Comment by Crystalin

It also depends on how secret it needs to be. For most of our secrets (those used for configuration) we use Consul.