How to set Docker credentials from a K8s secret

[michizubi-SRF]

It is unclear in the documentation, at least I didn't find it, how to set Docker or any other registry credentials from a K8s secret.
There's
# -- Provide an existing Secret within the cluster to use for authentication and configuration of version-checker existingSecret: ""
but it is unclear how this secret needs to be formatted for the client to be correctly used as registry credentials.
I don't want to set the credentials as plain text strings in values.yaml as this file will be checked in version control.

[michizubi-SRF]

In case anyone is interested in this.
I created an ExternalSecret that contains docker.username and docker.password. This is read by the _pod_helpers method and added as ENV vars to the container. In the values.yaml file those two variables need to be set with dummy values to be templated by Helm.

{{- if .Values.docker.username }}
  - name: VERSION_CHECKER_DOCKER_USERNAME
    valueFrom:
      secretKeyRef:
        name: {{ $chartname }}
        key: docker.username
  {{- end }}