Skip to main content
README.md2.5 KB
View on GitHub

1Password secrets example

Declarative secrets backed by 1Password, resolved with the !secret YAML function and the atmos secret CLI.

This example runs against a local Mockoon 1Password Connect mock through Atmos emulator components, so it is testable without a 1Password account.

How it works

  • Emulator (stacks/catalog/emulator/onepassword-connect.yaml): a mockoon/1password-connect emulator that serves a local 1Password Connect mock data file.
  • Store (atmos.yaml): a type: onepassword store named op. secret: true is implied — a 1Password store is always a secret backend (resolved via !secret, never !store). It supports full CRUD: atmos secret set writes the value to the field the reference points to (creating the item, as an API Credential, if it does not exist), and delete removes it.
  • Declarations (stacks/catalog/api.yaml): each secret carries an op://vault/item/field secret reference via the reference field. References support Go templating — op://{{ .atmos_stack }}/postgres/password resolves a different item per stack.
  • Usage: datadog_api_key: !secret DATADOG_API_KEY.

Authentication

No op CLI is required. The store auto-selects a backend:

BackendSet theseTypical use
Service AccountOP_SERVICE_ACCOUNT_TOKENlocal dev
ConnectOP_CONNECT_HOST + OP_CONNECT_TOKENCI / cloud

Force one with options.mode: service-account or options.mode: connect.

Service accounts cannot access your built-in Private/Personal/Employee vault — use a shared named vault.

Try it

cd examples/onepassword-secrets

# Start the local 1Password Connect mock
atmos emulator up onepassword-connect --stack dev --ephemeral

# Resolve a mocked secret
atmos secret get DATADOG_API_KEY --stack dev --component api --mask=false

# Check declared-secret status and validation
atmos secret list --stack dev --component api
atmos secret validate --stack dev --component api

# Write and remove a mocked secret
atmos secret set DB_PASSWORD=rotated-password --stack dev --component api
atmos secret delete DB_PASSWORD --stack dev --component api --force

# Stop the emulator
atmos emulator down onepassword-connect --stack dev