There's an optional but very helpful sixth step: expose the loaded configuration (by pushing it to the logs, or as a /_config endpoint). For secrets, obviously

There's an optional but very helpful sixth step: expose the loaded configuration (by pushing it to the logs, or as a /_config endpoint). For secrets, obviously don't expose the secret value itself, but do expose the vault address, secret identifier, and which version of the secret was loaded. This helps check that an application isn't using an outdated version of a secret.