These are NOT secrets (from the ConfigMap, prefix CONFIG_):
  CONFIG_APP_ENV=dev
  CONFIG_FEATURE_X_ENABLED=true
  CONFIG_LOG_LEVEL=info

These ARE secrets (from the Secret, prefix SECRET_):
  SECRET_API_KEY=dem******key
  SECRET_DB_PASSWORD=cha***-me
  SECRET_SMTP_PASSWORD=dem************ord