Credentials plugin for secrets in Jenkins - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the Jenkins Credentials plugin?

The Jenkins Credentials plugin securely stores and manages secrets like passwords, tokens, and keys used in Jenkins jobs and pipelines.

beginner

Name two types of credentials you can store using the Jenkins Credentials plugin.

You can store Username/Password pairs and Secret Text (like API tokens) among other types such as SSH keys and certificates.

intermediate

How do you reference stored credentials in a Jenkins Pipeline script?

Use the withCredentials step with the credential ID inside the pipeline to access the secret securely.

beginner

Why should you avoid hardcoding secrets directly in Jenkins job configurations?

Hardcoding secrets risks exposing sensitive data in logs or job configs. Using the Credentials plugin keeps secrets encrypted and secure.

intermediate

What is the difference between 'Global' and 'Folder' scoped credentials in Jenkins?

Global credentials are available to all jobs, while Folder scoped credentials are only accessible to jobs inside that folder, improving security by limiting access.

Which Jenkins plugin is used to securely store secrets like passwords and tokens?

A Docker plugin

B Credentials plugin

C Pipeline plugin

D Git plugin

The Credentials plugin is designed to securely store and manage secrets in Jenkins.

How do you access a stored secret in a Jenkins Pipeline script?

A Using the 'env.SECRET' environment variable automatically

B By hardcoding the secret in the script

C By storing the secret in a text file

D Using the withCredentials step with the credential ID

The withCredentials step securely fetches the secret by its ID in pipeline scripts.

What type of credential can you NOT store with the Jenkins Credentials plugin?

A Docker images

B Secret text like API tokens

C SSH private keys

D Username and password

Docker images are not credentials; the plugin stores secrets like passwords and keys.

Why is it better to use the Credentials plugin instead of hardcoding secrets?

A It makes the job run faster

B It automatically updates secrets

C It encrypts secrets and limits exposure

D It stores secrets in plain text

The plugin encrypts secrets and keeps them secure, avoiding exposure in logs or configs.

What does 'Folder scoped' credentials mean in Jenkins?

A Credentials available only to jobs in that folder

B Credentials available to all Jenkins jobs

C Credentials stored outside Jenkins

D Credentials that expire after one use

Folder scoped credentials restrict access to jobs inside that folder, improving security.

Explain how the Jenkins Credentials plugin helps keep secrets safe in your CI/CD pipelines.

Think about how secrets are stored and accessed without exposing them.

Describe the steps to use a stored secret in a Jenkins Pipeline script.

Focus on how the pipeline accesses the secret securely.

Practice

1. What is the main purpose of the Jenkins Credentials plugin?

easy

A. To monitor Jenkins server performance

B. To create Jenkins jobs automatically

C. To securely store and manage secrets like passwords and tokens

D. To generate build reports

Solution

1. Step 1: Understand the role of the Credentials plugin

   The plugin is designed to keep sensitive information safe within Jenkins.

2. Step 2: Identify the correct purpose

   It stores secrets like passwords, tokens, and keys securely, preventing exposure in code or logs.

3. Final Answer:

   To securely store and manage secrets like passwords and tokens -> Option C

4. Quick Check:

   Credentials plugin = secure secret storage [OK]

Hint: Remember: Credentials plugin = safe secret storage [OK]

Common Mistakes:

• Confusing credentials with job creation
• Thinking it monitors performance
• Assuming it generates reports

2. Which syntax correctly references a stored secret using the Credentials plugin in a Jenkins pipeline script?

easy

A. withCredentials([string(credentialsId: 'my-secret', variable: 'PASSWORD')]) { ... }

B. useCredentials('my-secret') { ... }

C. credentials('my-secret') { ... }

D. getSecret('my-secret') { ... }

Solution

1. Step 1: Recall the correct pipeline syntax

   The Jenkins pipeline uses withCredentials to bind secrets to environment variables.

2. Step 2: Match the correct syntax

   The correct form is withCredentials([string(credentialsId: 'id', variable: 'VAR')]) { ... }.

3. Final Answer:

   withCredentials([string(credentialsId: 'my-secret', variable: 'PASSWORD')]) { ... } -> Option A

4. Quick Check:

   Use withCredentials + credentialsId [OK]

Hint: Use withCredentials and credentialsId to access secrets [OK]

Common Mistakes:

• Using non-existent functions like useCredentials
• Omitting the variable name binding
• Incorrect function names like getSecret

3. Given this Jenkins pipeline snippet:

pipeline {
  agent any
  stages {
    stage('Use Secret') {
      steps {
        withCredentials([string(credentialsId: 'api-key', variable: 'API_KEY')]) {
          sh 'echo $API_KEY'
        }
      }
    }
  }
}

What will be the output of the sh 'echo $API_KEY' command during the build?

medium

A. The actual secret value stored under 'api-key'

B. The literal string '$API_KEY'

C. An error saying variable not found

D. Empty output with no value

Solution

1. Step 1: Understand withCredentials behavior

   The withCredentials block injects the secret as an environment variable named API_KEY.

2. Step 2: Analyze the shell command

   The shell command echo $API_KEY prints the value of the environment variable, which is the secret.

3. Final Answer:

   The actual secret value stored under 'api-key' -> Option A

4. Quick Check:

   withCredentials injects secret = actual secret output [OK]

Hint: withCredentials sets env var; echo prints secret value [OK]

Common Mistakes:

• Expecting literal variable name output
• Thinking it causes an error
• Assuming variable is empty

4. You wrote this Jenkins pipeline snippet but get an error:

withCredentials([string(credentialsId: 'my-secret')]) {
  sh 'echo $SECRET'
}

What is the likely cause of the error?

medium

A. Using string instead of usernamePassword type

B. Missing variable name binding in withCredentials block

C. Incorrect credentialsId value

D. Echo command syntax is wrong

Solution

1. Step 1: Check withCredentials syntax

   The string step requires both credentialsId and variable keys.

2. Step 2: Identify missing part

   The snippet lacks variable: 'SECRET', so the environment variable is not set.

3. Final Answer:

   Missing variable name binding in withCredentials block -> Option B

4. Quick Check:

   Always specify variable name with credentialsId [OK]

Hint: Always bind variable name with credentialsId [OK]

Common Mistakes:

• Forgetting variable binding
• Assuming credentialsId alone works
• Blaming shell command syntax

5. You want to use a secret stored as a username and password in Jenkins Credentials plugin inside a pipeline. Which is the correct way to access both values securely?

hard

A. withCredentials([certificate(credentialsId: 'cred-id', variable: 'CERT')]) { sh 'echo $CERT' }

B. withCredentials([string(credentialsId: 'cred-id', variable: 'USER')]) { sh 'echo $USER' }

C. withCredentials([file(credentialsId: 'cred-id', variable: 'FILE')]) { sh 'cat $FILE' }

D. withCredentials([usernamePassword(credentialsId: 'cred-id', usernameVariable: 'USER', passwordVariable: 'PASS')]) { sh 'echo $USER $PASS' }

Solution

1. Step 1: Identify credential type for username and password

   Use usernamePassword type to access both username and password.

2. Step 2: Use correct variable bindings

   Bind username to USER and password to PASS variables inside withCredentials.

3. Final Answer:

   withCredentials([usernamePassword(credentialsId: 'cred-id', usernameVariable: 'USER', passwordVariable: 'PASS')]) { sh 'echo $USER $PASS' } -> Option D

4. Quick Check:

   usernamePassword + two variables = correct access [OK]

Hint: Use usernamePassword type for user and pass secrets [OK]

Common Mistakes:

• Using string type for username/password secrets
• Confusing file or certificate types
• Not binding both username and password variables