3

I have a global jenkins credential and a config script that includes the line

API_TOKEN = "Token XXX"

For security reasons we can't keep the token in the script itself as its in version control. Is there a way to pass the jenkins credential to the python config script from jenkins?

  • How is Jenkins configured to invoke your script? – Dan Cornilescu Jun 27 '18 at 13:26
5

Specifically for credentials, CloudBees recommends using the Credentials Plugins, which inject the credentials in the environment available to the invoked scripts. From Injecting Secrets into Jenkins Build Jobs:

  • Credentials plugin - provides a centralized way to define credentials that can be used by your Jenkins instance, plugins and build jobs.
  • Credentials Binding plugin - allows you to configure your build jobs to inject credentials as environment variables.
  • Plain Credentials plugin - a plugin dependency required by the Credentials Binding plugin.

Inside your script you'd pick up the variable from the script's environment:

API_TOKEN = os.getenv('API_TOKEN')

In a similar way you can pass any arbitrary variables (other than credentials), using the EnvInject Plugin (watch for the warnings, tho). See related:

Another possible approach is to configure Jenkins to pass the value as an argument to your script. Inside your script you'd pick up the value using your preferred method of processing the script arguments.

4

If you are using Pipeline (i.e. Jenkinsfile), use withCredentials. To give a quick and dirty example:

withCredentials([[
  $class: 'UsernamePasswordMultiBinding',
  credentialsId: 'my-credentials',
  usernameVariable: 'user',
  passwordVariable: 'pw',
]]) {
  sh("./my-python-script.py --user ${user} --password ${pw}")
}

Your credentials will be automatically redacted from the console output to help prevent sensitive information from leaking.

  • 1
    One thing to beware: credentials plugin hide secrets from jenkins console only. Should the python script create a log and store the secret there, it will not be masked. At present, I know of no way to clean a log file effectively. Waiting on issues.jenkins-ci.org/browse/JENKINS-58664 – Peter Kahn Jul 25 '19 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.