KIP-76 — Enable getting password from executable rather than passing as plaintext in config files

Discussion SecurityAdmin

KIP-76 proposes an `executable.password.enable` config that, when set, causes password-type configs (e.g. `ssl.keystore.password`) to be treated as shell commands whose stdout is the actual password rather than the literal password string. This avoids storing plaintext passwords in properties files by delegating retrieval to external tools such as secret managers or encrypted keystores.

Details