community.general.onepassword_info module – Gather items from 1Password
Note
This module is part of the community.general collection (version 8.6.4).
You might already have this collection installed if you are using the ansible
package.
It is not included in ansible-core
.
To check whether it is installed, run ansible-galaxy collection list
.
To install it, use: ansible-galaxy collection install community.general
.
You need further requirements to be able to use this module,
see Requirements for details.
To use it in a playbook, specify: community.general.onepassword_info
.
Synopsis
community.general.onepassword_info wraps the
op
command line utility to fetch data about one or more 1Password items.A fatal error occurs if any of the items being searched for can not be found.
Recommend using with the
no_log
option to avoid logging the values of the secrets being retrieved.
Aliases: identity.onepassword_info
Requirements
The below requirements are needed on the host that executes this module.
op
1Password command line utility. See https://support.1password.com/command-line/
Parameters
Parameter |
Comments |
---|---|
A dictionary containing authentication details. If this is set, community.general.onepassword_info will attempt to sign in to 1Password automatically. Without this option, you must have already logged in via the 1Password CLI before running Ansible. It is highly recommended to store 1Password credentials in an Ansible Vault. Ensure that the key used to encrypt the Ansible Vault is equal to or greater in strength than the 1Password master password. |
|
The master password for your subdomain. This is always required when specifying |
|
The secret key for your subdomain. Only required for initial sign in. |
|
1Password subdomain name (<subdomain>.1password.com). If this is not specified, the most recent subdomain will be used. |
|
1Password username. Only required for initial sign in. |
|
Used to specify the exact path to the Default: |
|
A list of one or more search terms. Each search term can either be a simple string or it can be a dictionary for more control. When passing a simple string, When passing a dictionary, the following fields are available. |
|
The name of the field to search for within this item (optional, defaults to “password” (or “document” if the item has an attachment). |
|
The name of the 1Password item to search for (required). |
|
The name of a section within this item containing the specified field (optional, will search all sections if not specified). |
|
The name of the particular 1Password vault to search, useful if your 1Password user has access to multiple vaults (optional). |
Attributes
Attribute |
Support |
Description |
---|---|---|
Support: full This action does not modify state. |
Can run in |
|
Support: N/A This action does not modify state. |
Will return details on what has changed (or possibly needs changing in |
Notes
Note
Tested with
op
version 0.5.5Based on the community.general.onepassword lookup plugin by Scott Buchanan <sbuchanan@ri.pn>.
Examples
# Gather secrets from 1Password, assuming there is a 'password' field:
- name: Get a password
community.general.onepassword_info:
search_terms: My 1Password item
delegate_to: localhost
register: my_1password_item
no_log: true # Don't want to log the secrets to the console!
# Gather secrets from 1Password, with more advanced search terms:
- name: Get a password
community.general.onepassword_info:
search_terms:
- name: My 1Password item
field: Custom field name # optional, defaults to 'password'
section: Custom section name # optional, defaults to 'None'
vault: Name of the vault # optional, only necessary if there is more than 1 Vault available
delegate_to: localhost
register: my_1password_item
no_log: true # Don't want to log the secrets to the console!
# Gather secrets combining simple and advanced search terms to retrieve two items, one of which we fetch two
# fields. In the first 'password' is fetched, as a field name is not specified (default behaviour) and in the
# second, 'Custom field name' is fetched, as that is specified explicitly.
- name: Get a password
community.general.onepassword_info:
search_terms:
- My 1Password item # 'name' is optional when passing a simple string...
- name: My Other 1Password item # ...but it can also be set for consistency
- name: My 1Password item
field: Custom field name # optional, defaults to 'password'
section: Custom section name # optional, defaults to 'None'
vault: Name of the vault # optional, only necessary if there is more than 1 Vault available
- name: A 1Password item with document attachment
delegate_to: localhost
register: my_1password_item
no_log: true # Don't want to log the secrets to the console!
- name: Debug a password (for example)
ansible.builtin.debug:
msg: "{{ my_1password_item['onepassword']['My 1Password item'] }}"
Return Values
Common return values are documented here, the following are the fields unique to this module:
Key |
Description |
---|---|
Dictionary of each 1password item matching the given search terms, shows what would be returned from the third example above. Returned: success Sample: |