Add `PushSecret` config for Ceph RGW buckets for Thanos

[onedr0p]

I am manually syncing the s3 key and secret key secrets to 1Password, this can change if the below PR gets merged and a release is cut.

https://github.com/external-secrets/external-secrets/pull/2646

---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/pushsecret_v1alpha1.json
apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: thanos-rgw
spec:
  secretStoreRefs:
    - name: onepassword-connect
      kind: ClusterSecretStore
  selector:
    secret:
      name: thanos-bucket-v2
  data:
    - match:
        secretKey: AWS_ACCESS_KEY_ID
        remoteRef:
          remoteKey: thanos-rgw
    - match:
        secretKey: AWS_SECRET_ACCESS_KEY
        remoteRef:
          remoteKey: thanos-rgw

[onedr0p]

Now running into https://www.github.com/external-secrets/external-secrets/issues/3130

[onedr0p]

Closing this issue out since I believe I can pre-set the secret and it can be used by both clusters.

[onedr0p]

This is still needed since I cannot pre-create the bucket secrets

[onedr0p]

Closing issue, looks like this was fixed in external-secrets. I just need to switch to the release image on helm chart update.