Jenkins流水线需求：获取当前用户+分环境部署权限控制

Hey there, let's walk through implementing all three of your Jenkins pipeline requirements with practical, actionable code examples:

To grab the user who triggered or is executing the pipeline, you can use currentBuild.currentUser to access their username and details. Here's a quick snippet to integrate this:

script {
  def currentUser = currentBuild.currentUser.id
  echo "Current pipeline executor: ${currentUser}"
}

This will print the username of the user running the pipeline, which we'll reuse for the permission check step later.

Add an interactive input step in the post { success } block to prompt the user after a successful build. This pauses the pipeline until the user selects an action:

pipeline {
  agent any
  stages {
    stage('Build') {
      steps {
        echo "Running build steps..."
        // Add your actual build commands here (e.g., mvn clean install)
      }
    }
  }
  post {
    success {
      stage('Confirm Deployment') {
        steps {
          script {
            def currentUser = currentBuild.currentUser.id
            def userAction = input(
              message: "Build succeeded! ${currentUser}, please choose your next action:",
              parameters: [
                choice(
                  name: 'DEPLOY_ACTION',
                  choices: ['Continue Deployment', 'Terminate Pipeline'],
                  description: 'Select whether to proceed with deployment or stop here'
                )
              ]
            )
            
            if (userAction == 'Terminate Pipeline') {
              error("Pipeline terminated by ${currentUser} after successful build")
            }
            echo "${currentUser} chose to continue with deployment"
          }
        }
      }
    }
  }
}

If the user selects "Terminate Pipeline", the pipeline will fail gracefully with a clear message. Otherwise, it proceeds to the next stages.

We'll assume your Jenkins instance uses user groups (e.g., dev-team for developers, ops-team for operations staff) to enforce role-based access. Here's how to integrate permission checks into a full pipeline:

Full Integrated Pipeline with All Requirements #

pipeline {
  agent any
  parameters {
    choice(
      name: 'TARGET_ENV',
      choices: ['Dev', 'QA', 'Prod'],
      description: 'Select the target deployment environment'
    )
  }
  stages {
    stage('Permission Validation') {
      steps {
        script {
          def currentUser = currentBuild.currentUser.id
          def targetEnv = params.TARGET_ENV
          
          // Fetch user's groups from Jenkins security realm
          def userGroups = jenkins.model.Jenkins.instance.securityRealm.loadUserByUsername(currentUser).groups
          def isDeveloper = userGroups.contains('dev-team')
          def isOps = userGroups.contains('ops-team')
          
          // Enforce permission rules
          if (targetEnv in ['QA', 'Prod']) {
            if (!isOps) {
              // Block developers from deploying to non-Dev environments
              error("无权部署至QA或Prod环境，请通知运维人员继续后续流水线部署")
            }
            echo "✅ Ops user ${currentUser} is authorized to deploy to ${targetEnv}"
          } else if (targetEnv == 'Dev') {
            echo "✅ User ${currentUser} is authorized to deploy to Dev environment"
          }
        }
      }
    }
    
    stage('Build') {
      steps {
        echo "Building application for ${params.TARGET_ENV}..."
        // Your build logic here (e.g., npm run build, docker build)
      }
    }
    
    stage('Post-Build Confirmation') {
      when {
        success()
      }
      steps {
        script {
          def userAction = input(
            message: 'Build succeeded! Choose next action:',
            parameters: [choice(name: 'ACTION', choices: ['Continue Deployment', 'Terminate'], description: 'Select action')]
          )
          if (userAction == 'Terminate') {
            error("Pipeline terminated by user ${currentBuild.currentUser.id}")
          }
        }
      }
    }
    
    stage('Deploy to Target Environment') {
      steps {
        echo "Deploying to ${params.TARGET_ENV} environment..."
        // Your deployment logic here (e.g., kubectl apply, ansible playbook)
      }
    }
  }
}

Quick Notes for Permission Control: #

• Ensure your Jenkins security realm (LDAP, Active Directory, or internal users) is configured with the correct groups (dev-team and ops-team in this example).
• If you're using the Role-based Authorization Strategy Plugin, replace the group check with plugin-specific methods to fetch the user's assigned roles instead.

内容的提问来源于stack exchange，提问作者sudhir