You may consider provisioning the key to the VMs; very often there's insufficient entropy to generate them on their own, for one. You then provision the secret

You may consider provisioning the key to the VMs; very often there's insufficient entropy to generate them on their own, for one. You then provision the secrets to the containers via some form of service discovery mechanism; vault/console work, as do providing it as user-data in some configurations. It's going to come down to your use case and constraints; things that I do for Twitter For Pets may not work well for your bank, as an example.