Thanks for reading and for your great question.

You are absolutely true: the secret access can cost resource and latency.

As specified at the end, it's a matter of tradeoff. If you don't need to hot reload your secrets on the fly, reading secrets only once (using environment variable) is the best.

Your proposed solution, to notify a secret change by PubSub notification is interesting but works in 1 and only in 1 specific use case: set max instance equal to 1.

Indeed, the PubSub notification will reach ONLY ONE instance of the service and only this instance will process the event and update its secret. All the other instances won't receive the notification and won't update the secret. Except if you can ensure that you will have 1 and only 1 instance, therefore the max equal to 1