onepassword_facts - Fetch facts from 1Password items

New in version 2.7.

Synopsis

• onepassword_facts wraps the op command line utility to fetch data about one or more 1password items and return as Ansible facts.
• A fatal error occurs if any of the items being searched for can not be found.
• Recommend using with the no_log option to avoid logging the values of the secrets being retrieved.

Requirements

The below requirements are needed on the host that executes this module.

• op 1Password command line utility (v0.5.1). See https://support.1password.com/command-line/

Parameters

Parameter		Choices/Defaults	Comments
auto_login		Default: {}	A dictionary containing authentication details. If this is set, onepassword_facts will attempt to login to 1password automatically. The required values can be stored in Ansible Vault, and passed to the module securely that way. Without this option, you must have already logged in via the 1Password CLI before running Ansible.
	username		1Password username.
	secretkey		The secret key for your user.
	account		1Password account name (<account>.1password.com).
	masterpassword		The master password for your user.
cli_path		Default: op	Used to specify the exact path to the op command line interface
search_terms required			A list of one or more search terms. Each search term can either be a simple string or it can be a dictionary for more control. When passing a simple string, field is assumed to be password. When passing a dictionary, the following fields are available.
	field		The name of the field to search for within this item (optional, defaults to "password" (or "document" if the item has an attachment).
	section		The name of a section within this item containing the specified field (optional, will search all sections if not specified).
	name		The name of the 1Password item to search for (required).
	vault		The name of the particular 1Password vault to search, useful if your 1Password user has access to multiple vaults (optional).

Notes

Note

• Based on the onepassword lookup plugin by Scott Buchanan <sbuchanan@ri.pn>.

Examples

# Gather secrets from 1Password, assuming there is a 'password' field:
- name: Get a password
  onepassword_facts:
    search_terms: My 1Password item
  delegate_to: local
  no_log:      true   # Don't want to log the secrets to the console!

# Gather secrets from 1Password, with more advanced search terms:
- name: Get a password
  onepassword_facts:
    search_terms:
      - name:    My 1Password item
        field:   Custom field name       # optional, defaults to 'password'
        section: Custom section name     # optional, defaults to 'None'
        vault:   Name of the vault       # optional, only necessary if there is more than 1 Vault available
  delegate_to: local
  no_log:      true   # Don't want to log the secrets to the console!

# Gather secrets combining simple and advanced search terms to retrieve two items, one of which we fetch two
# fields. In the first 'password' is fetched, as a field name is not specified (default behaviour) and in the
# second, 'Custom field name' is fetched, as that is specified explicitly.
- name: Get a password
  onepassword_facts:
    search_terms:
      - My 1Password item                # 'name' is optional when passing a simple string...
      - name: My Other 1Password item    # ...but it can also be set for consistency
      - name:    My 1Password item
        field:   Custom field name       # optional, defaults to 'password'
        section: Custom section name     # optional, defaults to 'None'
        vault:   Name of the vault       # optional, only necessary if there is more than 1 Vault available
      - name: A 1Password item with document attachment
  delegate_to: local
  no_log:      true   # Don't want to log the secrets to the console!

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Returned	Description
onepassword dict	success	Dictionary of each 1password item matching the given search terms, shows what would be returned from the third example above. Sample: {'My 1Password item': {'password': 'the value of this field', 'Custom field name': 'the value of this field'}, 'My Other 1Password item': {'password': 'the value of this field'}, 'A 1Password item with document attachment': {'document': 'the contents of the document attached to this item'}}

Status

This module is flagged as preview which means that it is not guaranteed to have a backwards compatible interface.

Maintenance

This module is flagged as community which means that it is maintained by the Ansible Community. See Module Maintenance & Support for more info.

For a list of other modules that are also maintained by the Ansible Community, see here.

Author

• Ryan Conway (@rylon)

Hint

If you notice any issues in this documentation you can edit this document to improve it.