When you deploy a traditionally configured application to the server you will have a bazillion credentials to access different stuff like databases, external sy

When you deploy a traditionally configured application to the server you will have a bazillion credentials to access different stuff like databases, external systems. Think how you are going to secure that key store you need for SSL? What is the point of having it encrypted when the password lies in a configuration file two folders away? Vaults like this allow you to not have that cryptographic material on the server. Now, this doesn't solve all problems. As you mentioned, when you have breached server security you have access to everything. But, there are other problematic situations that this helps solve. Now you don't have to provide secrets when you are building images and you will not have secrets on the filesystem when somebody only gains partial access that lets him only read files. This also lets you see who and when is accessing secrets and lets you manage secrets (think how you are going to replace database password?)