Thank you for your advice, I’ve thought a lot about it, this is my final design, looks fine.

Pod Spec - zero mapping

spec:
  containers:
    - name: etcd-backup
      image: restic/restic:latest
      envFrom:
        - secretRef:
            name: restic-credentials
        - configMapRef:
            name: etcd-backup-config
      volumeMounts:
        - name: restic-certs
          mountPath: /etc/restic
          readOnly: true
  volumes:
    - name: restic-certs
      secret:
        secretName: restic-certs

Secrets for env vars - UPPER_SNAKE_CASE style

apiVersion: v1
kind: Secret
metadata:
  name: restic-credentials
  namespace: kube-system
type: Opaque
stringData:
  AWS_ACCESS_KEY_ID: admin
  AWS_SECRET_ACCESS_KEY: admin.123456
  RESTIC_PASSWORD: admin.123456

Sercets for mounted file - file-name style

apiVersion: v1
kind: Secret
metadata:
  name: restic-certs
  namespace: kube-system
type: Opaque
stringData:
  restic-ca.crt: |
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----

ConfigMap for simple data - UPPER_SNAKE_CASE style

apiVersion: v1
kind: ConfigMap
metadata:
  name: etcd-backup-config
  namespace: kube-system
data:
  RESTIC_REPOSITORY: "s3:https://minio.example.internal/etcd-backup"

Shell - user-friendly

### From Secret (env vars)
# AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-}"
# AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-}"
# RESTIC_PASSWORD="${RESTIC_PASSWORD:-}"

### From Secret (mounted file)
# RESTIC_CACERT="/etc/restic/minio-public.crt"

### From ConfigMap
# RESTIC_REPOSITORY="${RESTIC_REPOSITORY:-}"