/ home / community / community.general / 8.5.0 / module / onepassword_info

community.general.onepassword_info (8.5.0) — module

Gather items from 1Password

Authors: Ryan Conway (@Rylon)

Install collection

Install with ansible-galaxy collection install community.general:==8.5.0

Add to requirements.yml

  collections:
    - name: community.general
      version: 8.5.0

Description

M(community.general.onepassword_info) wraps the C(op) command line utility to fetch data about one or more 1Password items.

A fatal error occurs if any of the items being searched for can not be found.

Recommend using with the C(no_log) option to avoid logging the values of the secrets being retrieved.

Requirements

C(op) 1Password command line utility. See U(https://support.1password.com/command-line/)

Usage examples

Scanned by Steampunk Spotter

# Gather secrets from 1Password, assuming there is a 'password' field:
- name: Get a password
  community.general.onepassword_info:
    search_terms: My 1Password item
  delegate_to: localhost
  register: my_1password_item
  no_log: true         # Don't want to log the secrets to the console!

Scanned by Steampunk Spotter

# Gather secrets from 1Password, with more advanced search terms:
- name: Get a password
  community.general.onepassword_info:
    search_terms:
      - name:    My 1Password item
        field:   Custom field name       # optional, defaults to 'password'
        section: Custom section name     # optional, defaults to 'None'
        vault:   Name of the vault       # optional, only necessary if there is more than 1 Vault available
  delegate_to: localhost
  register: my_1password_item
  no_log: true                           # Don't want to log the secrets to the console!

Scanned by Steampunk Spotter

# Gather secrets combining simple and advanced search terms to retrieve two items, one of which we fetch two
# fields. In the first 'password' is fetched, as a field name is not specified (default behaviour) and in the
# second, 'Custom field name' is fetched, as that is specified explicitly.
- name: Get a password
  community.general.onepassword_info:
    search_terms:
      - My 1Password item                # 'name' is optional when passing a simple string...
      - name: My Other 1Password item    # ...but it can also be set for consistency
      - name:    My 1Password item
        field:   Custom field name       # optional, defaults to 'password'
        section: Custom section name     # optional, defaults to 'None'
        vault:   Name of the vault       # optional, only necessary if there is more than 1 Vault available
      - name: A 1Password item with document attachment
  delegate_to: localhost
  register: my_1password_item
  no_log: true                           # Don't want to log the secrets to the console!

Scanned by Steampunk Spotter

- name: Debug a password (for example)
  ansible.builtin.debug:
    msg: "{{ my_1password_item['onepassword']['My 1Password item'] }}"

Inputs

cli_path:
default: op
description: Used to specify the exact path to the C(op) command line interface
required: false
type: path

auto_login:
description:
- A dictionary containing authentication details. If this is set, M(community.general.onepassword_info)
will attempt to sign in to 1Password automatically.
- Without this option, you must have already logged in via the 1Password CLI before
running Ansible.
- It is B(highly) recommended to store 1Password credentials in an Ansible Vault.
Ensure that the key used to encrypt the Ansible Vault is equal to or greater in
strength than the 1Password master password.
required: false
suboptions:
master_password:
description:
- The master password for your subdomain.
- This is always required when specifying O(auto_login).
required: true
type: str
secret_key:
description:
- The secret key for your subdomain.
- Only required for initial sign in.
type: str
subdomain:
description:
- 1Password subdomain name (<subdomain>.1password.com).
- If this is not specified, the most recent subdomain will be used.
type: str
username:
description:
- 1Password username.
- Only required for initial sign in.
type: str
type: dict

search_terms:
description:
- A list of one or more search terms.
- Each search term can either be a simple string or it can be a dictionary for more
control.
- When passing a simple string, O(search_terms[].field) is assumed to be V(password).
- When passing a dictionary, the following fields are available.
elements: dict
required: true
suboptions:
field:
description:
- The name of the field to search for within this item (optional, defaults to
"password" (or "document" if the item has an attachment).
type: str
name:
description:
- The name of the 1Password item to search for (required).
type: str
section:
description:
- The name of a section within this item containing the specified field (optional,
will search all sections if not specified).
type: str
vault:
description:
- The name of the particular 1Password vault to search, useful if your 1Password
user has access to multiple vaults (optional).
type: str
type: list

Outputs

onepassword:
  description: Dictionary of each 1password item matching the given search terms,
    shows what would be returned from the third example above.
  returned: success
  sample:
    A 1Password item with document attachment:
      document: the contents of the document attached to this item
    My 1Password item:
      Custom field name: the value of this field
      password: the value of this field
    My Other 1Password item:
      password: the value of this field
  type: dict