You are developing an application with multiple microservices deployed in a Google Kubernetes Engine (GKE) cluster. One microservice requires a connection to an on-premises third-party database. How should you securely store and manage the database credentials while enabling credential rotation in alignment with security best practices?