I am using Config map from storing my variable (DB password). This config is part of git repo. Now this will be part of git history. What is the right way to fix it? I mean, is it possible, I use pulumi for entire GKE infra and manually add secrets on Google Console.

pulumi allows you to store secrets in configuration data, see https://www.pulumi.com/docs/intro/concepts/secrets/#secrets