Masking DB passwords from Developers

I’m trying to make a stack in the rancher gui that uses several database passwords that we’d like to hide from the developers.
Is there a way for a Rancher stack to read those passwords from a secured file? Is there a recommended way to achieve this?