In a our previous post, we looked at generating a 1password session without requiring user input. Today we will look at generating a one-time (30-minute) token on your local machine and only sharing that with your build servers.
As we saw previously, we can
op you can generate a session token. Below we have two small changes.
op signin --raw my firstname.lastname@example.org > opsession
We added the
--raw flag so that we only output the 1password token
We redirect the output to a
Now instead of building a forever re-useable
opsession (as we did with expect), we now have a 30-minute
opsession token (within a file) that we can share with our build server as seen below (step B).
Our automation scripts can now use the
--session flag pointing to the contents
of our token with
cat opsession. For example.
op get item db_password --session $(cat opsession)
In this approach, we are still generating 1password sessions locally, and then sharing the token on our build servers. Those environments now have 30-minutes access to the secrets it needs (DB passwords, API secrets, etc) in a completely autonomous way.