Kubernetes native secrets management is not very good, so you're going to end up using Vault either way.