如何隐藏Jenkins管道控制台输出中的参数，如APIKey

Question

当我在stage中执行脚本时，如何隐藏某些参数或*它们。

生成我想隐藏的输出的命令是：

sh "./wsagent_execute.sh -s -apiKey ${WHITESOURCE_API_KEY} -projectToken ${WHITESOURCE_PROJECT_TOKEN} -C ${configPath} -d ${directoryPath} -logLevel info"

我想隐藏的参数是-apiKey和-projectToken。我该怎么做呢？

Answer 1

如果您从保管库获取凭据，则可以使用Mask Password插件。它没有声明它支持Pipeline，但实际上它是支持的。

pipeline {
    agent any

    stages {
      stage('doing something') {
        steps {
          script {
            def current_nano = "1616407597607795668"
            sh label: "Now you see it", script: "echo ${current_nano}"
            maskPasswords(varPasswordPairs: [[password: current_nano, var: 'IGNORE']]) {
              sh label: "Now you don't", script: "echo ${current_nano}"
            }
          }
        }
      }
    }
}

输出：

[Pipeline] Start of Pipeline
[Pipeline] node
Running on Jenkins in /var/jenkins_home/workspace/
[Pipeline] {
[Pipeline] stage
[Pipeline] { (doing something)
[Pipeline] script
[Pipeline] {
[Pipeline] sh (Now you see it)
+ echo 1616407597607795668
1616407597607795668
[Pipeline] maskPasswords
[Pipeline] {
[Pipeline] sh (Now you don't)
+ echo ********
********
[Pipeline] }
[Pipeline] // maskPasswords
[Pipeline] }
[Pipeline] // script
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
Finished: SUCCESS

Answer 2

这些键是在管道中计算的，还是静态计算的？您可以尝试像使用Jenkins中的凭证一样使用它，但在日志中看不到它们的值。

Answer 3

如果您使用Jenkins凭据中定义的秘密，Jenkins将自动为您屏蔽该秘密，并在日志中显示为*

假设您已经使用Id: apikey在jenkins credential中定义了您的apiKey。然后你可以像下面的例子一样在你的管道上使用它。

更多详情请访问：here

node() {
   withCredentials([string(credentialsId: 'apikey', variable: 'TOKEN')]) {
      sh "./wsagent_execute.sh -s -apiKey $TOKEN -projectToken ${WHITESOURCE_PROJECT_TOKEN} -C ${configPath} -d ${directoryPath} -logLevel info"
   }
}

如果您对使用mask password或其他类似插件不满意