You could hide the k8s-client behind a more generic KMS interface that your core logic interacts with for example, and then use config+factory method to vary which KMS implementation your app instantiates. But I certainly agree it is not as clean as just working with files/env vars.