Jenkins中AWS凭证无法传入Ansible Playbook，求解决方法

我尝试将Jenkins中存储的AWS凭证传入Ansible Playbook，但并未生效。查阅资料后发现多数方案是在Jenkinsfile中存储凭证，想确认是否可以将变量传入Ansible Playbook。

当前配置情况 #

Jenkins凭证 #

已在Jenkins中存储了ID为aws-key（对应AWS_ACCESS_KEY_ID）和aws_secret_access_key（对应AWS_SECRET_ACCESS_KEY）的凭证。

Jenkinsfile代码 #

pipeline {
    agent any
    stages {
        stage('GIT代码拉取'){
           steps{
               git branch: 'ansible', credentialsId: 'test-pipeline', url: 'https://github.com/newbtech'
           }
        }
        environment{
            AWS_ACCESS_KEY_ID = credentials('aws-key')
            AWS_SECRET_ACCESS_KEY = credentials('aws_secret_access_key')
        }
        stage('执行Ansible Playbook'){
           steps{
               ansiblePlaybook credentialsId: 'root-key', 
               disableHostKeyChecking: true, installation: 'ansible', 
               extras: "-e HOST=${SERVER}", 
               inventory: 'ansible/host.inv', 
               playbook: 'ansible/cstest.yml'                
           }
        }
    }
}

Ansible Playbook代码 #

---
- hosts: "{{ HOST }}"
  tasks:
    - name: "从S3拉取Ubuntu包"
      aws_s3:
        aws_access_key: "aws-key"
        aws_secret_key: "aws_secret_access_key"
        bucket: "images"
        object: "ubuntu.deb"
        dest: "/tmp/ubuntu.deb"
        mode: get
      when: ansible_facts['os_family'] == "Debian"
      vars:
         ansible_python_interpreter: /usr/bin/python3

解决方案 #

完全可以将Jenkins中的AWS凭证变量传入Ansible Playbook，以下是几种可行方案：

方案1：通过extras参数直接传递变量 #

在Jenkinsfile的ansiblePlaybook步骤中，把AWS凭证作为额外变量传入Playbook：

ansiblePlaybook credentialsId: 'root-key', 
               disableHostKeyChecking: true, installation: 'ansible', 
               extras: "-e HOST=${SERVER} -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}", 
               inventory: 'ansible/host.inv', 
               playbook: 'ansible/cstest.yml'

同时修改Ansible Playbook，引用这些传递过来的变量：

aws_access_key: "{{ AWS_ACCESS_KEY_ID }}"
aws_secret_key: "{{ AWS_SECRET_ACCESS_KEY }}"

方案2：让Ansible读取Jenkins环境变量 #

Ansible可以直接读取执行环境中的环境变量，只要确保Jenkins的环境变量能传递到Ansible进程即可。

首先修正Jenkinsfile中environment块的位置（应该放在stages同级，而非内部，否则环境变量可能无法正确传递）：

pipeline {
    agent any
    environment{
        AWS_ACCESS_KEY_ID = credentials('aws-key')
        AWS_SECRET_ACCESS_KEY = credentials('aws_secret_access_key')
    }
    stages {
        stage('GIT代码拉取'){
           steps{
               git branch: 'ansible', credentialsId: 'test-pipeline', url: 'https://github.com/newbtech'
           }
        }
        stage('执行Ansible Playbook'){
           steps{
               ansiblePlaybook credentialsId: 'root-key', 
               disableHostKeyChecking: true, installation: 'ansible', 
               extras: "-e HOST=${SERVER}", 
               inventory: 'ansible/host.inv', 
               playbook: 'ansible/cstest.yml'                
           }
        }
    }
}

然后修改Ansible Playbook，使用lookup('env')读取环境变量：

aws_access_key: "{{ lookup('env', 'AWS_ACCESS_KEY_ID') }}"
aws_secret_key: "{{ lookup('env', 'AWS_SECRET_ACCESS_KEY') }}"

方案3：安全进阶方案（可选） #

如果对安全性要求更高，可以：

• 使用Jenkins的凭证绑定功能，将凭证注入到Ansible的执行环境
• 使用Ansible Vault加密存储AWS凭证，在Jenkins中传递解密密钥

不过对于普通场景，前两种方案已经足够解决问题。

内容的提问来源于stack exchange，提问作者Newbietech