Consider a file with user-read-only permissions, for example ...
-r--------+ admin secrets.txt
How can such a file be put under revision control, so that its contents remain secret, even from the revision control administrator?
Use GPG to encrypt the file before commiting to your repo.
Yes, it's cumbersome (you won't be able to diff/merge/etc. without decrypting first) but I can't conceive of any other way to skin this cat.
Store the secrets in a separate file (not under version control), and insert the secret content into the other file with a script or Puppet-like tool.
Working from this other answer, a simple example could be:
netjoin.sh.erb (stored in version control):
/etc/puppet/auth/getpwd (can also be stored in version control):
/etc/puppet/auth/passwd_ad (absolutely not in version control):