Currently we can see pliantext of pk password via command line, and --cache-password won't work for caching --pk_password.
Just make:
ovpncli client.ovpn --pk-password $(/etc/openvpn/client.pass)
To:
ovpncli client.ovpn --pk-password-file /etc/openvpn/client.pass
Or:
export OVPN_PK_PASSWORK_FILE=/etc/openvpn/client.pass
ovpncli client.ovpn
Will be fine enough.