community.general.onepassword_info – Gather items from 1Password¶
Note
This plugin is part of the community.general collection (version 2.5.1).
To install it use: ansible-galaxy collection install community.general
.
To use it in a playbook, specify: community.general.onepassword_info
.
Synopsis¶
community.general.onepassword_info wraps the
op
command line utility to fetch data about one or more 1Password items.A fatal error occurs if any of the items being searched for can not be found.
Recommend using with the
no_log
option to avoid logging the values of the secrets being retrieved.This module was called
onepassword_facts
before Ansible 2.9, returningansible_facts
. Note that the community.general.onepassword_info module no longer returnsansible_facts
! You must now use theregister
option to use the facts in other tasks.
Requirements¶
The below requirements are needed on the host that executes this module.
op
1Password command line utility. See https://support.1password.com/command-line/
Parameters¶
Notes¶
Note
Tested with
op
version 0.5.5Based on the
onepassword
lookup plugin by Scott Buchanan <sbuchanan@ri.pn>.When this module is called with the deprecated
onepassword_facts
name, potentially sensitive data from 1Password is returned as Ansible facts. Facts are subject to caching if enabled, which means this data could be stored in clear text on disk or in a database.
Examples¶
# Gather secrets from 1Password, assuming there is a 'password' field:
- name: Get a password
community.general.onepassword_info:
search_terms: My 1Password item
delegate_to: localhost
register: my_1password_item
no_log: true # Don't want to log the secrets to the console!
# Gather secrets from 1Password, with more advanced search terms:
- name: Get a password
community.general.onepassword_info:
search_terms:
- name: My 1Password item
field: Custom field name # optional, defaults to 'password'
section: Custom section name # optional, defaults to 'None'
vault: Name of the vault # optional, only necessary if there is more than 1 Vault available
delegate_to: localhost
register: my_1password_item
no_log: True # Don't want to log the secrets to the console!
# Gather secrets combining simple and advanced search terms to retrieve two items, one of which we fetch two
# fields. In the first 'password' is fetched, as a field name is not specified (default behaviour) and in the
# second, 'Custom field name' is fetched, as that is specified explicitly.
- name: Get a password
community.general.onepassword_info:
search_terms:
- My 1Password item # 'name' is optional when passing a simple string...
- name: My Other 1Password item # ...but it can also be set for consistency
- name: My 1Password item
field: Custom field name # optional, defaults to 'password'
section: Custom section name # optional, defaults to 'None'
vault: Name of the vault # optional, only necessary if there is more than 1 Vault available
- name: A 1Password item with document attachment
delegate_to: localhost
register: my_1password_item
no_log: true # Don't want to log the secrets to the console!
- name: Debug a password (for example)
ansible.builtin.debug:
msg: "{{ my_1password_item['onepassword']['My 1Password item'] }}"
Return Values¶
Common return values are documented here, the following are the fields unique to this module:
Authors¶
Ryan Conway (@Rylon)