How to manage application configurations / environment variables in production

Question

I read several articles that state that application configurations / parameters should be stored outside version control and set as environment variables in the production environment.

My question is: how do you manage these environment variables?

Using a configuration management tool such as Puppet? What if you are deploying a new version of your application and you need to add new configuration variables?

Your deployment scenarios will probably also be in version control, so if you set any production variable, everyone with access to the deployment will be able to see it. (and tools like Capistrano store deployment scripts along with the application source code.)

What is the common practice for this? Thank you for your help.