community.general.onepassword_info – Gather items from 1Password

Note

This plugin is part of the community.general collection (version 1.3.6).

To install it use: ansible-galaxy collection install community.general.

To use it in a playbook, specify: community.general.onepassword_info.

Synopsis

  • community.general.onepassword_info wraps the op command line utility to fetch data about one or more 1Password items.

  • A fatal error occurs if any of the items being searched for can not be found.

  • Recommend using with the no_log option to avoid logging the values of the secrets being retrieved.

  • This module was called onepassword_facts before Ansible 2.9, returning ansible_facts. Note that the community.general.onepassword_info module no longer returns ansible_facts! You must now use the register option to use the facts in other tasks.

Requirements

The below requirements are needed on the host that executes this module.

Parameters

Parameter Choices/Defaults Comments
auto_login
dictionary
Default:
{}
A dictionary containing authentication details. If this is set, community.general.onepassword_info will attempt to sign in to 1Password automatically.
Without this option, you must have already logged in via the 1Password CLI before running Ansible.
It is highly recommended to store 1Password credentials in an Ansible Vault. Ensure that the key used to encrypt the Ansible Vault is equal to or greater in strength than the 1Password master password.
master_password
string / required
The master password for your subdomain.
This is always required when specifying auto_login.
secret_key
string
The secret key for your subdomain.
Only required for initial sign in.
subdomain
string
1Password subdomain name (<subdomain>.1password.com).
If this is not specified, the most recent subdomain will be used.
username
string
1Password username.
Only required for initial sign in.
cli_path
path
Default:
"op"
Used to specify the exact path to the op command line interface
search_terms
list / elements=string / required
A list of one or more search terms.
Each search term can either be a simple string or it can be a dictionary for more control.
When passing a simple string, field is assumed to be password.
When passing a dictionary, the following fields are available.
field
string
The name of the field to search for within this item (optional, defaults to "password" (or "document" if the item has an attachment).
name
string
The name of the 1Password item to search for (required).
section
string
The name of a section within this item containing the specified field (optional, will search all sections if not specified).
vault
string
The name of the particular 1Password vault to search, useful if your 1Password user has access to multiple vaults (optional).

Notes

Note

  • Tested with op version 0.5.5

  • Based on the onepassword lookup plugin by Scott Buchanan <sbuchanan@ri.pn>.

  • When this module is called with the deprecated onepassword_facts name, potentially sensitive data from 1Password is returned as Ansible facts. Facts are subject to caching if enabled, which means this data could be stored in clear text on disk or in a database.

Examples

# Gather secrets from 1Password, assuming there is a 'password' field:
- name: Get a password
  community.general.onepassword_info:
    search_terms: My 1Password item
  delegate_to: localhost
  register: my_1password_item
  no_log: true         # Don't want to log the secrets to the console!

# Gather secrets from 1Password, with more advanced search terms:
- name: Get a password
  community.general.onepassword_info:
    search_terms:
      - name:    My 1Password item
        field:   Custom field name       # optional, defaults to 'password'
        section: Custom section name     # optional, defaults to 'None'
        vault:   Name of the vault       # optional, only necessary if there is more than 1 Vault available
  delegate_to: localhost
  register: my_1password_item
  no_log: True                           # Don't want to log the secrets to the console!

# Gather secrets combining simple and advanced search terms to retrieve two items, one of which we fetch two
# fields. In the first 'password' is fetched, as a field name is not specified (default behaviour) and in the
# second, 'Custom field name' is fetched, as that is specified explicitly.
- name: Get a password
  community.general.onepassword_info:
    search_terms:
      - My 1Password item                # 'name' is optional when passing a simple string...
      - name: My Other 1Password item    # ...but it can also be set for consistency
      - name:    My 1Password item
        field:   Custom field name       # optional, defaults to 'password'
        section: Custom section name     # optional, defaults to 'None'
        vault:   Name of the vault       # optional, only necessary if there is more than 1 Vault available
      - name: A 1Password item with document attachment
  delegate_to: localhost
  register: my_1password_item
  no_log: true                           # Don't want to log the secrets to the console!

- name: Debug a password (for example)
  ansible.builtin.debug:
    msg: "{{ my_1password_item['onepassword']['My 1Password item'] }}"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key Returned Description
onepassword
dictionary
success
Dictionary of each 1password item matching the given search terms, shows what would be returned from the third example above.

Sample:
{'A 1Password item with document attachment': {'document': 'the contents of the document attached to this item'}, 'My 1Password item': {'Custom field name': 'the value of this field', 'password': 'the value of this field'}, 'My Other 1Password item': {'password': 'the value of this field'}}


Authors

  • Ryan Conway (@Rylon)