Another option is to use saltstack's product: salt
This Configuration Management System (CMS) can protect sensitive data in three ways.
1) Pillars; these are securely stored and encrypted key:value or key:list dictionaries stored on your primary computer(s) that you manage the entire cluster from.
This will allow you to create salt scripts that can have that data inserted at time of running into the scripts (so not stored in the actual scripts).
2) GPG cipher; this allows you to write in actual passwords and keys into scripts and have them encrypted into hashes as placeholders for when you store these scripts into a revision control system (github/gitlab/bitbucket).
The GPG key used for encrypting/decrypting is stored on your primary computer (master) for managing the cluster.
3) Salt-cloud; all of your salt scripts are stored in the /srv/salt/
directory on the primary machine, however the credentials/keys for spinning up VMs in the cloud is stored in /etc/salt/
directory.
This allows you to store the work you share with other people on a project in github, but all the sensitive data salt needs to spin up more resources isnt even in the same directory to be recorded.
This will probably super simplify your devops related code as well if you end up using this product.
Resources:
- GPG Render
- salt-cloud
- pillars