Skip to content

Commit ef26df3

Browse files
bbobbettoSbbobbettoS
authored
Added vaultTmpPath option (#133) (#134)
* Resolve issue #133 Added vaultTmpPath option to set a different temporary path, rather than the default workspace,for temporary files generated by interacting with the vault * Test modified to get temp path from system property java.io.tmpdir, maybe fix Windows test * Fixed test in Windows environment, moved vaultTmpPath 'not presence check' to the right test
1 parent 2bcf4bb commit ef26df3

File tree

24 files changed

+188
-14
lines changed

24 files changed

+188
-14
lines changed

‎README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ See also [jenkins.io](https://jenkins.io/doc/pipeline/steps/ansible/) documentat
7272
| Inventory inline content | inventoryContent | CLI arg: `-i`: See the Inventory section for additional details. |
7373
| Credentials | credentialsId | The Jenkins credential to use for the SSH connection. See the Authentication section for additional details. |
7474
| Vault Credentials | vaultCredentialsId | CLI arg: `--vault-password-file`: The Jenkins credential to use as the vault credential. See the Vault Credentials section for additional details. |
75+
| Vault temp path | vaultTmpPath | Path where to store temporary vault secrets files, ssh key files, etc... Default is in workspace. |
7576
| sudo | become | CLI arg: `-s` |
7677
| sudo user | becomeUser | CLI arg: `-U` |
7778
| Number of parallel processes | forks | CLI arg: `-f` |
@@ -123,6 +124,7 @@ for documentation extracted from the online help of the plugin.
123124
| Inventory inline content | inventoryContent | CLI arg: `-i`: See the inventory section for details. |
124125
| Credentials | credentialsId | The Jenkins credential to use for the SSH connection. See the Authentication section for additional details |
125126
| Vault Credentials | vaultCredentialsId | The Jenkins credential to use as the vault credential. See the Vault Credentials section for more details |
127+
| Vault temp path | vaultTmpPath | Path where to store temporary vault secrets files, ssh key files, etc... rkspace. |
126128
| sudo | sudo | CLI arg: `-s` |
127129
| sudo user | sudoUser | CLI arg: `-U` |
128130
| Host subset | limit | CLI arg: `-l` |
@@ -269,6 +271,7 @@ See also [jenkins.io Pipeline step](https://jenkins.io/doc/pipeline/steps/ansibl
269271
| Action | action | Mandatory. The name of the action to use. Interactive operations such as create, edit, and view are not supported. |
270272
| Vault Credentials | vaultCredentialsId | CLI arg: `--vault-password-file`. The Jenkins credential to use as the vault credential. See the Vault Credentials section for more details |
271273
| New Vault Credentials | newVaultCredentialsId | CLI arg: `--new-vault-password-file`. The Jenkins credential to use as the vault credential. See the Vault Credentials section for more details |
274+
| Vault temp path | vaultTmpPath | Path where to store temporary vault secrets files, ssh key files, etc... Default is in workspace. |
272275
| Content | content | The content to encrypt with the 'encrypt_string' action. |
273276
| Input | input | The file to encrypt with the encrypt actions. |
274277
| Output | output | CLI arg: `--output` |

‎src/main/java/org/jenkinsci/plugins/ansible/AbstractAnsibleInvocation.java

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ abstract class AbstractAnsibleInvocation<T extends AbstractAnsibleInvocation<T>>
5353
protected boolean sudo;
5454
protected String sudoUser;
5555
protected StandardCredentials vaultCredentials;
56+
protected FilePath vaultTmpPath;
5657
protected StandardUsernameCredentials credentials;
5758
protected List<ExtraVar> extraVars;
5859
protected String additionalParameters;
@@ -216,6 +217,11 @@ public T setVaultCredentials(StandardCredentials vaultCredentials) {
216217
return (T) this;
217218
}
218219

220+
public T setVaultTmpPath(FilePath vaultTmpPath) {
221+
this.vaultTmpPath = vaultTmpPath;
222+
return (T) this;
223+
}
224+
219225
protected ArgumentListBuilder prependPasswordCredentials(ArgumentListBuilder args) {
220226
if (credentials instanceof UsernamePasswordCredentials) {
221227
UsernamePasswordCredentials passwordCredentials = (UsernamePasswordCredentials)credentials;
@@ -228,12 +234,13 @@ protected ArgumentListBuilder appendCredentials(ArgumentListBuilder args)
228234
throws IOException, InterruptedException
229235
{
230236
if (credentials instanceof SSHUserPrivateKey) {
237+
FilePath tmpPath = vaultTmpPath != null ? vaultTmpPath : ws;
231238
SSHUserPrivateKey privateKeyCredentials = (SSHUserPrivateKey)credentials;
232-
key = Utils.createSshKeyFile(key, ws, privateKeyCredentials, copyCredentialsInWorkspace);
239+
key = Utils.createSshKeyFile(key, tmpPath, privateKeyCredentials, copyCredentialsInWorkspace);
233240
args.add("--private-key").add(key.getRemote().replace("%", "%%"));
234241
args.add("-u").add(privateKeyCredentials.getUsername());
235242
if (privateKeyCredentials.getPassphrase() != null) {
236-
script = Utils.createSshAskPassFile(script, ws, privateKeyCredentials, copyCredentialsInWorkspace);
243+
script = Utils.createSshAskPassFile(script, tmpPath, privateKeyCredentials, copyCredentialsInWorkspace);
237244
environment.put("SSH_ASKPASS", script.getRemote());
238245
// inspired from https://github.com/jenkinsci/git-client-plugin/pull/168
239246
// but does not work with MacOSX
@@ -252,13 +259,14 @@ protected ArgumentListBuilder appendVaultPasswordFile(ArgumentListBuilder args)
252259
throws IOException, InterruptedException
253260
{
254261
if(vaultCredentials != null){
262+
FilePath tmpPath = vaultTmpPath != null ? vaultTmpPath : ws;
255263
if (vaultCredentials instanceof FileCredentials) {
256264
FileCredentials secretFile = (FileCredentials)vaultCredentials;
257-
vaultPassword = Utils.createVaultPasswordFile(vaultPassword, ws, secretFile);
265+
vaultPassword = Utils.createVaultPasswordFile(vaultPassword, tmpPath, secretFile);
258266
args.add("--vault-password-file").add(vaultPassword.getRemote().replace("%", "%%"));
259267
} else if (vaultCredentials instanceof StringCredentials) {
260268
StringCredentials secretText = (StringCredentials)vaultCredentials;
261-
vaultPassword = Utils.createVaultPasswordFile(vaultPassword, ws, secretText);
269+
vaultPassword = Utils.createVaultPasswordFile(vaultPassword, tmpPath, secretText);
262270
args.add("--vault-password-file").add(vaultPassword.getRemote().replace("%", "%%"));
263271
}
264272
}

‎src/main/java/org/jenkinsci/plugins/ansible/AnsibleAdHocCommandBuilder.java

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
package org.jenkinsci.plugins.ansible;
1717

1818
import java.io.IOException;
19+
import java.io.File;
1920
import java.util.List;
2021
import javax.annotation.Nonnull;
2122

@@ -55,6 +56,8 @@ public class AnsibleAdHocCommandBuilder extends Builder implements SimpleBuildSt
5556

5657
public String vaultCredentialsId = null;
5758

59+
public String vaultTmpPath = null;
60+
5861
public final String hostPattern;
5962

6063
/**
@@ -135,6 +138,11 @@ public void setCredentialsId(String credentialsId) {
135138
public void setVaultCredentialsId(String vaultCredentialsId) {
136139
this.vaultCredentialsId = vaultCredentialsId;
137140
}
141+
142+
@DataBoundSetter
143+
public void setVaultTmpPath(String vaultTmpPath) {
144+
this.vaultTmpPath = vaultTmpPath;
145+
}
138146

139147
public void setBecome(boolean become) {
140148
this.become = become;
@@ -215,6 +223,7 @@ public void perform(@Nonnull Run<?, ?> run, @Nonnull FilePath ws, @Nonnull Launc
215223
invocation.setVaultCredentials(StringUtils.isNotBlank(vaultCredentialsId) ?
216224
CredentialsProvider.findCredentialById(vaultCredentialsId, StandardCredentials.class, run) :
217225
null);
226+
invocation.setVaultTmpPath(StringUtils.isNotBlank(vaultTmpPath) ? new FilePath(new File(vaultTmpPath)) : null);
218227
invocation.setExtraVars(extraVars);
219228
invocation.setAdditionalParameters(additionalParameters);
220229
invocation.setDisableHostKeyCheck(disableHostKeyChecking);

‎src/main/java/org/jenkinsci/plugins/ansible/AnsiblePlaybookBuilder.java

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
package org.jenkinsci.plugins.ansible;
1717

1818
import java.io.IOException;
19+
import java.io.File;
1920
import java.util.List;
2021
import javax.annotation.Nonnull;
2122

@@ -69,6 +70,8 @@ public class AnsiblePlaybookBuilder extends Builder implements SimpleBuildStep
6970

7071
public String vaultCredentialsId = null;
7172

73+
public String vaultTmpPath = null;
74+
7275
public boolean become = false;
7376

7477
public String becomeUser = "root";
@@ -165,6 +168,11 @@ public void setVaultCredentialsId(String vaultCredentialsId) {
165168
this.vaultCredentialsId = vaultCredentialsId;
166169
}
167170

171+
@DataBoundSetter
172+
public void setVaultTmpPath(String vaultTmpPath) {
173+
this.vaultTmpPath = vaultTmpPath;
174+
}
175+
168176
public void setBecome(boolean become) {
169177
this.become = become;
170178
}
@@ -253,6 +261,7 @@ public void perform(@Nonnull Run<?, ?> run, @Nonnull Node node, @Nonnull FilePat
253261
copyCredentialsInWorkspace);
254262
invocation.setVaultCredentials(StringUtils.isNotBlank(vaultCredentialsId) ?
255263
CredentialsProvider.findCredentialById(vaultCredentialsId, StandardCredentials.class, run) : null);
264+
invocation.setVaultTmpPath(StringUtils.isNotBlank(vaultTmpPath) ? new FilePath(new File(vaultTmpPath)) : null);
256265
invocation.setExtraVars(extraVars);
257266
invocation.setAdditionalParameters(additionalParameters);
258267
invocation.setDisableHostKeyCheck(disableHostKeyChecking);

‎src/main/java/org/jenkinsci/plugins/ansible/AnsibleVaultBuilder.java

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
package org.jenkinsci.plugins.ansible;
1515

1616
import java.io.IOException;
17+
import java.io.File;
1718
import javax.annotation.Nonnull;
1819

1920
import com.cloudbees.plugins.credentials.CredentialsProvider;
@@ -53,6 +54,8 @@ public class AnsibleVaultBuilder extends Builder implements SimpleBuildStep
5354

5455
public String newVaultCredentialsId = null;
5556

57+
public String vaultTmpPath = null;
58+
5659
public String content = null;
5760

5861
public String input = null;
@@ -84,6 +87,11 @@ public void setNewVaultCredentialsId(String newVaultCredentialsId) {
8487
this.newVaultCredentialsId = newVaultCredentialsId;
8588
}
8689

90+
@DataBoundSetter
91+
public void setVaultTmpPath(String vaultTmpPath) {
92+
this.vaultTmpPath = vaultTmpPath;
93+
}
94+
8795
@DataBoundSetter
8896
public void setContent(String content) {
8997
this.content = content;
@@ -123,6 +131,7 @@ public void perform(@Nonnull Run<?, ?> run, @Nonnull Node node, @Nonnull FilePat
123131
CredentialsProvider.findCredentialById(vaultCredentialsId, StandardCredentials.class, run) : null);
124132
invocation.setNewVaultCredentials(StringUtils.isNotBlank(newVaultCredentialsId) ?
125133
CredentialsProvider.findCredentialById(newVaultCredentialsId, StandardCredentials.class, run) : null);
134+
invocation.setVaultTmpPath(StringUtils.isNotBlank(vaultTmpPath) ? new FilePath(new File(vaultTmpPath)) : null);
126135
invocation.setContent(content);
127136
invocation.setInput(input);
128137
invocation.setOutput(output);

‎src/main/java/org/jenkinsci/plugins/ansible/AnsibleVaultInvocation.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -106,13 +106,14 @@ protected ArgumentListBuilder appendNewVaultPasswordFile(ArgumentListBuilder arg
106106
throws IOException, InterruptedException
107107
{
108108
if(newVaultCredentials != null){
109+
FilePath tmpPath = vaultTmpPath != null ? vaultTmpPath : ws;
109110
if (newVaultCredentials instanceof FileCredentials) {
110111
FileCredentials secretFile = (FileCredentials)newVaultCredentials;
111-
newVaultPassword = Utils.createVaultPasswordFile(newVaultPassword, ws, secretFile);
112+
newVaultPassword = Utils.createVaultPasswordFile(newVaultPassword, tmpPath, secretFile);
112113
args.add("--new-vault-password-file").add(newVaultPassword.getRemote().replace("%", "%%"));
113114
} else if (newVaultCredentials instanceof StringCredentials) {
114115
StringCredentials secretText = (StringCredentials)newVaultCredentials;
115-
newVaultPassword = Utils.createVaultPasswordFile(newVaultPassword, ws, secretText);
116+
newVaultPassword = Utils.createVaultPasswordFile(newVaultPassword, tmpPath, secretText);
116117
args.add("--new-vault-password-file").add(newVaultPassword.getRemote().replace("%", "%%"));
117118
}
118119
}

‎src/main/java/org/jenkinsci/plugins/ansible/Utils.java

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -37,21 +37,21 @@ class Utils
3737
* @throws IOException
3838
* @throws InterruptedException
3939
*/
40-
static FilePath createSshKeyFile(FilePath key, FilePath workspace, SSHUserPrivateKey credentials, boolean inWorkspace) throws IOException, InterruptedException {
40+
static FilePath createSshKeyFile(FilePath key, FilePath tmpPath, SSHUserPrivateKey credentials, boolean inThisDir) throws IOException, InterruptedException {
4141
StringBuilder sb = new StringBuilder();
4242
List<String> privateKeys = credentials.getPrivateKeys();
4343
for (String s : privateKeys) {
4444
sb.append(s);
4545
}
46-
key = workspace.createTextTempFile("ssh", ".key", sb.toString(), inWorkspace);
46+
key = tmpPath.createTextTempFile("ssh", ".key", sb.toString(), inThisDir);
4747
key.chmod(0400);
4848
return key;
4949
}
5050

51-
static FilePath createSshAskPassFile(FilePath script, FilePath workspace, SSHUserPrivateKey credentials, boolean inWorkspace) throws IOException, InterruptedException {
51+
static FilePath createSshAskPassFile(FilePath script, FilePath tmpPath, SSHUserPrivateKey credentials, boolean inThisDir) throws IOException, InterruptedException {
5252
StringBuilder sb = new StringBuilder();
5353
sb.append("#! /bin/sh\n").append("/bin/echo \"" + Secret.toString(credentials.getPassphrase()) + "\"");
54-
script = workspace.createTextTempFile("ssh", ".sh", sb.toString(), inWorkspace);
54+
script = tmpPath.createTextTempFile("ssh", ".sh", sb.toString(), inThisDir);
5555
script.chmod(0700);
5656
return script;
5757
}
@@ -65,9 +65,9 @@ static FilePath createSshAskPassFile(FilePath script, FilePath workspace, SSHUse
6565
* @throws IOException
6666
* @throws InterruptedException
6767
*/
68-
static FilePath createVaultPasswordFile(FilePath key, FilePath workspace, FileCredentials credentials) throws IOException, InterruptedException {
68+
static FilePath createVaultPasswordFile(FilePath key, FilePath tmpPath, FileCredentials credentials) throws IOException, InterruptedException {
6969
try (InputStream content = credentials.getContent()) {
70-
key = workspace.createTempFile("vault", ".password");
70+
key = tmpPath.createTempFile("vault", ".password");
7171
key.copyFrom(content);
7272
key.chmod(0400);
7373
}
@@ -83,8 +83,8 @@ static FilePath createVaultPasswordFile(FilePath key, FilePath workspace, FileCr
8383
* @throws IOException
8484
* @throws InterruptedException
8585
*/
86-
static FilePath createVaultPasswordFile(FilePath key, FilePath workspace, StringCredentials credentials) throws IOException, InterruptedException {
87-
key = workspace.createTextTempFile("vault", ".password", credentials.getSecret().getPlainText(), true);
86+
static FilePath createVaultPasswordFile(FilePath key, FilePath tmpPath, StringCredentials credentials) throws IOException, InterruptedException {
87+
key = tmpPath.createTextTempFile("vault", ".password", credentials.getSecret().getPlainText(), true);
8888
key.chmod(0400);
8989
return key;
9090
}

‎src/main/java/org/jenkinsci/plugins/ansible/jobdsl/AnsibleJobDslExtension.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ public Object ansibleAdHoc(String module, String command, Runnable closure) {
2828
adhoc.setAnsibleName(context.getAnsibleName());
2929
adhoc.setCredentialsId(context.getCredentialsId());
3030
adhoc.setVaultCredentialsId(context.getVaultCredentialsId());
31+
adhoc.setVaultTmpPath(context.getVaultTmpPath());
3132
adhoc.setColorizedOutput(context.isColorizedOutput());
3233
adhoc.setForks(context.getForks());
3334
adhoc.setDisableHostKeyChecking(context.isDisableHostKeyChecking());
@@ -52,6 +53,7 @@ public Object ansiblePlaybook(String playbook, Runnable closure) {
5253
plbook.setAnsibleName(context.getAnsibleName());
5354
plbook.setCredentialsId(context.getCredentialsId());
5455
plbook.setVaultCredentialsId(context.getVaultCredentialsId());
56+
plbook.setVaultTmpPath(context.getVaultTmpPath());
5557
plbook.setColorizedOutput(context.isColorizedOutput());
5658
plbook.setForks(context.getForks());
5759
plbook.setDisableHostKeyChecking(context.isDisableHostKeyChecking());
@@ -80,6 +82,7 @@ public Object ansibleVault(Runnable closure) {
8082
vault.setAction(context.getAction());
8183
vault.setVaultCredentialsId(context.getVaultCredentialsId());
8284
vault.setNewVaultCredentialsId(context.getNewVaultCredentialsId());
85+
vault.setVaultTmpPath(context.getVaultTmpPath());
8386
vault.setContent(context.getContent());
8487
vault.setInput(context.getInput());
8588
vault.setOutput(context.getOutput());

‎src/main/java/org/jenkinsci/plugins/ansible/jobdsl/context/AnsibleContext.java

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ public class AnsibleContext implements Context {
2121
private String credentialsId;
2222
private String vaultCredentialsId;
2323
private String newVaultCredentialsId;
24+
private String vaultTmpPath = null;
2425
private String content;
2526
private String input;
2627
private String output;
@@ -82,6 +83,10 @@ public void newVaultCredentialsId(String newVaultCredentialsId) {
8283
this.newVaultCredentialsId = newVaultCredentialsId;
8384
}
8485

86+
public void setVaultTmpPath(String vaultTmpPath) {
87+
this.vaultTmpPath = vaultTmpPath;
88+
}
89+
8590
public void content(String content) {
8691
this.content = content;
8792
}
@@ -174,6 +179,10 @@ public String getNewVaultCredentialsId() {
174179
return newVaultCredentialsId;
175180
}
176181

182+
public String getVaultTmpPath() {
183+
return vaultTmpPath;
184+
}
185+
177186
public String getContent() {
178187
return content;
179188
}

‎src/main/java/org/jenkinsci/plugins/ansible/workflow/AnsibleAdhocStep.java

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ public class AnsibleAdhocStep extends AbstractStepImpl {
6565
private String installation;
6666
private String credentialsId;
6767
private String vaultCredentialsId;
68+
private String vaultTmpPath = null;
6869
private boolean become = false;
6970
private String becomeUser = "root";
7071
private List<ExtraVar> extraVars = null;
@@ -113,6 +114,11 @@ public void setVaultCredentialsId(String vaultCredentialsId) {
113114
this.vaultCredentialsId = Util.fixEmptyAndTrim(vaultCredentialsId);
114115
}
115116

117+
@DataBoundSetter
118+
public void setVaultTmpPath(String vaultTmpPath) {
119+
this.vaultTmpPath = vaultTmpPath;
120+
}
121+
116122
@DataBoundSetter
117123
public void setBecome(boolean become) {
118124
this.become = become;
@@ -189,6 +195,10 @@ public String getVaultCredentialsId() {
189195
return vaultCredentialsId;
190196
}
191197

198+
public String getVaultTmpPath() {
199+
return vaultTmpPath;
200+
}
201+
192202
public boolean isBecome() {
193203
return become;
194204
}
@@ -305,6 +315,7 @@ protected Void run() throws Exception {
305315
builder.setBecomeUser(step.getBecomeUser());
306316
builder.setCredentialsId(step.getCredentialsId());
307317
builder.setVaultCredentialsId(step.getVaultCredentialsId());
318+
builder.setVaultTmpPath(step.getVaultTmpPath());
308319
builder.setForks(step.getForks());
309320
builder.setExtraVars(step.getExtraVars());
310321
builder.setAdditionalParameters(step.getExtras());

0 commit comments

Comments
 (0)