I got some help from my team:
The providers all work with Fleet managed agents, they are on by default.
${kubernetes_secrets.<default>.<somesecret>.<value>}should work in a Fleet managed agent policy. You can try entering that through the integrations configuration UI, which in theory should work.