Nomad falls square in the middle between Swarm and k8s in terms of operational complexity. While it's the closest for your use-case I can think of, I still fee

Nomad falls square in the middle between Swarm and k8s in terms of operational complexity. While it's the closest for your use-case I can think of, I still feel it requires more resources to operate properly than what you're looking for: While there's some early functionality for Nomad to do both secrets and services independently, it still seems that you're looking at min 3xnomad servers + 3xconsul servers + 2xvault servers + whatever clients you have to actually run workloads - and make sure you have proper monitoring and alerts for consensus and cert/token rotations. Another angle to consider would be - do you actually need the dynamic scheduling part? If not, you can simplify things a lot by going to systemd+podman and instrument it all with ansible (or what-have-you). If you want the deployment UX to be more developer-friendly you can host Dokku or something on top of that.