I'm guessing my brain has been permanently warped by working in a hashistack environment for the last 5+ years. All of these KV pairs are always either in a consul (bog-standard config information) or vault (secrets/credentials) in a consul-template associated with the job - and rendered at run time. And, of course - critically - the consul-template updates those credentials and values as they are routinely rotated.

I did a ^F for "update" and "dynamic" - didn't find any hits in that doc. Managing your dynamic environment values is table-stakes in most large deployments - and I didn't see any reference in `secretspec` as to how they plan to do that.