It’s Cybersecurity Awareness Month! Join our interactive training session, or learn about security and AI from 1Password experts.
Forum Discussion
ddribin
2 years agoNew Contributor
"op read" is pretty slow, ~700ms per invocation
Hi all,
I've noticed that op read is pretty slow, taking on the order of 700ms per invocation. Here's a benchmark using the https://github.com/sharkdp/hyperfine tool:
% hyperfine --warmup...
ddribin
2 years agoNew Contributor
Hi AndyW1P! Thank you for the reply!
It's not so much that I was expecting faster times, but I didn't expect it to be so slow. Two places where I've used op
recently that highlight the issue:
First, I've been playing around with https://ansible.readthedocs.io/en/latest/ to setup a new server. I figured I'd put all the secrets, such as the sudo
password, in 1Password and then use the https://docs.ansible.com/ansible/latest/collections/community/general/onepassword_lookup.html lookup to set playbook variables.
It turns out this lookup is extremely slow. It can slow down running playbooks by ~10x! A very simple playbook takes ~13s with the onepassword
lookup. Switching it out to https://docs.ansible.com/ansible/latest/vault_guide/index.html, Ansible's own secret manager, the same playbook runs in ~1s.
The onepassword
lookup uses op
under the hood. Apparently it runs it at least once for each task, due partially to Ansible’s lazy variable evaluation, so it adds up quickly.
Second, I use https://restic.readthedocs.io/en/stable/ to backup some Linux servers to https://www.backblaze.com/cloud-storage. Again, I wanted to put all the secrets into 1Password, so I wrote this wrapper script:
```
!/bin/sh
shellcheck disable=SC2155
RESTIC_BUCKET="$(op read "op://$OP_ITEM/bucket")"
RESTIC_PATH="$(op read "op://$OP_ITEM/path")"
export RESTIC_REPOSITORY="b2:$RESTIC_BUCKET:/$RESTIC_PATH"
export RESTIC_PASSWORD="$(op read "op://$OP_ITEM/password")"
export B2_ACCOUNT_ID="$(op read "op://$OP_ITEM/keyId")"
export B2_ACCOUNT_KEY="$(op read "op://$OP_ITEM/applicationKey")"
exec "$@"
```
Now I can run restic-wrapper restic snapshots
and it all "just works". But, again, I noticed this running very slowly. It takes 4 to 5 seconds just to get to the exec
line, because there are five invocations of op
.
But, yes, both of these cases where unexpected slow, ultimately due to op
taking ~700ms per invocation.