For a bunch of secrets in the config file, we already allow to alternatively read it from a file, e.g. if there is a password field, there is also a password_file field. Only one of those may be used.

However, we do not offer this behavior consistently. Occasionally, we get feature requests to allow it for particular fields. This issue proposes to just consistently offer the feature for all secrets in general (exceptions might be possible or even required in particular cases, but those would then be exceptions and not just the normal case).

See also this discussion.

Note that the semantics generally is to read the secret from the file for each new request (so that password rotation works seamlessly). Exceptions need to be documented clearly (but ideally, we would avoid those entirely). Cf. a previous issue about this: #6140

Also note that for consistency with the already quite frequent existing usage, we won't go for a new YAML construct like

secret:
  type: file
  file: "/etc/my-secrets/..."

This could be considered for a future release, though.