Hi! Is there any way to retrieve the fletctl token from 1Password by using 1password-cli instead of hardcoding it in the config file? I'm successfully logging in by using SSO config but only while hardcoding the token into the

~/.fleet/config

file and I'm not able to retrieve it from 1Password. Does anybody use a most secure approach than the one specified in the documentation? Thanks in advance!

We store it in Vault, but that's a heavy learning curve. I would imagine 1password-cli could do essentially the same thing, but this sounds more like a support question for 1P?

It's not a 1P question. I was wondering if there are options to store passwords to not hardcode them in config file that should be dinamically generated to avoid it. The thing here is that I was not able to retrive credentials from the 1P vault as I am doing using other services because fleet is expecting file permission to be set to 600 max.

Hmm. We’re pulling from Vault, writing to the file, then setting permissions. But this is all through Packer/Terraform, which runs as root.

I'd probably use something like: https://fleetdm.com/docs/using-fleet/fleetctl-cli#use-fleetctl-as-an-api-only-user then if you wanted you could modify the yaml file written as the config, and use yaml env variable support to pull the token in from env var.