wwmoraes/op-secret-plugin repository overview

⁠op-secret-plugin

⁠About

Connects to an 1Password Connect instance to fetch and provide secrets to containers.

⁠Getting Started

Install the plugin:

docker plugin install wwmoraes/op-secret-plugin:$(uname -m)-latest \
  --alias op \
  --grant-all-permissions \
    OP_CONNECT_HOST=https://op-connect-host:8080 \
    OP_CONNECT_TOKEN_FILE=/run/secrets/op/token

If you need to use a plaintext token, replace OP_CONNECT_TOKEN_FILE with OP_CONNECT_TOKEN.

⁠Prerequisites

• Docker Engine with secret plugin support (tested on v20)
• 1Password Connect service instance running and accessible through HTTP

⁠Usage

Create secrets using the --driver option:

docker secret create -d op \
  -l connect.1password.io/vault=bar \
  -l connect.1password.io/item=baz \
  -l connect.1password.io/field=qux \
  -l connect.1password.io/reusable=false \ # optional, defaults to true
  foo

Note: Creation works if the secret doesn't exist on 1Password. It'll be checked on each first mount, and will fail the service if missing.