code: func NewCachingSecretManager(kubeClient clientset.Interface, getTTL manager.GetObjectTTLFunc) Manager {
  	getSecret := func(namespace, name string, opts metav1.GetOptions) (runtime.Object, error) {
  		return kubeClient.CoreV1().Secrets(namespace).Get(name, opts)
  	}
  	secretStore := manager.NewObjectStore(getSecret, clock.RealClock{}, getTTL, defaultTTL)
  	return &secretManager{
  		manager: manager.NewCacheBasedManager(secretStore, getSecretNames),
  	}
  }
docs: // NewCachingSecretManager creates a manager that keeps a cache of all secrets
  // necessary for registered pods.
  // It implements the following logic:
  // - whenever a pod is created or updated, the cached versions of all secrets
  //   are invalidated
  // - every GetObject() call tries to fetch the value from local cache; if it is
  //   not there, invalidated or too old, we fetch it from apiserver and refresh the
  //   value in cache; otherwise it is just fetched from cache