> Using their suggested YAML format leads to another problem: there's no easy way to keep secrets outside of the configuration files, unless you build your own process around it

Isn’t that what the Secrets resources are for? Just use those, and mount them into your containers in the filesystem or environment variables.