Jenkins从节点传递AmazonWebServicesCredentialsBinding变量为空问题

嘿，我之前也踩过这个坑！你碰到的这个在从节点上withCredentials设置的变量为空的问题，核心原因是Pipeline里的sh步骤用了三个单引号'''包裹脚本，导致Shell不会解析其中的环境变量。三个单引号在Jenkins Pipeline里属于“原样字符串”，变量会被直接当作字面量传给Shell，根本不会替换成实际的Credentials值，自然就空了。

最直接的解决方案：改用双引号包裹脚本 #

把sh '''...'''换成sh """..."""，这样Jenkins会先解析脚本里的变量，再传递给Shell执行，变量就能正常替换了：

withCredentials([
    [ $class : 'AmazonWebServicesCredentialsBinding', credentialsId : 'AWS_ACCOUNT_ID_DEV', accessKeyVariable: 'AWS_ACCESS_KEY_ID_DEV', secretKeyVariable: 'AWS_SECRET_ACCESS_KEY_DEV' ],
    [ $class : 'AmazonWebServicesCredentialsBinding', credentialsId : 'AWS_ACCOUNT_ID_DNS', accessKeyVariable: 'AWS_ACCESS_KEY_ID_DNS', secretKeyVariable: 'AWS_SECRET_ACCESS_KEY_DNS' ]
]){
    sh """
        echo "$AWS_ACCESS_KEY_ID_DEV\n$AWS_SECRET_ACCESS_KEY_DEV\n\n" | aws configure --profile profile_705229686812
        echo "$AWS_ACCESS_KEY_ID_DNS\n$AWS_SECRET_ACCESS_KEY_DNS\n\n" | aws configure --profile profile_417752960097
    """
}

备选方案：显式传递环境变量（更安全） #

如果担心双引号带来的转义问题，也可以在Shell脚本里用${变量名}的方式引用，或者通过sh步骤的environment参数显式传递变量：

方式1：Shell内直接引用变量 #

withCredentials([
    [ $class : 'AmazonWebServicesCredentialsBinding', credentialsId : 'AWS_ACCOUNT_ID_DEV', accessKeyVariable: 'AWS_ACCESS_KEY_ID_DEV', secretKeyVariable: 'AWS_SECRET_ACCESS_KEY_DEV' ],
    [ $class : 'AmazonWebServicesCredentialsBinding', credentialsId : 'AWS_ACCOUNT_ID_DNS', accessKeyVariable: 'AWS_ACCESS_KEY_ID_DNS', secretKeyVariable: 'AWS_SECRET_ACCESS_KEY_DNS' ]
]){
    sh '''
        echo "${AWS_ACCESS_KEY_ID_DEV}\n${AWS_SECRET_ACCESS_KEY_DEV}\n\n" | aws configure --profile profile_705229686812
        echo "${AWS_ACCESS_KEY_ID_DNS}\n${AWS_SECRET_ACCESS_KEY_DNS}\n\n" | aws configure --profile profile_417752960097
    '''
}

方式2：显式传递环境变量 #

withCredentials([
    [ $class : 'AmazonWebServicesCredentialsBinding', credentialsId : 'AWS_ACCOUNT_ID_DEV', accessKeyVariable: 'AWS_ACCESS_KEY_ID_DEV', secretKeyVariable: 'AWS_SECRET_ACCESS_KEY_DEV' ],
    [ $class : 'AmazonWebServicesCredentialsBinding', credentialsId : 'AWS_ACCOUNT_ID_DNS', accessKeyVariable: 'AWS_ACCESS_KEY_ID_DNS', secretKeyVariable: 'AWS_SECRET_ACCESS_KEY_DNS' ]
]){
    sh(
        script: '''
            echo "${AWS_ACCESS_KEY_ID_DEV}\n${AWS_SECRET_ACCESS_KEY_DEV}\n\n" | aws configure --profile profile_705229686812
            echo "${AWS_ACCESS_KEY_ID_DNS}\n${AWS_SECRET_ACCESS_KEY_DNS}\n\n" | aws configure --profile profile_417752960097
        ''',
        environment: [
            AWS_ACCESS_KEY_ID_DEV: env.AWS_ACCESS_KEY_ID_DEV,
            AWS_SECRET_ACCESS_KEY_DEV: env.AWS_SECRET_ACCESS_KEY_DEV,
            AWS_ACCESS_KEY_ID_DNS: env.AWS_ACCESS_KEY_ID_DNS,
            AWS_SECRET_ACCESS_KEY_DNS: env.AWS_SECRET_ACCESS_KEY_DNS
        ]
    )
}

额外排查点（如果上面的方法没用） #

如果调整引号后还是有问题，不妨检查这几点：

• 确认从节点jenkins-slave-docker上的withCredentials插件版本和主节点一致，插件是否正常启用
• 检查从节点的Jenkins代理用户权限，确保它能正常读取Credentials注入的环境变量
• 在withCredentials块里加一步echo "$AWS_ACCESS_KEY_ID_DEV"测试变量是否真的为空，排除是aws configure命令本身的问题

内容的提问来源于stack exchange，提问作者awiechert