enable grafana agent read load secrets using externalsecrets

apps/grafana/release.yaml

@@ -171,3 +171,11 @@ spec:
           selector:
             matchLabels:
               scrape-service-metrics: "true"
+      - apiVersion: v1
+        kind: ServiceAccount
+        metadata:
+          annotations:
+            eks.amazonaws.com/role-arn: arn:aws:iam::${flux_workload_account_id}:role/grafana-irsa
+            eks.amazonaws.com/sts-regional-endpoints: "true"
+          name: grafana
+          namespace: grafana

apps/grafana/secretstore-1password.yaml

@@ -0,0 +1,16 @@
+apiVersion: external-secrets.io/v1
+kind: SecretStore
+metadata:
+  name: grafana-1password
+  namespace: grafana
+spec:
+  provider:
+    onepassword:
+      connectHost: http://onepassword-connect.1password-connect.svc.cluster.local:8080
+      vaults:
+        CloudEng-General: 1
+      auth:
+        secretRef:
+          connectTokenSecretRef:
+            name: onepassword-basic-auth
+            key: 1password-connect-token

apps/grafana/secretstore-ssm.yaml

@@ -0,0 +1,14 @@
+apiVersion: external-secrets.io/v1
+kind: SecretStore
+metadata:
+  name: grafana-ssm
+  namespace: grafana
+spec:
+  provider:
+    aws:
+      service: ParameterStore
+      region: eu-west-1
+      auth:
+        jwt:
+          serviceAccountRef:
+            name: grafana