I have JupyterHub running on a kubernetes cluster in AWS EKS (managed kubernetes on AWS).

I need to know if there is any way for me to store or configure a sensitive secret that can be accessed during a notebook server instance startup, but only by the server processes. It should never be accessible by any normal users or malicious users.

Specifically, I have a custom "postStart" step, configured in my helm chart:

proxy:
  # ...

auth
  # ...

singleuser:
  image:
    # ...
  lifecycleHooks:
    postStart:
      exec:
        command: ["/bin/sh", "-c", "custom-program -password abcdefg12345"] # <-- THIS. 

How can I safely store my password, e.g. abcdefg12345 above, so that it can never be accessible to any users of the JupyterHub cluster? (Except admins)

Would it be safe in the helm chart config file? Where does helm store the postStart lifecycleHook command?