Plugin
configuration-management-design
Service configuration — key catalog per category (infra / business tunables / feature flags) with type + default + validation + scope + reload, precedence (flags > env > remote > file > defaults), per-category source (env / vault+KMS / remote-config / flag service), start-up schema validation fail-fast, secrets never in repo via External Secrets Operator + workload identity + rotation + audit, hot-reload only where safe, config drift fingerprint + alerts, feature-flag categories (release/ops/experiment/permission/big) with owner + removal plan + quarterly cleanup.