One issue with this strategy is that you can now only deploy that container/image on hosts with the file containing the image-specific secrets. If you want to

One issue with this strategy is that you can now only deploy that container/image on hosts with the file containing the image-specific secrets. If you want to have a large pool of generic hosts that can run any image, then you've just reduced the size of the pool for some images. If you choose instead to make every secret available to every host, then you've just spread your individual application secrets across many hosts.