One identity

An application or managed identity, federated to the deployment environment — no secret is exchanged. Four rights: cluster admin through the control plane, vault secrets, registry push, group read.

One vault

With the named secrets. The names are in the repository; the values never are.

One sheet of facts

Subscription, cluster, the pool labels the portals pin to, ingress class and TLS, storage classes, registry, database, the host and its zone.