dynaconf / dynaconf/dynaconf

[RFC] 1Password (onepassword) support

Open
#1,172 3 comments 2 reactions 0 assignees View on GitHub
Docs Not a Bug RFC
Dominant language
Python
Stars
4.3k
Forks
347
Avg merge
2d 2h
Merged PRs (30d)
1

Description

**Is your feature request related to a problem? Please describe.**

I want to ensure that my secret data is accessed in a secure manner, from a secured enclave. The Vault integration is _one_ solution to that, but I'm looking for a solution with other providers, e.g., 1Password.

**Describe the solution you'd like**
A clear and concise description of what you want to happen.

1Password provides a number of possible developer integrations. There are 2 _potential_ solutions to this integration with 1Password

1. The Python SDK
* https://developer.1password.com/docs/sdks
* https://github.com/1Password/onepassword-sdk-python/
* Benefits are being directly integrated with Python
* Drawbacks are the Service Account requirement and [Service Account limitations](https://developer.1password.com/docs/service-accounts/get-started/) (namely that it's subject to rate limits and only _certain_ 1Password Vaults)
2. Integration with the `op` CLI
* https://developer.1password.com/docs/cli
* There are two potential integration paths with `op` CLI
1. `op read` on each password lookup
* This could potentially be done with a custom converter
* The downside on this option would be the requirment of the `op read` lookup for _each_ secret. Obviously not ideal for a large amount of secrets
2. `op inject`
* The suggestion _here_ would be to support the [1Password template syntax](https://developer.1password.com/docs/cli/secrets-template-syntax) (possibly behind an existing `@format` token, or even a new `@op` token)
* And then once the _final_ file or data is compiled, run it through `op inject` to allow the `op` CLI to replace all the 1Password template references
* This would require a _deeper_ integration with Dynaconf, but would be provide the quickest parsing since it would be a one-shot and done

**Describe alternatives you've considered**

The alternative is essentially what I'm already going to start looking at, which is integrating with `op read` as a custom converter. And then I would add my custom converter to any code that I desire. It would seem, based on lack of existing issues, that perhaps I'm the only person interested in this integration, but I do think it would have wider community benefits ¯\\\_(ツ)_/¯

My implementation _preference_ would be 2.b, the `op inject` solution. Realistically, that level of integration is beyond my grasp with the complexities of this solution. I will post back on the progress that I make at least with 2.a 👍

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.