If the service doesn't support loading passwords from a separate file, it's time to get creative.

foo_service --config-file <(sed -e 's/^\( *password:\).*/\1 '"$(cat "${CREDENTIALS_DIRECTORY}/my_password")"'/' config.yaml)

#systemd #Linux #security #SysAdmin