Jenkins hashicorp-vault-plugin空结果

Question

我尝试了这里提到的Jenkins管道示例：https://plugins.jenkins.io/hashicorp-vault-plugin

node {
    // define the secrets and the env variables
    def secrets = [
        [$class: 'VaultSecret', path: 'secret/testing', secretValues: [
            [$class: 'VaultSecretValue', envVar: 'testing', vaultKey: 'value_one'],
            [$class: 'VaultSecretValue', envVar: 'testing_again', vaultKey: 'value_two']]],
        [$class: 'VaultSecret', path: 'secret/another_test', secretValues: [
        [$class: 'VaultSecretValue', envVar: 'another_test', vaultKey: 'value']]]
    ]

    // optional configuration, if you do not provide this the next higher configuration
    // (e.g. folder or global) will be used
    def configuration = [$class: 'VaultConfiguration',
                         vaultUrl: 'http://my-very-other-vault-url.com',
                         vaultCredentialId: 'my-vault-cred-id']
    // inside this block your credentials will be available as env variables
    wrap([$class: 'VaultBuildWrapper', configuration: configuration, vaultSecrets: secrets]) {
        sh 'echo $testing'
        sh 'echo $testing_again'
        sh 'echo $another_test'
    }
}

所以我在Jenkins 2.173中安装了hashicorp-vault-plugin 2.2.0并启动了一个Vault（v1.1.1）Docker容器

docker run -d --name vaulttest -p 80:8200 --cap-add=IPC_LOCK -e 'VAULT_DEV_ROOT_TOKEN_ID=myroot' vault

接下来，我使用令牌“myroot”在Jenkins中配置了令牌凭据

我在Vault中创建了秘密（使用WebUI）

testing
   value_one
   value_two
another_test
   value

首先，示例中存在错误：当使用路径“secret / testing”和“secret / another_test”时，插件失败并显示错误404：

Invalid path for a versioned K/V secrets engine. See the API docs for the appropriate API endpoints to use. If using the Vault CLI, use 'vault kv get' for this operation."

使用路径“secret / data / testing”和“secret / data / another_test”时可以修复此问题（请参阅https://issues.jenkins-ci.org/browse/JENKINS-44900）

当调用Job时，变量似乎是空的：

[Pipeline] sh
+ echo

[Pipeline] sh
+ echo

[Pipeline] sh
+ echo

连接肯定有效，因为当提供无效凭据或无效路径时，我收到错误。

还检索Secrets直接返回有效的响应：

/ # vault kv get secret/testing
====== Metadata ======
Key              Value
---              -----
created_time     2019-04-17T05:31:23.581020191Z
deletion_time    n/a
destroyed        false
version          3

====== Data ======
Key          Value
---          -----
value_one    HUGO
value_two    BETTY

我在这里错过了什么？

Answer 1

正如此处所见，qazxsw poi Vault KV V2返回不同的Json Response。

所以你必须使用

https://issues.jenkins-ci.org/browse/JENKINS-52646

检索正确的json响应。

然后可以将生成的Json-Response传递给“readJSON”

def secrets = [
    [$class: 'VaultSecret', path: 'secret/data/testing', secretValues: [
        [$class: 'VaultSecretValue', envVar: 'testing', vaultKey: 'data']]]
]