I'm currently taking advantages of SaltStack's GPG renderer to store secrets in our version-controlled Salt code (see https://docs.saltstack.com/en/latest/ref/renderers/all/salt....).