Chef secrets or passwords ways to handle them

I am bootstrapping windows servers which need a password to join the domain. I was interested in what options this group has explored. @coderanger has a good blog on the options but I was curious if other options are available.

I’m in a similar situation, except I’m using realm to add Linux servers to windows AD. I’m curious also. Which blow did you read?