How to securely slip an opvn certificate into a docker container?

Question

openvpn

I use the bitbucket pipeline for deployment with my public container, based on the debian image with pre-installed shh and openvpn client.
How to safely store the ovpn config, or how to transfer it to a container so that it can be deployed to a circuit closed by a vpn.
bitbucket ssh stores keys as secrets, but ovpn does not.
You can also store variables as secrets (which is also an option) if the config leaks, then there is no password.
Who deploys to protected circuits with btbucket?