Credentials plugin for secrets in Jenkins - Mini Project: Build & Apply

Using Jenkins Credentials Plugin to Manage Secrets

📖 Scenario: You are setting up a Jenkins pipeline to deploy an application. To keep your deployment secure, you want to store sensitive information like passwords and API tokens safely using Jenkins Credentials Plugin.

🎯 Goal: Learn how to create and use Jenkins credentials in a pipeline script to access secrets securely without exposing them in your code.

📋 What You'll Learn

Create a Jenkins credential with a specific ID and secret value

Reference the credential ID in a pipeline script

Use the credential securely inside the pipeline steps

Print a message confirming the secret was accessed (without showing the secret)

💡 Why This Matters

🌍 Real World

In real projects, storing secrets like API tokens, passwords, and keys securely is critical to protect your systems from unauthorized access.

💼 Career

Knowing how to manage secrets with Jenkins Credentials Plugin is a key skill for DevOps engineers and automation specialists to build secure CI/CD pipelines.

1

Create a Jenkins secret text credential

Create a Jenkins secret text credential with the ID my-secret-token and the secret value superSecret123. This credential will store your API token securely.

Jenkins

# Create the secret text credential in Jenkins UI with ID 'my-secret-token' and secret 'superSecret123'
# Your code here

Hint

Use Jenkins UI to add a new credential of type 'Secret text'. Set the ID exactly to my-secret-token and the secret to superSecret123.

2

Reference the credential ID in a Jenkins pipeline variable

In your Jenkins pipeline script, create a variable called tokenId and set it to the string 'my-secret-token' to reference the credential you created.

Jenkins

# Reference the credential ID in a variable called tokenId
# Your code here

Hint

Define a variable named tokenId and assign it the string 'my-secret-token'.

3

Use the Jenkins credentials binding to access the secret

In the pipeline script, use the withCredentials block with string(credentialsId: tokenId, variable: 'SECRET_TOKEN') to access the secret stored in Jenkins credentials. Inside the block, assign the secret to a variable called token.

Jenkins

def tokenId = 'my-secret-token'

pipeline {
    agent any
    stages {
        stage('Example') {
            steps {
                // Use withCredentials to bind the secret to SECRET_TOKEN
                // Assign SECRET_TOKEN to a variable called token
                // Your code here
            }
        }
    }
}

Hint

Use withCredentials with string(credentialsId: tokenId, variable: 'SECRET_TOKEN'). Inside the block, assign env.SECRET_TOKEN to token.

4

Print confirmation message without exposing the secret

Add a print or echo statement inside the withCredentials block to display the message Secret token accessed successfully without printing the actual secret value.

Jenkins

def tokenId = 'my-secret-token'

pipeline {
    agent any
    stages {
        stage('Example') {
            steps {
                withCredentials([string(credentialsId: tokenId, variable: 'SECRET_TOKEN')]) {
                    script {
                        def token = env.SECRET_TOKEN
                        // Print confirmation message here
                        // Your code here
                    }
                }
            }
        }
    }
}

Hint

Use echo "Secret token accessed successfully" inside the withCredentials block.

Practice

1. What is the main purpose of the Jenkins Credentials plugin?

easy

A. To monitor Jenkins server performance

B. To create Jenkins jobs automatically

C. To securely store and manage secrets like passwords and tokens

D. To generate build reports

Solution

1. Step 1: Understand the role of the Credentials plugin

   The plugin is designed to keep sensitive information safe within Jenkins.

2. Step 2: Identify the correct purpose

   It stores secrets like passwords, tokens, and keys securely, preventing exposure in code or logs.

3. Final Answer:

   To securely store and manage secrets like passwords and tokens -> Option C

4. Quick Check:

   Credentials plugin = secure secret storage [OK]

Hint: Remember: Credentials plugin = safe secret storage [OK]

Common Mistakes:

• Confusing credentials with job creation
• Thinking it monitors performance
• Assuming it generates reports

2. Which syntax correctly references a stored secret using the Credentials plugin in a Jenkins pipeline script?

easy

A. withCredentials([string(credentialsId: 'my-secret', variable: 'PASSWORD')]) { ... }

B. useCredentials('my-secret') { ... }

C. credentials('my-secret') { ... }

D. getSecret('my-secret') { ... }

Solution

1. Step 1: Recall the correct pipeline syntax

   The Jenkins pipeline uses withCredentials to bind secrets to environment variables.

2. Step 2: Match the correct syntax

   The correct form is withCredentials([string(credentialsId: 'id', variable: 'VAR')]) { ... }.

3. Final Answer:

   withCredentials([string(credentialsId: 'my-secret', variable: 'PASSWORD')]) { ... } -> Option A

4. Quick Check:

   Use withCredentials + credentialsId [OK]

Hint: Use withCredentials and credentialsId to access secrets [OK]

Common Mistakes:

• Using non-existent functions like useCredentials
• Omitting the variable name binding
• Incorrect function names like getSecret

3. Given this Jenkins pipeline snippet:

pipeline {
  agent any
  stages {
    stage('Use Secret') {
      steps {
        withCredentials([string(credentialsId: 'api-key', variable: 'API_KEY')]) {
          sh 'echo $API_KEY'
        }
      }
    }
  }
}

What will be the output of the sh 'echo $API_KEY' command during the build?

medium

A. The actual secret value stored under 'api-key'

B. The literal string '$API_KEY'

C. An error saying variable not found

D. Empty output with no value

Solution

1. Step 1: Understand withCredentials behavior

   The withCredentials block injects the secret as an environment variable named API_KEY.

2. Step 2: Analyze the shell command

   The shell command echo $API_KEY prints the value of the environment variable, which is the secret.

3. Final Answer:

   The actual secret value stored under 'api-key' -> Option A

4. Quick Check:

   withCredentials injects secret = actual secret output [OK]

Hint: withCredentials sets env var; echo prints secret value [OK]

Common Mistakes:

• Expecting literal variable name output
• Thinking it causes an error
• Assuming variable is empty

4. You wrote this Jenkins pipeline snippet but get an error:

withCredentials([string(credentialsId: 'my-secret')]) {
  sh 'echo $SECRET'
}

What is the likely cause of the error?

medium

A. Using string instead of usernamePassword type

B. Missing variable name binding in withCredentials block

C. Incorrect credentialsId value

D. Echo command syntax is wrong

Solution

1. Step 1: Check withCredentials syntax

   The string step requires both credentialsId and variable keys.

2. Step 2: Identify missing part

   The snippet lacks variable: 'SECRET', so the environment variable is not set.

3. Final Answer:

   Missing variable name binding in withCredentials block -> Option B

4. Quick Check:

   Always specify variable name with credentialsId [OK]

Hint: Always bind variable name with credentialsId [OK]

Common Mistakes:

• Forgetting variable binding
• Assuming credentialsId alone works
• Blaming shell command syntax

5. You want to use a secret stored as a username and password in Jenkins Credentials plugin inside a pipeline. Which is the correct way to access both values securely?

hard

A. withCredentials([certificate(credentialsId: 'cred-id', variable: 'CERT')]) { sh 'echo $CERT' }

B. withCredentials([string(credentialsId: 'cred-id', variable: 'USER')]) { sh 'echo $USER' }

C. withCredentials([file(credentialsId: 'cred-id', variable: 'FILE')]) { sh 'cat $FILE' }

D. withCredentials([usernamePassword(credentialsId: 'cred-id', usernameVariable: 'USER', passwordVariable: 'PASS')]) { sh 'echo $USER $PASS' }

Solution

1. Step 1: Identify credential type for username and password

   Use usernamePassword type to access both username and password.

2. Step 2: Use correct variable bindings

   Bind username to USER and password to PASS variables inside withCredentials.

3. Final Answer:

   withCredentials([usernamePassword(credentialsId: 'cred-id', usernameVariable: 'USER', passwordVariable: 'PASS')]) { sh 'echo $USER $PASS' } -> Option D

4. Quick Check:

   usernamePassword + two variables = correct access [OK]

Hint: Use usernamePassword type for user and pass secrets [OK]

Common Mistakes:

• Using string type for username/password secrets
• Confusing file or certificate types
• Not binding both username and password variables