How to handle different credentials in continuous integration?
I'm not familiar with teamcity, but you can :


add a config folder in your repo, and inside this repo
create three files (staging.yml, preprod.yml, prod.yml). 
on each file you will write down variables specific to each
environment, and apply them within pipeline.


For secrets, it's cautious to handle that manually or better use Vault.

To not throw on error your pipeline/pods, set secrets as optional that could help if you want to set them later.