Credentials plugin for secrets in Jenkins - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to use the Jenkins Credentials plugin to retrieve a secret text.

Jenkins

def secret = com.cloudbees.plugins.credentials.CredentialsProvider.findCredentialById('[1]', com.cloudbees.plugins.credentials.common.UsernamePasswordCredentials.class, Jenkins.instance)

Drag options to blanks, or click blank then click option'

Amy-secret-id

Bsecret-text

Ccredentials-id

Dpassword

Attempts:

3 left

💡 Hint

Common Mistakes

Using the secret value instead of the credential ID

Using an incorrect class type

The findCredentialById method requires the ID of the stored secret. Here, my-secret-id is the correct ID placeholder.

2fill in blank

medium

Complete the code to access the secret text value from the credentials object.

Jenkins

def secretText = secret.[1]()

Drag options to blanks, or click blank then click option'

AgetSecret

BgetPlainText

CgetPassword

DgetSecretText

Attempts:

3 left

💡 Hint

Common Mistakes

Using a method that does not exist

Confusing with other getter methods

The getPassword() method returns the secret text stored in the credentials object.

3fill in blank

hard

Fix the error in the code to correctly retrieve credentials in a Jenkins pipeline script.

Jenkins

withCredentials([string(credentialsId: '[1]', variable: 'SECRET')]) {
  echo "Secret is $SECRET"
}

Drag options to blanks, or click blank then click option'

Amy-secret-id

Bsecret-id

Ccredentials

Dmy-secret

Attempts:

3 left

💡 Hint

Common Mistakes

Using a wrong or partial ID

Using the variable name instead of the ID

The credentialsId must exactly match the ID of the stored secret, here my-secret-id.

4fill in blank

hard

Fill both blanks to define a credentials binding for username and password in a Jenkins pipeline.

Jenkins

withCredentials([usernamePassword(credentialsId: '[1]', usernameVariable: '[2]', passwordVariable: 'PASSWORD')]) {
  echo "User is $USERNAME"
}

Drag options to blanks, or click blank then click option'

Auser-pass-id

BUSERNAME

CUSER

Dpassword

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong variable names

Mixing up username and password variables

The credentialsId is the ID of the username-password credential. The usernameVariable must match the variable used in the script, here USERNAME.

5fill in blank

hard

Fill all three blanks to create a map of secrets filtered by a condition using Jenkins credentials in Groovy.

Jenkins

def secretsMap = credentials.findAll { cred -> cred.id.[3]('prod') }.collectEntries { cred -> [[1], [2]] }

Drag options to blanks, or click blank then click option'

Acred.id

Bcred.getPassword().getPlainText()

CstartsWith

Dcontains

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong property names

Using incorrect string method for filtering

The map uses cred.id as keys and cred.getPassword().getPlainText() as values. The filter uses contains to select credentials with 'prod' in their ID.

Practice

1. What is the main purpose of the Jenkins Credentials plugin?

easy

A. To monitor Jenkins server performance

B. To create Jenkins jobs automatically

C. To securely store and manage secrets like passwords and tokens

D. To generate build reports

Solution

1. Step 1: Understand the role of the Credentials plugin

   The plugin is designed to keep sensitive information safe within Jenkins.

2. Step 2: Identify the correct purpose

   It stores secrets like passwords, tokens, and keys securely, preventing exposure in code or logs.

3. Final Answer:

   To securely store and manage secrets like passwords and tokens -> Option C

4. Quick Check:

   Credentials plugin = secure secret storage [OK]

Hint: Remember: Credentials plugin = safe secret storage [OK]

Common Mistakes:

• Confusing credentials with job creation
• Thinking it monitors performance
• Assuming it generates reports

2. Which syntax correctly references a stored secret using the Credentials plugin in a Jenkins pipeline script?

easy

A. withCredentials([string(credentialsId: 'my-secret', variable: 'PASSWORD')]) { ... }

B. useCredentials('my-secret') { ... }

C. credentials('my-secret') { ... }

D. getSecret('my-secret') { ... }

Solution

1. Step 1: Recall the correct pipeline syntax

   The Jenkins pipeline uses withCredentials to bind secrets to environment variables.

2. Step 2: Match the correct syntax

   The correct form is withCredentials([string(credentialsId: 'id', variable: 'VAR')]) { ... }.

3. Final Answer:

   withCredentials([string(credentialsId: 'my-secret', variable: 'PASSWORD')]) { ... } -> Option A

4. Quick Check:

   Use withCredentials + credentialsId [OK]

Hint: Use withCredentials and credentialsId to access secrets [OK]

Common Mistakes:

• Using non-existent functions like useCredentials
• Omitting the variable name binding
• Incorrect function names like getSecret

3. Given this Jenkins pipeline snippet:

pipeline {
  agent any
  stages {
    stage('Use Secret') {
      steps {
        withCredentials([string(credentialsId: 'api-key', variable: 'API_KEY')]) {
          sh 'echo $API_KEY'
        }
      }
    }
  }
}

What will be the output of the sh 'echo $API_KEY' command during the build?

medium

A. The actual secret value stored under 'api-key'

B. The literal string '$API_KEY'

C. An error saying variable not found

D. Empty output with no value

Solution

1. Step 1: Understand withCredentials behavior

   The withCredentials block injects the secret as an environment variable named API_KEY.

2. Step 2: Analyze the shell command

   The shell command echo $API_KEY prints the value of the environment variable, which is the secret.

3. Final Answer:

   The actual secret value stored under 'api-key' -> Option A

4. Quick Check:

   withCredentials injects secret = actual secret output [OK]

Hint: withCredentials sets env var; echo prints secret value [OK]

Common Mistakes:

• Expecting literal variable name output
• Thinking it causes an error
• Assuming variable is empty

4. You wrote this Jenkins pipeline snippet but get an error:

withCredentials([string(credentialsId: 'my-secret')]) {
  sh 'echo $SECRET'
}

What is the likely cause of the error?

medium

A. Using string instead of usernamePassword type

B. Missing variable name binding in withCredentials block

C. Incorrect credentialsId value

D. Echo command syntax is wrong

Solution

1. Step 1: Check withCredentials syntax

   The string step requires both credentialsId and variable keys.

2. Step 2: Identify missing part

   The snippet lacks variable: 'SECRET', so the environment variable is not set.

3. Final Answer:

   Missing variable name binding in withCredentials block -> Option B

4. Quick Check:

   Always specify variable name with credentialsId [OK]

Hint: Always bind variable name with credentialsId [OK]

Common Mistakes:

• Forgetting variable binding
• Assuming credentialsId alone works
• Blaming shell command syntax

5. You want to use a secret stored as a username and password in Jenkins Credentials plugin inside a pipeline. Which is the correct way to access both values securely?

hard

A. withCredentials([certificate(credentialsId: 'cred-id', variable: 'CERT')]) { sh 'echo $CERT' }

B. withCredentials([string(credentialsId: 'cred-id', variable: 'USER')]) { sh 'echo $USER' }

C. withCredentials([file(credentialsId: 'cred-id', variable: 'FILE')]) { sh 'cat $FILE' }

D. withCredentials([usernamePassword(credentialsId: 'cred-id', usernameVariable: 'USER', passwordVariable: 'PASS')]) { sh 'echo $USER $PASS' }

Solution

1. Step 1: Identify credential type for username and password

   Use usernamePassword type to access both username and password.

2. Step 2: Use correct variable bindings

   Bind username to USER and password to PASS variables inside withCredentials.

3. Final Answer:

   withCredentials([usernamePassword(credentialsId: 'cred-id', usernameVariable: 'USER', passwordVariable: 'PASS')]) { sh 'echo $USER $PASS' } -> Option D

4. Quick Check:

   usernamePassword + two variables = correct access [OK]

Hint: Use usernamePassword type for user and pass secrets [OK]

Common Mistakes:

• Using string type for username/password secrets
• Confusing file or certificate types
• Not binding both username and password variables