diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index d4173b6..4af6559 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -15,9 +15,30 @@ push:staging:
     - apk update && apk add gettext
   script:
     - export $(cat $ENV | xargs)
-    - for namespace in namespaces/*.yaml; do envsubst < $namespace > $namespace.tmp; mv $namespace.tmp $namespace; done
-    - for svc in common-services/*/*.yaml; do envsubst < $svc > $svc.tmp; mv $svc.tmp $svc; done
-    - for val in values/*.yaml; do envsubst < $val > $val.tmp; mv $val.tmp $val; done
+    - echo "Update namespaces"
+    - |
+      for namespace in namespaces/*.yaml;
+      do envsubst < $namespace > $namespace.tmp;
+      mv $namespace.tmp $namespace;
+      done
+    - echo "Update manifests"
+    - |
+      for svc in manifests/common-services/*/*.yaml;
+      do envsubst < $svc > $svc.tmp; mv $svc.tmp $svc;
+      done
+    - echo "Deploy secrets"
+    - |
+      for secret in secrets/*.yaml;
+      do envsubst < $secret | kubectl apply -f -;
+      done
+    - echo "Deploy values ConfigMaps"
+    - |
+      for val in values/*.yaml;
+      do envsubst < $val > $val.tmp;
+      kubectl create configmap -n manifests/common-services $(basename "${val%.*}")-values -o yaml --dry-run=client --from-file=$val.tmp | kubectl apply -f -;
+      rm $val.tmp;
+      done
+    - echo "Pushing updated manifests in ${} branch"
     - |
       git config user.name "Bot Auto Deploy"
       git config user.email "autodeploy@mediactivegroup.com"
diff --git a/common-services/gitlab-agent/secrets.yaml b/common-services/gitlab-agent/secrets.yaml
deleted file mode 100644
index e3c87cd..0000000
--- a/common-services/gitlab-agent/secrets.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: gitlab-agent-token
-  namespace: common-services
-type: Opaque
-stringData:
-   token: "${GITLAB_AGENT_TOKEN}"
diff --git a/common-services/gitlab-runner/secrets.yaml b/common-services/gitlab-runner/secrets.yaml
deleted file mode 100644
index 63b3a0f..0000000
--- a/common-services/gitlab-runner/secrets.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: gitlab-runner-token
-  namespace: common-services
-type: Opaque
-data:
-  runner-registration-token: "" # need to leave as an empty string for compatibility reasons
-  runner-token: ${GITLAB_RUNNER_TOKEN}
diff --git a/flux/staging/flux-system/gotk-sync.yaml b/flux/staging/flux-system/gotk-sync.yaml
index 3b7921e..8518386 100644
--- a/flux/staging/flux-system/gotk-sync.yaml
+++ b/flux/staging/flux-system/gotk-sync.yaml
@@ -46,7 +46,7 @@ metadata:
   namespace: flux-system
 spec:
   interval: 1m0s
-  path: ./common-services
+  path: ./manifests/common-services
   prune: true
   sourceRef:
     kind: GitRepository
diff --git a/common-services/cert-manager/certificate.yaml b/manifests/common-services/cert-manager/certificate.yaml
similarity index 94%
rename from common-services/cert-manager/certificate.yaml
rename to manifests/common-services/cert-manager/certificate.yaml
index 9d2dde5..000cd4a 100644
--- a/common-services/cert-manager/certificate.yaml
+++ b/manifests/common-services/cert-manager/certificate.yaml
@@ -40,16 +40,6 @@ spec:
         ingress:
           class: traefik
 
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cloudflare-api-token-secret
-  namespace: common-services
-type: Opaque
-stringData:
-  api-token: ${CERT_MANAGER_CLOUDFLARE_API_TOKEN}
-
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
@@ -104,6 +94,7 @@ spec:
             name: cloudflare-api-token-secret
             key: api-token
 
+# TODO: décommenter et template ce certificat
 #---
 #apiVersion: cert-manager.io/v1
 #kind: Certificate
diff --git a/common-services/cert-manager/release.yaml b/manifests/common-services/cert-manager/release.yaml
similarity index 91%
rename from common-services/cert-manager/release.yaml
rename to manifests/common-services/cert-manager/release.yaml
index 7cb3907..b543af8 100644
--- a/common-services/cert-manager/release.yaml
+++ b/manifests/common-services/cert-manager/release.yaml
@@ -27,5 +27,6 @@ spec:
         kind: HelmRepository
         name: jetstack
         namespace: common-services
-      valuesFiles:
-        - ../values/cert-manager.yaml
+  valuesFrom:
+    - kind: ConfigMap
+      name: cert-manager-values
diff --git a/common-services/gitlab-agent/release.yaml b/manifests/common-services/gitlab-agent/release.yaml
similarity index 100%
rename from common-services/gitlab-agent/release.yaml
rename to manifests/common-services/gitlab-agent/release.yaml
diff --git a/common-services/gitlab-runner/release.yaml b/manifests/common-services/gitlab-runner/release.yaml
similarity index 88%
rename from common-services/gitlab-runner/release.yaml
rename to manifests/common-services/gitlab-runner/release.yaml
index 8aed21e..c20e91b 100644
--- a/common-services/gitlab-runner/release.yaml
+++ b/manifests/common-services/gitlab-runner/release.yaml
@@ -23,5 +23,6 @@ spec:
         kind: HelmRepository
         name: gitlab-runner
         namespace: common-services
-      valuesFiles:
-        - ../values/gitlab-runner.yaml
+  valuesFrom:
+    - kind: ConfigMap
+      name: gitlab-runner-values
diff --git a/common-services/grafana/release.yaml b/manifests/common-services/grafana/release.yaml
similarity index 89%
rename from common-services/grafana/release.yaml
rename to manifests/common-services/grafana/release.yaml
index f70b30a..f4edb1e 100644
--- a/common-services/grafana/release.yaml
+++ b/manifests/common-services/grafana/release.yaml
@@ -22,5 +22,6 @@ spec:
         kind: HelmRepository
         name: grafana
         namespace: common-services
-      valuesFiles:
-        - ../values/grafana.yaml
+  valuesFrom:
+    - kind: ConfigMap
+      name: grafana-values
diff --git a/common-services/mariadb/mariadb-ingressroutetcp.yaml b/manifests/common-services/mariadb/mariadb-ingressroutetcp.yaml
similarity index 100%
rename from common-services/mariadb/mariadb-ingressroutetcp.yaml
rename to manifests/common-services/mariadb/mariadb-ingressroutetcp.yaml
diff --git a/common-services/mariadb/release.yaml b/manifests/common-services/mariadb/release.yaml
similarity index 89%
rename from common-services/mariadb/release.yaml
rename to manifests/common-services/mariadb/release.yaml
index 6b65ade..1b73416 100644
--- a/common-services/mariadb/release.yaml
+++ b/manifests/common-services/mariadb/release.yaml
@@ -23,5 +23,6 @@ spec:
         kind: HelmRepository
         name: bitnami
         namespace: common-services
-      valuesFiles:
-        - ../values/mariadb.yaml
+  valuesFrom:
+    - kind: ConfigMap
+      name: mariadb-values
diff --git a/common-services/prometheus/release.yaml b/manifests/common-services/prometheus/release.yaml
similarity index 89%
rename from common-services/prometheus/release.yaml
rename to manifests/common-services/prometheus/release.yaml
index 77723ff..ab75005 100644
--- a/common-services/prometheus/release.yaml
+++ b/manifests/common-services/prometheus/release.yaml
@@ -22,5 +22,6 @@ spec:
         kind: HelmRepository
         name: prometheus-community
         namespace: common-services
-      valuesFiles:
-        - ../values/prometheus.yaml
+  valuesFrom:
+    - kind: ConfigMap
+      name: prometheus-values
diff --git a/common-services/shinken-monitoring/manifest.yaml b/manifests/common-services/shinken-monitoring/manifest.yaml
similarity index 100%
rename from common-services/shinken-monitoring/manifest.yaml
rename to manifests/common-services/shinken-monitoring/manifest.yaml
diff --git a/common-services/traefik/middlewares.yaml b/manifests/common-services/traefik/middlewares.yaml
similarity index 100%
rename from common-services/traefik/middlewares.yaml
rename to manifests/common-services/traefik/middlewares.yaml
diff --git a/common-services/traefik/release.yaml b/manifests/common-services/traefik/release.yaml
similarity index 89%
rename from common-services/traefik/release.yaml
rename to manifests/common-services/traefik/release.yaml
index 06acf39..ba7d62b 100644
--- a/common-services/traefik/release.yaml
+++ b/manifests/common-services/traefik/release.yaml
@@ -22,5 +22,6 @@ spec:
         kind: HelmRepository
         name: traefik
         namespace: common-services
-      valuesFiles:
-        - ../values/traefik.yaml
+  valuesFrom:
+    - kind: ConfigMap
+      name: traefik-values
diff --git a/common-services/user-config/manifest.yaml b/manifests/common-services/user-config/manifest.yaml
similarity index 100%
rename from common-services/user-config/manifest.yaml
rename to manifests/common-services/user-config/manifest.yaml
diff --git a/velero/manifest.yaml b/manifests/velero/manifest.yaml
similarity index 100%
rename from velero/manifest.yaml
rename to manifests/velero/manifest.yaml
diff --git a/namespaces/common-services.yaml b/namespaces/common-services.yaml
index b5f2126..b0ba5f7 100644
--- a/namespaces/common-services.yaml
+++ b/namespaces/common-services.yaml
@@ -3,15 +3,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: common-services
-
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: docker-registry-credentials
-  namespace: common-services
-type: kubernetes.io/dockerconfigjson
-data:
-  # Uses a deployment token defined on the "LDC Web" group (docker-registry-credentials)
-  .dockerconfigjson: >-
-    ${DOCKER_AUTH_CONFIG}
diff --git a/namespaces/production.yaml b/namespaces/production.yaml
index 1b2d13b..d5659fb 100644
--- a/namespaces/production.yaml
+++ b/namespaces/production.yaml
@@ -3,15 +3,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: production
-
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: docker-registry-credentials
-  namespace: production
-type: kubernetes.io/dockerconfigjson
-data:
-  # Uses a deployment token defined on the "LDC Web" group (docker-registry-credentials)
-  .dockerconfigjson: >-
-    ${DOCKER_AUTH_CONFIG}
diff --git a/namespaces/review.yaml b/namespaces/review.yaml
index 44f792a..bb37057 100644
--- a/namespaces/review.yaml
+++ b/namespaces/review.yaml
@@ -3,15 +3,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: review
-
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: docker-registry-credentials
-  namespace: review
-type: kubernetes.io/dockerconfigjson
-data:
-  # Uses a deployment token defined on the "LDC Web" group (docker-registry-credentials)
-  .dockerconfigjson: >-
-    ${DOCKER_AUTH_CONFIG}
diff --git a/namespaces/staging.yaml b/namespaces/staging.yaml
index 5c14815..2c4cc75 100644
--- a/namespaces/staging.yaml
+++ b/namespaces/staging.yaml
@@ -3,15 +3,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: staging
-
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: docker-registry-credentials
-  namespace: staging
-type: kubernetes.io/dockerconfigjson
-data:
-  # Uses a deployment token defined on the "LDC Web" group (docker-registry-credentials)
-  .dockerconfigjson: >-
-    ${DOCKER_AUTH_CONFIG}
diff --git a/namespaces/velero.yaml b/namespaces/velero.yaml
index 309feb1..7dd5bd7 100644
--- a/namespaces/velero.yaml
+++ b/namespaces/velero.yaml
@@ -3,15 +3,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: velero
-
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: docker-registry-credentials
-  namespace: velero
-type: kubernetes.io/dockerconfigjson
-data:
-  # Uses a deployment token defined on the "LDC Web" group (docker-registry-credentials)
-  .dockerconfigjson: >-
-    ${DOCKER_AUTH_CONFIG}
diff --git a/secrets/common-services.yaml b/secrets/common-services.yaml
new file mode 100644
index 0000000..4dfec4e
--- /dev/null
+++ b/secrets/common-services.yaml
@@ -0,0 +1,60 @@
+---
+
+### common-services ###
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: docker-registry-credentials
+  namespace: common-services
+type: kubernetes.io/dockerconfigjson
+data:
+  # Uses a deployment token defined on the "LDC Web" group (docker-registry-credentials)
+  .dockerconfigjson: >-
+    ${DOCKER_AUTH_CONFIG}
+
+---
+
+### cert-manager ###
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflare-api-token-secret
+  namespace: common-services
+type: Opaque
+stringData:
+  api-token: ${CERT_MANAGER_CLOUDFLARE_API_TOKEN}
+
+---
+
+### gitlab-agent ###
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitlab-agent-token
+  namespace: common-services
+type: Opaque
+stringData:
+   token: "${GITLAB_AGENT_TOKEN}"
+
+---
+
+### gitlab-runner ###
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitlab-runner-token
+  namespace: common-services
+type: Opaque
+data:
+  runner-registration-token: "" # need to leave as an empty string for compatibility reasons
+  runner-token: ${GITLAB_RUNNER_TOKEN}
+
+---
diff --git a/secrets/production.yaml b/secrets/production.yaml
new file mode 100644
index 0000000..feb8e60
--- /dev/null
+++ b/secrets/production.yaml
@@ -0,0 +1,15 @@
+---
+
+### production ###
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: docker-registry-credentials
+  namespace: production
+type: kubernetes.io/dockerconfigjson
+data:
+  # Uses a deployment token defined on the "LDC Web" group (docker-registry-credentials)
+  .dockerconfigjson: >-
+    ${DOCKER_AUTH_CONFIG}
diff --git a/secrets/review.yaml b/secrets/review.yaml
new file mode 100644
index 0000000..4da5c0b
--- /dev/null
+++ b/secrets/review.yaml
@@ -0,0 +1,15 @@
+---
+
+### review ###
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: docker-registry-credentials
+  namespace: review
+type: kubernetes.io/dockerconfigjson
+data:
+  # Uses a deployment token defined on the "LDC Web" group (docker-registry-credentials)
+  .dockerconfigjson: >-
+    ${DOCKER_AUTH_CONFIG}
diff --git a/secrets/staging.yaml b/secrets/staging.yaml
new file mode 100644
index 0000000..4b5c9ff
--- /dev/null
+++ b/secrets/staging.yaml
@@ -0,0 +1,15 @@
+---
+
+### staging ###
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: docker-registry-credentials
+  namespace: staging
+type: kubernetes.io/dockerconfigjson
+data:
+  # Uses a deployment token defined on the "LDC Web" group (docker-registry-credentials)
+  .dockerconfigjson: >-
+    ${DOCKER_AUTH_CONFIG}