jenkins-pipeline - 如何在管道中访问 Vault 凭据

Question

我们在管道中使用 Vault 插件从 Vault 读取凭据。现在我们还想用 Vault 的 PKI 引擎生成 TLS 证书。为此，我需要在我的管道文件中为 Jenkins 提供 appRole secret ID。该 secret 在 Jenkins 中配置为“Vault App Role Credential”，我不知道如何访问它。

我想做的是这样的:

withCredentials([VaultAppRoleCredential(credentialsId: 'vault_credentials'), roleIdVariable: 'roleId', secretIdVariable: 'secretId']) {
stage('generate certificate') {
    // authenticate with credentials against Vault
    // ...
}

}

我目前的解决方法是复制凭证并将 roleId 和 secretId 额外存储在 Jenkins 的用户名+密码凭证中。

Answer 1

这是我的工作示例，如何使用 Vault Credentials Token 并使用它来访问 Vault secret :

// Specify how to access secrets in Vault
def configuration = [
vaultUrl: 'https://hcvault.global.nibr.novartis.net',
vaultCredentialId: 'poc-vault-token',
engineVersion: 2
]

def secrets = [
[path: 'secret/projects/intd/common/accounts', engineVersion: 2, secretValues: 
    [
        [vaultKey: 'TEST_SYS_USER'],
        [vaultKey: 'TEST_SYS_PWD']
    ]
  ]
]

... [omitted pipeline]

stage ('Get Vault Secrets') {
  steps  {
    script {
      withCredentials([[$class: 'VaultTokenCredentialBinding', credentialsId: 'poc-vault-token', vaultAddr: 'https://hcvault.global.nibr.novartis.net'], usernamePassword(credentialsId: 'artifactory-jenkins-user-password', usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD')]) {
        withVault([configuration: configuration, vaultSecrets: secrets]) {  
          sh """
            echo $env.VAULT_ADDR > hcvault-address.txt
            echo $env.VAULT_TOKEN > hcvault-token.txt
            echo $env.TEST_SYS_USER > sys-user-account.txt
          """.stripIndent()
        }
      }
    }
  }
}