How do pipeline jobs access secrets?

Pipeline jobs, e.g. simpipe, need to talk to a database. For this they need connection credentials.

This need to be available in the job running in WMS.

The obvious way would be to set them via environment variables for the job.

If that is the solution:

• Who makes sure the job as that environment variable setup?
• How does the system or the operator now the correct credentials to set?