For variables that should remain secret, like an authorization bearer token, or a database password, how do you guys recommend injecting these variables into a data flow?

Because of how Kubernetes work and how it is recommended (single user inside of container, etc) secrets management will not add additional security on top of just that as everyone with write access will have access to all the secrets anyway. There are some techniques to hide it from a read only user though (i think ev variables, etc)