Skip to main content
A
Anonymous
January 23, 2023
Question

Question about how to use 1password within playbooks

  • January 23, 2023
  • 2 replies
  • 2271 views

Hey everyone, Im extremely new to Ansible, so please excuse all of the mistakes Im about to make in this post. I have a handful of linux servers at work and I want to use ansible to update them regularly. We use 1password, and I have the 1password CLI installed and working on the server I have ansible installed on. I can successfully pull passwords with this test playbook:

  • hosts: localhost tasks:
  • name: debug: var: lookup("onepassword", "linuxserver1_localadmin")

Im running into a wall trying to figure out how to use 1password within a playbook to specify which password to use when connecting to a server. All of the servers will use the same username, but each has a different password. I know I can put ansible_password=xxxxx in vars, but thats plain text so obviously I cant do that. So within the host file right now I have:

[linuxserver1]
10.x.x.x
[linuxserver1:vars]
ansible_user=linuxserver1_localadmin

[linuxserver2]
10.x.x.x
[linuxserver2:vars]
ansible_user=linuxserver2_localadmin

My goal is to run a very simple playbook like this (pseudo-yaml):

  • hosts: linuxserver1 tasks:
    • name: run updates vars:
      • password: lookup("onepassword", "linuxserver1_localadmin") command: yum update -y
        • hosts: linuxserver2 tasks:
    • name: run updates vars:
      • password: lookup("onepassword", "linuxserver2_localadmin") command: yum update -y

Eventually in the hosts file I will have linuxserver3/4/5 etc. Is there a way to specify the password with 1pass in the hosts file, or is it done in the playbook like Im imagining in the pseudo-code?

Thanks for any and all help!

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Browser:_ Not Provided

2 replies

Jack_P_1P
1Password Employee
Jack_P_1P
1Password Employee
February 10, 2023

Hi @bsssysadmin:

First I'd like to apologize in the delay in responding here. One solution would to be use individual host targets, rather than a group and store each server's account details as a separate Login item. This would allow you to specify the specific name of an item you'd like to look up, so the pseudo-yaml would look something like this:

```
hosts: server1
....
password: lookup("onepassword","server1_login")
.....
hosts: server2
...
password: lookup("onepassword","server2_login")
... and so on

```

Let me know if that makes sense!

Jack

A
Anonymous
February 19, 2023

Personally I would recommend using SSH keys over passwords and use the 1password SSH agent for the connections. This works really well. Though you did say you were running Ansible on a server so if you are SSHing into that server SSH agent forwarding would also work as mentioned in this thread: https://1password.community/discussion/127482/feature-request-using-1p-ssh-from-inside-a-local-docker-container

If you are insistent on using passwords, use one of the variables documented here and set it using the onepassword filter in either groups_vars/all.yml or host_vars/hostname.yml for specific host passwords:

yaml
ansible_ssh_password: "{{ lookup('community.general.onepassword', 'server1_login', field='password', vault='Private') }}"

PS if you are using op CLI v2, make sure you update the community.general ansible collection to 6.3.0 to get the v2 patch.

Terms & ConditionsAccessibility statement

©2026 1Password. All rights reserved.
4711 Yonge St, 10th Floor, Toronto Ontario, M2N 6K8, Canada