Unable to interpolate sensitive environment variables

user_11659920 0
Viewed 15906

I have a piece of code that runs like this

package core.jenkins

class Utils implements Serializable {
    def script

    Utils(script) {
        this.script = script
    }

    def func() {
        script.withCredentials([script.usernamePassword(credentialsId: 'chartmuseum-basic-auth', usernameVariable: 'USER', passwordVariable: 'PASSWORD')]) {
            script.sh "helm repo add --username script.USER} --password ${script.PASSWORD} chartmuseum \"http://${chartmuseumHostname}:8080\""
        }
}

The above works perfectly fine but I do not a warning

Warning: A secret was passed to "sh" using Groovy String interpolation, which is insecure.
         Affected argument(s) used the following variable(s): [PASSWORD, USER]
         See https://jenkins.io/redirect/groovy-string-interpolation for details.
+ helm repo add --username **** --password **** chartmuseum http://apps-chartmuseum.apps.svc.cluster.local:8080

So following the guide, Im doing the following

script.withCredentials([script.usernamePassword(credentialsId: 'chartmuseum-basic-auth', usernameVariable: 'USER', passwordVariable: 'PASSWORD')]) {
script.sh 'helm repo add --username $script.USER --password $script.PASSWORD chartmuseum "http://$chartmuseumHostname:8080"'
        }

But running the variable values are not be properly substitured and I get

+ helm repo add --username .USER --password .PASSWORD chartmuseum http://:8080
Error: Looks like "http://:8080" is not a valid chart repository or cannot be reached: Get http://:8080/index.yaml: dial tcp :8080: connect: connection refused

So neither the credentials nor the value of the chartmuseumHostname variable is being substituted correctly. What am I missing here ?

jenkins-pipeline groovy
3 Answers

Actuall withCredentials() creates a environment variable which you can access it from shell scripts. See here: https://www.jenkins.io/doc/pipeline/steps/credentials-binding/ Try using directly the shell variables:

script.sh 'helm repo add --username $USER --password $PASSWORD chartmuseum "http://$chartmuseumHostname:8080"'
user_55952630

Just binding together the answers already on this post, the withCredentials makes it so that you should be able to use the variables directly (answer by @catalin), the single quotes make it so that jenkins should stop complaining about security and if you want to be extra careful, you can double quote the variable values as suggested in the docs for withCredentials.

This should give you something like this:

script.withCredentials([script.usernamePassword(credentialsId: 'chartmuseum-basic-auth', 
                                                usernameVariable: 'USER', 
                                                passwordVariable: 'PASSWORD')]) {
  script.sh 'helm repo add --username "$USER" --password "$PASSWORD" chartmuseum "http://$chartmuseumHostname:8080"'
}

which still leaves us with the question of why you are calling things with the script. prefix as mentioned in the comments by @matt-schuchard.

user_54494310

I try using the suggestion by @Catalin (https://www.jenkins.io/doc/pipeline/steps/credentials-binding/ using directly the shell variables) But for me adding double quotes inside single quotes doesn't work. The only solution I found is taking the variables out of the single quotes like:

'myscript $secretvariable' + notsecretvariable

Examples:

Test1: Try using recommended solution (jenkins/@catalin)

Code:

sh label: 'Test1', script: 'echo this is a secret $docker_pwd this is not "$dockerRegistry"'

Result: variable dockerRegistry is not interpolated/resolved

15:50:43  [Pipeline] sh (Test1)
15:50:43  + echo this is a secret **** this is not ''
15:50:43  this is a secret **** this is not

Test2: Take non-sensitive variable out of the single quotes:

 sh label: 'Test2', script: 'echo this is a secret $docker_pwd this is not' + dockerRegistry

Result: variable dockerRegistry is properlly resolved

15:50:44  [Pipeline] sh (Test2)
15:50:44  + echo this is a secret **** this is not my.repositories.xx
15:50:44  this is a secret **** this is not my.repositories.xx
user_164026210
Related