Python world analog of Rails encrypted credentials feature (to store secrets securely)

Are the Python analogs of encrypted credentials Rails feature?

Quote from Rails Guides on subject:

Rails stores secrets in config/credentials.yml.enc, which is encrypted and hence cannot be edited directly. Rails uses config/master.key or alternatively looks for the environment variable ENV["RAILS_MASTER_KEY"] to encrypt the credentials file. Because the credentials file is encrypted, it can be stored in version control, as long as the master key is kept safe.

To edit the credentials file, run bin/rails credentials:edit. This command will create the credentials file if it does not exist. Additionally, this command will create config/master.key if no master key is defined.

Secrets kept in the credentials file are accessible via Rails.application.credentials.

My idea is:

• to have all the secrets encrypted in repository;
• to have locally only master.key (or only one env variable);
• to once pass manually to production server master.key;
• then pass other secrets by git through automated deployment process.