Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

In our environment we keeping all configs in git repo and using argo for autodeploy. We have problem with kwatch deployment because we cannot keep webhook url outside configmap. We don't want to keep hook in plain text in configmap because there is secret key in hook url.

Describe the solution you'd like
A clear and concise description of what you want to happen.

Solution for that is to have ability to add env to config map eg. ${webhook-url} and add secret containing that url.
For example if we want to deploy kwatch with mattermost notification we add

    alert:
      mattermost:
          webhook: ${webhook-url}

to config map, create secret with that hook url and fixing deployment

          - name: webhook-url
            valueFrom:
              secretKeyRef:
                key: hook-from-secret
                name: name-of-secret

If it's help fluentbit is using secret and configmap to store username and pasword
https://docs.fluentbit.io/manual/administration/configuring-fluent-bit/yaml/environment-variables-section