Separating secrets from configuration?

[cwaldbieser]

Does Open OnDemand have a recommended way for separating secrets from the configuration file?
I'd like to be able to version our configuration-- maybe in a git repository, but I really don't want any secrets stored with it.

[johrstrom]

This may be more of an automation question. I know that puppet can store encrypted secrets. That's what we do at OSC. Alternatively, ansible can respond to multiple --extra-vars CLI arguments. So the idea with ansible would be you store some in git then others you put on the .gitignore list and share... some other way.