Jenkins多凭证（Azure服务主体）注入失败，如何解决？

问题描述 #

你在Jenkins流水线中尝试注入Azure服务主体凭证和SSH密钥文件时遇到了类型转换错误，原流水线代码如下：

stage('provision') { 
  withCredentials([ 
    [azureServicePrincipal('azsrvprincipaldev')], 
    [$class: 'FileBinding', credentialsId: 'id_rsa', variable: 'RSA_PATH'], 
    [$class: 'FileBinding', credentialsId: 'id_rsa.pub', variable: 'RSA_PUB_PATH'] 
  ]) { 
    sh './jenkins.sh' 
  } 
}

执行时抛出的错误信息：

java.lang.ClassCastException: org.jenkinsci.plugins.credentialsbinding.impl.BindingStep.bindings expects class org.jenkinsci.plugins.credentialsbinding.MultiBinding but received class java.util.ArrayList
Caused: java.lang.IllegalArgumentException: Could not instantiate {bindings=[[@azureServicePrincipal(<anonymous>=azsrvprincipaldev)], {$class=FileBinding, credentialsId=id_rsa, variable=RSA_PATH}, {$class=FileBinding, credentialsId=id_rsa.pub, variable=RSA_PUB_PATH}]} for BindingStep(bindings: MultiBinding{AzureCredentialsBinding(credentialsId: String, clientIdVariable?: String, clientSecretVariable?: String, subscriptionIdVariable?: String, tenantIdVariable?: String) ...

问题原因 #

错误的核心是**azureServicePrincipal('azsrvprincipaldev')被额外套了一层方括号**，导致它变成了ArrayList类型，而withCredentials要求每个绑定项都是MultiBinding类型，不允许嵌套数组结构。

修正后的代码 #

把azureServicePrincipal外面多余的方括号去掉即可，正确的流水线代码如下：

stage('provision') { 
  withCredentials([ 
    azureServicePrincipal('azsrvprincipaldev'), 
    [$class: 'FileBinding', credentialsId: 'id_rsa', variable: 'RSA_PATH'], 
    [$class: 'FileBinding', credentialsId: 'id_rsa.pub', variable: 'RSA_PUB_PATH'] 
  ]) { 
    sh './jenkins.sh' 
  } 
}

进阶：自定义环境变量名（可选） #

如果不想使用默认的Azure凭证环境变量名（默认会生成AZURE_CLIENT_ID、AZURE_CLIENT_SECRET等变量），可以显式指定自定义变量名：

stage('provision') { 
  withCredentials([ 
    azureServicePrincipal(
      credentialsId: 'azsrvprincipaldev',
      clientIdVariable: 'MY_AZURE_CLIENT_ID',
      clientSecretVariable: 'MY_AZURE_CLIENT_SECRET',
      subscriptionIdVariable: 'MY_AZURE_SUBSCRIPTION_ID',
      tenantIdVariable: 'MY_AZURE_TENANT_ID'
    ), 
    [$class: 'FileBinding', credentialsId: 'id_rsa', variable: 'RSA_PATH'], 
    [$class: 'FileBinding', credentialsId: 'id_rsa.pub', variable: 'RSA_PUB_PATH'] 
  ]) { 
    sh './jenkins.sh' 
  } 
}

这样修改后，Jenkins就能正确识别所有绑定项的类型，不会再抛出ClassCastException错误了。

内容的提问来源于stack exchange，提问作者saromba