feat: configure Grafana admin credentials via ExternalSecret in kube-prometheus-stack values

manifest/kube-prometheus-stack/values.yaml

@@ -1375,7 +1375,7 @@ grafana:
   # Use an existing secret for the admin user.
   admin:
     ## Name of the secret. Can be templated.
-    existingSecret: ""
+    existingSecret: "grafana-admin-secret"
     userKey: admin-user
     passwordKey: admin-password
 
@@ -5620,7 +5620,30 @@ cleanPrometheusOperatorObjectNames: false
 ## Extra manifests to deploy.  Can be of type dict or list.
 ## If dict, keys are ignored and only values are used.
 ## Items contained within extraObjects can be defined as dict or string and are passed through tpl.
-extraManifests: null
+extraManifests:
+  - apiVersion: external-secrets.io/v1beta1
+    kind: ExternalSecret
+    metadata:
+      name: grafana-admin-secret
+      namespace: kube-prometheus-stack
+    spec:
+      refreshInterval: 1h
+      secretStoreRef:
+        name: vault-backend
+        kind: ClusterSecretStore
+      target:
+        name: grafana-admin-secret
+        creationPolicy: Owner
+        template:
+          engineVersion: v2
+          data:
+            admin-user: "admin"
+            admin-password: "{{ .password }}"
+      data:
+        - secretKey: password
+          remoteRef:
+            key: grafana-admin-password
+            property: password
   # - apiVersion: v1
   #   kind: ConfigMap
   #   metadata: