Kubernetes ConfigMap and Secret Management

Help me implement proper ConfigMap and Secret management in Kubernetes.

Application needs:
- Configuration types: [app config, feature flags, env vars]
- Sensitive data: [API keys, database creds, certificates]
- Environments: [dev/staging/prod]
- Update frequency: [static/dynamic]

Requirements:
1. ConfigMap patterns
   - File-based configuration
   - Environment variables
   - Command-line arguments
   - Immutable ConfigMaps

2. Secret management
   - Encoding and encryption
   - External secret stores integration
   - Sealed Secrets
   - External Secrets Operator
   - HashiCorp Vault integration

3. Update strategies
   - Rolling updates on config change
   - Checksum annotations
   - Reloader controller

4. Security considerations
   - RBAC for secrets
   - Encryption at rest
   - Audit logging

Include examples for each pattern and best practices documentation.