6

In Jenkinsfile, I want to make an ssh key visible to all stages in the pipeline.

From the official document, I learned that:

  1. environment directive is used to defy environment variables for used within Jenkinsfile
  2. The scope of the variables defined depends on the placement of the environment directive
  3. One can set the some types of credentials insideenvironment directive with the help of the credentials helper
  4. The types of credentials supported by the helper are:
    • Secret text
    • Usernames and passwords
    • Secret files

For other types of credentials, the document suggests using the snippet generator, which generates a step.

Example of an ssh key step

withCredentials([sshUserPrivateKey(credentialsId: 'jenkins_aws_to_bitbucket', keyFileVariable: 'BITBUCKET_PRV_KEY')]) {
    // some block
}

This is meant to be used in a stage like:

pipeline {
    agent {
        // define agent details
    }
    stages {
        stage('Example stage 1') {
            steps {
                withCredentials(bindings: [sshUserPrivateKey(credentialsId: 'jenkins-ssh-key-for-abc', \
                                                             keyFileVariable: 'SSH_KEY_FOR_ABC')]) {
                  // 
                }
                withCredentials(bindings: [certificate(credentialsId: 'jenkins-certificate-for-xyz', \
                                                       keystoreVariable: 'CERTIFICATE_FOR_XYZ', \
                                                       passwordVariable: 'XYZ-CERTIFICATE-PASSWORD')]) {
                  // 
                }
            }
        }
        stage('Example stage 2') {
            steps {
                // 
            }
        }
    }
}

Snippet source

Question

  1. If the steps are within a stage, are these credentials visible within other stages?
  2. If not, how to make these credentials global ~ visible within all stages
6
  1. No, the credentials will only be visible within the block passed to withCredentials, not outside of that.

  2. There is no way to make the credentials globally available without switching to Scripted Pipeline. With Scripted, you can wrap your entire job in withCredentials. This is not possible with Declarative.

1

I set credential globally in declarative pipeline like this and then my Jenkins could talk with Google Dataflow in all stages. For example, I used a secret file (google service account).


pipeline {
    agent any
    environment {
        //Secret File ID was defined in Jenkins -> Credentials -> System -> Global credentials
        GOOGLE_APPLICATION_CREDENTIALS = credentials('mySecretFileId')

        GCP_PROJECT_NAME = 'myProject'
    }
   stages {
             stage('step 1') {
              steps {
                sh "gcloud auth activate-service-account --key-file ${env.GOOGLE_APPLICATION_CREDENTIALS}"
                sh "gcloud config set project ${env.GCP_PROJECT_NAME}"

                // access google dataflow
                sh "gcloud dataflow jobs list --status=active"
                // ....
              }
             }
             stage('stage 2') {
               steps {
                  // access google dataflow
                  sh "gcloud dataflow jobs list --status=active"
               }
             }
             //...
   }
}   


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.