env pushed to kubernetes deployments: use Secrets

[thomas-riccardi]

We currently use ConfigMaps to push env to the kubernetes deployments; it may contain secrets so we should use Secrets instead.

Use-cases:

• for example some k8s roles can give ConfigMap access but not Secrets
• more generally, the whole k8s ecosystem already handle secrets differently, let's use that.

Maybe add an opt-out to keep ConfigMaps? not a priority.