I currently have a few servers that are managed by saltstack, every now and then saltstack fails to deploy the new configs because of an issue somewhere and it can take a while to work out what changed that caused the issue.
It seems like having some kind of version control system for these configs would solve this problem but storing sensitive info such as the api keys and app secrets that are in these configs in a git repo is always advised against.
Is using git or similar the right way to go about this? Is there any other better way?