How to turn variable from hashiport vault to global variable in Jenkinsfile

Question

I am new to Jenkins and have been dealing with an issue for 3 days nonstop and cant figure it out, so I am hoping someone can help out.
I am trying to pass a secret from hashicorp vault into a jenkins pipeline and it looks like I can pull the secret but I can not use it outside of the curly brackets of the withVault statement, can someone point me in the right direction on how to turn this secret into a global variable that I can then use inside of the pipeline?

Here is my code:

#!/usr/bin/env groovy
def projectProperties = [
  [$class: 'BuildDiscarderProperty',strategy: [$class: 'LogRotator', numToKeepStr: '5']]
]

    node{
withVault(configuration: [timeout: 60, vaultCredentialId: 'approle', vaultUrl: 'https://redacted.com'], vaultSecrets: [[path: '/secrets/kaniko', secretValues: [[vaultKey: 'key']]]])
{
 sh 'echo $key' #Shows that the key has been pulled while running the pipeline
}
}

pipeline {
     agent {
    kubernetes {
      cloud 'openshift'
      idleMinutes 15
      activeDeadlineSeconds 1800
      yaml """
apiVersion: v1
kind: Pod
metadata:
  name: kaniko
spec:
  volumes:
  - name: build-context
    emptyDir: {}
  - name: kaniko-secret
    secret:
      secretName: regcred-${NAMESPACE}
      items:
        - key: .dockerconfigjson
          path: config.json
  securityContext:
    runAsUser: 0
  serviceAccount: kaniko
  initContainers:
    - name: kaniko-init
      image: ubuntu
  containers:
  - name: kaniko
    image: gcr.io/kaniko-project/executor:latest
    args: ["--context=git://${key}@github.com/redacted/dockerfiles.git#refs/heads/${BRANCH}",
      "--destination=image-registry.openshift-image-registry.svc:5000/${NAMESPACE}/${IMAGE_NAME}:${IMAGE_TAG}",
      "--dockerfile=/jenkins-slave-ansible/Dockerfile",
      "--skip-tls-verify"]
    resources:
      limits:
        cpu: 1
        memory: 5Gi
      requests:
        cpu: 100m
        memory: 256Mi
    volumeMounts:
      - name: build-context
        mountPath: /kaniko/build-context
      - name: kaniko-secret
        mountPath: /kaniko/.docker
  restartPolicy: Never
"""
    }
  }
    parameters {
    choice(name: 'NAMESPACE', choices: ['engineering', 'ce-jenkins-testing']) 
    string(defaultValue: 'master', description: 'Please enter your branch name', name: 'BRANCH') 
    string(defaultValue: 'test', description: 'Please enter your image name (e.g.: jenkins-slave-ansible)', name: 'IMAGE_NAME') 
    string(defaultValue: 'latest', description: 'Please add your tag (e.g.: 1.72.29)', name: 'IMAGE_TAG') 
  }   
etc..... more code below

I need to be able to use the key from above inside of the line:

args: ["--context=git://${key}@github.com/redacted/dockerfiles.git#refs/heads/${BRANCH}"

Thanks in advance!

Answer 1

You can bind the vaultKey to an environment variable

secretValues: [[vaultKey: 'key', envVar: 'KEY']]

And then where you need to use it, reference env.KEY

args: ["--context=git://${env.KEY}@github.com/redacted/dockerfiles.git#refs/heads/${BRANCH}"