grafana(host): move secrets to SOPS

resources/chaosknoten/grafana/docker_compose/alertmanager.yaml.j2

@@ -34,7 +34,7 @@ receivers:
   - name: "ccchh-infrastructure-alerts"
     telegram_configs:
       - send_resolved: true
-        bot_token: {{ lookup("community.general.passwordstore", "noc/vm-secrets/chaosknoten/grafana/alertmanager_telegram_bot_token", create=false, missing="error") }}
+        bot_token: {{ lookup("community.sops.sops", "resources/chaosknoten/grafana/secrets.yaml", extract="['alertmanager_telegram_bot_token']") }}
         chat_id: -1002434372415
         parse_mode: HTML
         message: {{ "'{{ template \"alert-message.telegram.ccchh\" . }}'" }}

resources/chaosknoten/grafana/docker_compose/compose.yaml.j2

@@ -36,7 +36,7 @@ services:
     restart: unless-stopped
     environment:
       - GF_SECURITY_ADMIN_USER=admin
-      - "GF_SECURITY_ADMIN_PASSWORD={{ lookup("community.general.passwordstore", "noc/vm-secrets/chaosknoten/grafana/GF_SECURITY_ADMIN_PASSWORD", create=false, missing="error") }}"
+      - "GF_SECURITY_ADMIN_PASSWORD={{ lookup("community.sops.sops", "resources/chaosknoten/grafana/secrets.yaml", extract="['GF_SECURITY_ADMIN_PASSWORD']") }}"
     volumes:
       - ./configs/grafana.ini:/etc/grafana/grafana.ini
       - ./configs/grafana-datasource.yml:/etc/grafana/provisioning/datasources/datasource.yml
@@ -50,7 +50,7 @@ services:
     restart: unless-stopped
     environment:
       - PVE_USER=grafana@pve
-      - "PVE_PASSWORD={{ lookup("community.general.passwordstore", "noc/vm-secrets/chaosknoten/grafana/prometheus-exporter", create=false, missing="error") }}"
+      - "PVE_PASSWORD={{ lookup("community.sops.sops",  "resources/chaosknoten/grafana/secrets.yaml", extract="['prometheus-exporter']") }}"
       - PVE_VERIFY_SSL=false
     volumes:
       - /dev/null:/etc/prometheus/pve.yml

resources/chaosknoten/grafana/docker_compose/grafana.ini.j2

@@ -11,7 +11,7 @@ auto_login = true
 name = id.hamburg.ccc.de
 allow_sign_up = true
 client_id = grafana
-client_secret = {{ lookup("community.general.passwordstore", "noc/vm-secrets/chaosknoten/grafana/KEYCLOAK_SECRET", create=false, missing="error") }}
+client_secret = {{ lookup("community.sops.sops", "resources/chaosknoten/grafana/secrets.yaml", extract="['KEYCLOAK_SECRET']") }}
 scopes = openid email profile offline_access roles
 email_attribute_path = email
 login_attribute_path = username