biometric unlock many times

[sdahlbac]

Your environment

Terraform Provider Version:

tofu -v
OpenTofu v1.6.0
on darwin_arm64

• provider registry.opentofu.org/1password/onepassword v1.4.0
• provider registry.opentofu.org/cyrilgdn/postgresql v1.21.0
• provider registry.opentofu.org/hashicorp/aws v5.32.1
• provider registry.opentofu.org/hashicorp/kubernetes v2.25.2
• provider registry.opentofu.org/hashicorp/random v3.6.0
• provider registry.opentofu.org/mongey/kafka v0.5.4

Connect Server Version:
N/A

CLI Version:
op -v
2.24.0

OS: osx/arm

Terraform Version: OpenTofu v1.6.0

What happened?

Everything works, but instead of biometric unlock just once, I need to do it 5 times

What did you expect to happen?

a single biometric unlock should suffice

Steps to reproduce

2. tofu plan

Notes & Logs

[simonweil]

I'm seeing this too and it is very annoying...
I can't run the plan and go make a coffee :(

[volodymyrZotov]

Hi @sdahlbac . Thank you for raising this! Agree, that's annoying...😬
This happens as terraform processes each resource in parallel and each of the parallel processes would need to be authenticated by the CLI. This is a known issue and it will be fixed on the OP CLI side. Stay tuned for future CLI releases.

Meanwhile you can mitigate the issue by running the apply command sequentially

terraform apply -parallelism=1

[vponoikoait]

+1

[sdahlbac]

@volodymyrZotov any updates on this?

[asininemonkey]

Another month and no update. Anything?

[SimonBarendse]

Hi folks,

As @volodymyrZotov investigated the way Terraform calls into the CLI from different processes for every resource doesn't play well with how the CLI is authorized (per process). This is an intentional design of 1Password CLI auth preventing every process running on your machine from being able to access your 1Password account.

We're currently planning to add (biometric) auth prompt support to the 1Password Go SDK. Once that's tackled, we can replace the calls to CLI in this Terraform project with SDK. That should solve this issue as well as a few others (a.o. #204, #148, #130, #141, #191, #163). All these issues have in common that they're caused by the friction from using CLI while Terraform is better suited to integrate via SDK.

Adding Auth Prompt support to SDKs is a relatively large effort, and I'm not expecting movement on this issue until a couple months into the new year at the earliest.

In the meantime, you can use either the workaround @volodymyrZotov shared above of running your Terraform commands without parallelism:

terraform apply -parallelism=1

or you can use a 1Password Service Account to auth Terraform instead of using a biometric prompt.

[sdahlbac]

Thanks for the update