Passing a jenkins credential (global) to a python script

Question

I have a global jenkins credential and a config script that includes the line

API_TOKEN = "Token XXX"

For security reasons we can't keep the token in the script itself as its in version control. Is there a way to pass the jenkins credential to the python config script from jenkins?

Answer 1

Specifically for credentials, CloudBees recommends using the Credentials Plugins, which inject the credentials in the environment available to the invoked scripts. From Injecting Secrets into Jenkins Build Jobs:

• Credentials plugin - provides a centralized way to define credentials that can be used by your Jenkins instance, plugins and build jobs.
• Credentials Binding plugin - allows you to configure your build jobs to inject credentials as environment variables.
• Plain Credentials plugin - a plugin dependency required by the Credentials Binding plugin.

Inside your script you'd pick up the variable from the script's environment:

API_TOKEN = os.getenv('API_TOKEN')

In a similar way you can pass any arbitrary variables (other than credentials), using the EnvInject Plugin (watch for the warnings, tho). See related:

• Jenkins inject environment variable
• Environment variables in Jenkins

Another possible approach is to configure Jenkins to pass the value as an argument to your script. Inside your script you'd pick up the value using your preferred method of processing the script arguments.

Answer 2

If you are using Pipeline (i.e. Jenkinsfile), use withCredentials. To give a quick and dirty example:

withCredentials([[
  $class: 'UsernamePasswordMultiBinding',
  credentialsId: 'my-credentials',
  usernameVariable: 'user',
  passwordVariable: 'pw',
]]) {
  sh("./my-python-script.py --user ${user} --password ${pw}")
}

Your credentials will be automatically redacted from the console output to help prevent sensitive information from leaking.