community.general.onepassword prompting for password every time.

[Sandelinos]

Summary

In the past when running a playbook using community.general.onepassword lookups, I would get prompted for my password a few times (same as the forks configuration setting) and then 1password (or PAM, not sure which one handles this) would remember that my shell session had been authorized and not prompt for my password again during the playbook execution. Recently this has changed and now I'm prompted for my password for every single lookup, making my playbooks unusable since I need to type in my password 100+ times on each execution.

I am able to run several op commands in a terminal and only get a password prompt once, so I know the issue is not with 1password itself.

Issue Type

Bug Report

Component Name

community.general.onepassword

Ansible Version

ansible [core 2.19.1]
  config file = None
  configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.13/site-packages/ansible
  ansible collection location = /home/user/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.13.7 (main, Aug 15 2025, 12:34:02) [GCC 15.2.1 20250813] (/usr/bin/python)
  jinja version = 3.1.6
  pyyaml version = 6.0.2 (with libyaml v0.2.5)

Community.general Version

# /usr/lib/python3.13/site-packages/ansible_collections
Collection        Version
----------------- -------
community.general 10.7.3

Configuration

CONFIG_FILE() = None
EDITOR(env: EDITOR) = vim

GALAXY_SERVERS:

OS / Environment

The above version information is from Arch Linux, but I'm also experiencing the issue on Debian Trixie

Steps to Reproduce

Playbook:

- name: Pretasks
  gather_facts: false
  hosts: all
  pre_tasks:
    - name: Get ansible_become_password from 1Password
      ansible.builtin.set_fact:
        ansible_become_password: {{ lookup('community.general.onepassword', inventory_hostname, vault='Servers') }}
      tags: always

Run the playbook with --forks 1 against several hosts.

Expected Results

I get prompted for my password once.

Actual Results

I get prompted or my password by 1password for every single host.

Code of Conduct

• I agree to follow the Ansible Code of Conduct

[ansibullbot]

Files identified in the description:

• plugins/doc_fragments/onepassword.py

If these files are incorrect, please update the component name section of the description or use the !component bot command.

click here for bot help

[kengribble]

I ran into a similar issue today, but maybe a bit worse.

When I run an Ansible playbook "1Password Access Requested... Allow iTerm2 to get CLI access... Authorize with Touch ID" for every task in a playbook.

To be clear, this was working as expected a few weeks ago.

Testing the 1password CLI, "op"

To test "op" in a way that might simulate the calls Ansible might be making, I wrote a quick script:

test-op.sh

for i in {1..5}; do
  bash -lc 'op item get "YOUR_ITEM_HERE" --format json'
done
bash -lc 'op item get "YOUR_ITEM_HERE" --format json'

Then just to make sure I run:

$ op signout --all

When I run the test-op.sh script the first time, it pops up the usual "1Password Access Requested... Allow iTerm2 to get CLI access... Authorize with Touch ID" When I authorize it once, it runs without requesting again, and subsequent runs of the script do not ask for authorization.

Terminal

iTerm2 Build 3.6.20250908-nightly
Mac Terminal Version 2.14 (455.1)

When I test the same with the stock Mac terminal, I get the same unexpected results as I do with iTerm2.

OS / Environment

MacOS Sequoia 15.6.1 (24G90)
Macbook Pro Apple M3 Max

Ansible Version

$ ansible --version
ansible [core 2.19.2]
  config file = None
  configured module search path = ['/Users/myaccount/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /opt/homebrew/Cellar/ansible/12.0.0/libexec/lib/python3.13/site-packages/ansible
  ansible collection location = /Users/myaccount/.ansible/collections:/usr/share/ansible/collections
  executable location = /opt/homebrew/bin/ansible
  python version = 3.13.7 (main, Aug 14 2025, 11:12:11) [Clang 17.0.0 (clang-1700.0.13.3)] (/opt/homebrew/Cellar/ansible/12.0.0/libexec/bin/python)
  jinja version = 3.1.6
  pyyaml version = 6.0.2 (with libyaml v0.2.5)

Community.general Version

$ ansible-galaxy collection list community.general

# /opt/homebrew/Cellar/ansible/12.0.0/libexec/lib/python3.13/site-packages/ansible_collections
Collection        Version
----------------- -------
community.general 11.2.1

Steps to Reproduce

Testing playbook

---

- name: "Debug Print Variables"
  ansible.builtin.debug:
   msg:
     - "Debug successful"
     - "msg: Ansible user: {{ ansible_user }}"

- name: "Test write of /root/.ansible-testing with become"
  become: true
  ansible.builtin.shell:
   cmd: "touch /root/.ansible-testing"

- name: "Test write of /tmp/.ansible-{{ ansible_user }}-testing without become"
  ansible.builtin.shell:
   cmd: "touch /tmp/.ansible-{{ ansible_user }}-testing"

Expected Results

I get prompted for authentication once from 1password.

Actual Results

I get prompted for authentication from 1password for each task in the playbook.

[pridkett]

Can confirm - seeing the same thing with the following configuration:

OS

macOS Sequoia 15.6.1

Terminal

• Kitty 0.42.2
• Ghostty 1.2.0

Ansible Version

$ ansible --version
ansible [core 2.19.2]
  config file = /Users/pwagstro/Documents/workspace/ansible-config/ansible.cfg
  configured module search path = ['/Users/pwagstro/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /opt/homebrew/Cellar/ansible/12.0.0/libexec/lib/python3.13/site-packages/ansible
  ansible collection location = /Users/pwagstro/.ansible/collections:/usr/share/ansible/collections
  executable location = /opt/homebrew/bin/ansible
  python version = 3.13.7 (main, Aug 14 2025, 11:12:11) [Clang 17.0.0 (clang-1700.0.13.3)] (/opt/homebrew/Cellar/ansible/12.0.0/libexec/bin/python)
  jinja version = 3.1.6
  pyyaml version = 6.0.2 (with libyaml v0.2.5)

1Password Version

GUI: 8.11.8

CLI

$ op --version
2.32.0

Community General Version

$ ansible-galaxy collection list community.general

# /Users/pwagstro/.ansible/collections/ansible_collections
Collection        Version
----------------- -------
community.general 11.3.0 

# /opt/homebrew/Cellar/ansible/12.0.0/libexec/lib/python3.13/site-packages/ansible_collections
Collection        Version
----------------- -------
community.general 11.2.1

Test Playbook

I've tested the following playbook:

---
# Playbook for creating and configuring a TimescaleDB LXC container on Proxmox
- name: Debug issues with community.general.onepassword
  hosts: localhost
  gather_facts: true
  vars_files:
    - secrets.yml # encrypted secrets file
  vars:
    foo: bar
  tasks:
    - name: debug - internal
      ansible.builtin.debug:
        msg: "{{ foo }}"

    - name: debug - unencrypted from secrets.yml
      ansible.builtin.debug:
        msg: "{{ ssh_signing_key_ref }}"

    - name: debug 2 - encrypted secret from secrets.yml
      ansible.builtin.debug:
        msg: "{{ ssh_signing_public_key }}"

    - name: debug - internal
      ansible.builtin.debug:
        msg: "{{ foo }}"

And here's my secrets.yml:

ssh_signing_key_ref: "fffffffffzzzzzzzzzzzzzzzzz"
ssh_signing_public_key: "{{ lookup('community.general.onepassword', ssh_signing_key_ref, vault='Private', field='public key') }}"

If you have something set up so you need to read your secrets key from 1password, it will prompt for 1Password on every task in the playbook, including gathering facts. Otherwise, it seems to only prompt when it ends up needing to template a variable that includes a lookup.

[pridkett]

I did some more digging and this is likely a change with the way that Ansible 12 works with lookups/shells (or possibly 1Password) and not directly related to community.general.onepassword. In brief, I created another simple lookup that also uses 1Password and saved it as ~/.ansible/plugins/lookup/op.py

from ansible.plugins.lookup import LookupBase
from ansible.errors import AnsibleError
import subprocess
import json

class LookupModule(LookupBase):
    def run(self, terms, variables=None, **kwargs):
        results = []
        for reference in terms:
            try:
                # Fetch the item and field from 1Password
                command = [ "op", "read", reference ]
                result = subprocess.check_output(command, text=True).strip()
                results.append(result)
            except subprocess.CalledProcessError as e:
                raise AnsibleError(f"Error fetching {reference}: {str(e)}")
        return results

I then created the most simple Ansible playbook that would call this very simple lookup command twice:

---
- name: Test op lookup plugin
  hosts: localhost
  connection: local
  gather_facts: false

  tasks:
    - name: First lookup
      ansible.builtin.debug:
        msg: "First lookup result: {{ lookup('op', 'op://Private/testitem/testkey') }}"

    - name: Second lookup
      ansible.builtin.debug:
        msg: "Second lookup result: {{ lookup('op', 'op://Private/testitem/testkey') }}"

I ran this playbook with:

ansible-playbook test-op-lookup.yml

When run, this prompted me for my fingerprint twice. This suggests to me that the issue most likely isn't related to community.general.onepassword, but more something related to Ansible 12 or a recent update to 1Password.

EDIT: Confirmed - reverting to Ansible 11.9 removes this problem.

[felixfontein]

Yes, this is very likely related to changes ansible-core 2.19 and definitely not to a change in this collection.

[chrishoage]

Is this fixed by #11193?

[felixfontein]

No, that is totally unrelated. (It's also not about the lookup.)

[felixfontein]

!component =plugins/lookup/onepassword.py

[ansibullbot]

Files identified in the description:

• plugins/lookup/onepassword.py

If these files are incorrect, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibullbot]

cc @azenk @samdoran
click here for bot help