In order to run keystone-manage and a k8s client, we need an image containing both. Alternatively, the run command could call the k8s api directly, to modify the secret value.