I cannot comment on Vault as I have not tried it yet, but I am a happy user of sops for some deployments. In my case the secrets are stored in a sops-encrypted

I cannot comment on Vault as I have not tried it yet, but I am a happy user of sops for some deployments. In my case the secrets are stored in a sops-encrypted JSON file in the repository. Sops encrypts the secrets but keeps the JSON structure so changes to a specific secret can be tracked in git with a oneline change instead of a binary blob diff of the full file which is very nice.