6

I can see credentials in Jenkins console output. How can we encrypt them? The "Mask Passwords plugin" is considered as not safe in my case.

5

Here's an example of using them in a pipeline safely. In this case, they are injected as environment variables and their value should never have to be shown unless you explicitly choose to print out the variable content for some reason or other.

Environment variables are generally seen as the best way to store secrets at this point and are heavily relied on by many modern deployments (e.g. often used in kubernetes apps).

https://www.jenkins.io/doc/book/pipeline/jenkinsfile/#handling-credentials

Jenkinsfile (Declarative Pipeline)
pipeline {
    agent {
        // Define agent details here
    }
    environment {
        AWS_ACCESS_KEY_ID     = credentials('jenkins-aws-secret-key-id')
        AWS_SECRET_ACCESS_KEY = credentials('jenkins-aws-secret-access-key')
    }
    stages {
        stage('Example stage 1') {
            steps {
                // 
            }
        }
        stage('Example stage 2') {
            steps {
                // 
            }
        }
    }
}

You can also avoid Jenkins altogether by having your pipeline/etc retrieve them from some other tool like HashiCorp Vault, AWS SSM, Azure Vault, etc.

2
  • Thanks, that is a good idea to retrive credentials from tools like AWS. I am thinking if someone wants to use the jenkins, he or she has to store their credentials in AWS, if this jenkins pipeline tools is used by a large number of people, would that be a problem?
    – RTenda
    Apr 30 '20 at 1:16
  • You can set things up so that most users can't touch the settings/config + credentials in Jenkins or equivalent tools. I'd expect a service account type user to do the pipeline work and for that to be decoupled from the Jenkins user. You may want a job (e.g. deploy to development) to be runnable by anyone but only modifiable by devops personnel, and you may want to restrict, say, the prod job to only being runnable by devops personnel who are allowed to touch prod. May 3 '20 at 20:16
0

John's answer works just fine. An alternative is to use the withCredentials block, which is built right into core Jenkins.

Example

pipeline {
  agent any

  stages {
    ...
    stage('Publish') {
      steps {
        withCredentials([usernamePassword(credentialsId: 'sonar-publisher', usernameVariable: 'SONAR_USER', passwordVariable: 'SONAR_PASSWORD')]) {
          // maybe do stuff with variables, echoing them prints *****
          sh './gradlew sonar'
        }
      }
    }
  }
}

The only requirement in this scenario is that the credentials sonar-publisher exists on the Jenkins master and your job has access to them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.