I've seen Python CLI apps for internal tooling being very maintainable and setting up a Makefile with an "install" task makes it easy for everyone in the team to get started.

> Simple, you get the secrets very rarely: at deployment.

Do you mean writing custom scripts to get secrets? Where do you store secrets in such a scenario? What if you need to change secrets at runtime.

Vault is nice in that you can fine grain access:

- ACLs which allow some team members to be responsible for setting secrets and other team members for using them,

- temporary credentials for well known DBMSs which helps secure logs from leaks,

- PKI Management,

- temporary SSH keys.

And more. Not sure how you'd get that with a deploy time script.