One question resolves almost every config-placement decision.
If this value leaked, would that be an inconvenience or an incident?
ValueRight home
Database passwordSecret Manager
Database hostname/portParameter Manager / ConfigMap
Feature-flag booleanParameter Manager
TLS private keyCertificate Manager + Secret Manager
Inconvenience-tier → ConfigMap or Parameter Manager. Incident-tier → Secret Manager, full stop.