From 0d5f48e2c2e47a635f58f81d321c7d919d15bb4c Mon Sep 17 00:00:00 2001 From: Erich Blume Date: Tue, 10 Feb 2026 13:09:55 -0800 Subject: [PATCH] Document op read vs op item get convention (#143) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Adds guidance to CLAUDE.md: use `op read` for secret values, `op item get` only for metadata - Fixes the argocd login example which used `op item get --fields` - `op item get --fields` wraps multi-line values in quotes, which corrupts keys and other secrets Discovered while verifying the sifaka borg repokey in 1Password — hashes didn't match until we switched to `op read`. Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/143 --- CLAUDE.md | 4 +++- docs/changelog.d/docs-op-read-convention.doc.md | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) create mode 100644 docs/changelog.d/docs-op-read-convention.doc.md diff --git a/CLAUDE.md b/CLAUDE.md index 60c32b4..9390944 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -53,7 +53,7 @@ Most services run in minikube on indri via ArgoCD (app-of-apps, manual sync). **Commands:** `argocd app list|get|diff|sync ` -**Login:** `argocd login argocd.ops.eblu.me --username admin --password "$(op --vault vg6xf6vvfmoh5hqjjhlhbeoaie item get srogeebssulhtb6tnqd7ls6qey --fields password --reveal)"` +**Login:** `argocd login argocd.ops.eblu.me --username admin --password "$(op read 'op://vg6xf6vvfmoh5hqjjhlhbeoaie/srogeebssulhtb6tnqd7ls6qey/password')"` ### Indri (Ansible) @@ -95,3 +95,5 @@ mise run blumeops-tasks # fetch from Todoist, sorted by priority ## Credentials Root store is 1Password. Never grab directly - use existing patterns (ansible pre_tasks, external-secrets, scripts with `op` CLI). Warn user before any credential access. + +**`op read` vs `op item get`:** Always use `op read "op://vault/item/field"` to retrieve secret values. `op item get --fields` wraps multi-line values in quotes, corrupting them. Use `op item get` only for listing item metadata (title, vault, field names), never for reading actual secret values in scripts or IaC. Look for existing uses of `op item get --fields` in Ansible/scripts and suggest replacing with `op read`. diff --git a/docs/changelog.d/docs-op-read-convention.doc.md b/docs/changelog.d/docs-op-read-convention.doc.md new file mode 100644 index 0000000..b343479 --- /dev/null +++ b/docs/changelog.d/docs-op-read-convention.doc.md @@ -0,0 +1 @@ +Document `op read` vs `op item get` convention for 1Password secret retrieval