Exactly. For robotic accounts, cloud providers usually even come with a vault solution (Azure keyvault, etc.) that is audited. Those vaults can be integrated i

Exactly. For robotic accounts, cloud providers usually even come with a vault solution (Azure keyvault, etc.) that is audited. Those vaults can be integrated in kube/openshift and seen as secrets directly by applications. For human users, SSO is a must, otherwise a password manager that also gets audited. PCI-DSS audit would require this kind of things.