Credentials binding in pipelines in Jenkins - Commands & Configuration

Introduction

When you run automated tasks in Jenkins pipelines, you often need passwords or keys. Credentials binding lets you safely use these secrets without showing them in logs or code.

When your pipeline needs to access a private Git repository using a username and password.

When deploying an application that requires an API key or token.

When running tests that need database credentials.

When you want to avoid hardcoding sensitive information in your pipeline scripts.

When you want Jenkins to automatically clean up secrets after the pipeline finishes.

Config File - Jenkinsfile

Jenkinsfile

pipeline {
  agent any
  environment {
    MY_SECRET = credentials('my-secret-id')
  }
  stages {
    stage('Use Secret') {
      steps {
        echo "Using secret in a safe way"
        sh 'echo Secret is $MY_SECRET'
      }
    }
  }
}

This Jenkinsfile defines a pipeline that uses the credentials function to bind a secret stored in Jenkins with the ID my-secret-id to the environment variable MY_SECRET. This variable can then be used safely in the pipeline steps without exposing the secret in the code.

Commands

This command adds a new secret credential to Jenkins using an XML file. It stores the secret securely with an ID you can reference in pipelines.

Terminal

jenkins-cli create-credentials-by-xml system::system::jenkins _ < credentials.xml

Expected Output

Created credentials with ID my-secret-id

→

system::system::jenkins - Specifies the Jenkins system scope for the credentials

This command starts the Jenkins pipeline named 'my-pipeline' which uses the bound credentials in its steps.

Terminal

jenkins-cli build my-pipeline

Expected Output

Started build #1 for job my-pipeline

This command shows the console output of the first build of 'my-pipeline' to verify the secret was used without being exposed.

Terminal

jenkins-cli console my-pipeline 1

Expected Output

[Pipeline] echo

Using secret in a safe way

[Pipeline] sh

+ echo Secret is ********

Secret is ********

[Pipeline] End of Pipeline

Key Concept

If you remember nothing else from this pattern, remember: credentials binding lets you use secrets safely in pipelines without exposing them in logs or code.

Common Mistakes

Hardcoding secrets directly in the Jenkinsfile or pipeline script.

This exposes sensitive information in the code repository and logs, risking leaks.

Store secrets in Jenkins credentials and bind them using the credentials function in the pipeline.

Referencing a credential ID that does not exist or is misspelled.

The pipeline will fail because it cannot find the secret to bind.

Double-check the credential ID in Jenkins and use the exact ID in the pipeline.

Printing the secret variable directly in pipeline logs.

This reveals the secret in the build logs, defeating the purpose of binding.

Use the secret only in commands or scripts that do not print it, or mask it in logs.

Summary

Add secrets to Jenkins using the credentials store with a unique ID.

Bind these credentials in your Jenkinsfile using the credentials function to environment variables.

Use the bound variables safely in pipeline steps without exposing secrets in logs.

Practice

1. What is the main purpose of using credentials() or withCredentials in Jenkins pipelines?

easy

A. To securely inject secrets like passwords or tokens as environment variables

B. To speed up the pipeline execution by caching credentials

C. To automatically create new user accounts in Jenkins

D. To generate random passwords for pipeline steps

Solution

1. Step 1: Understand the role of credentials binding

   Credentials binding is used to safely provide secrets to pipeline steps without exposing them in code.

2. Step 2: Identify the function of credentials() and withCredentials

   These functions inject secrets as environment variables, keeping them hidden from logs.

3. Final Answer:

   To securely inject secrets like passwords or tokens as environment variables -> Option A

4. Quick Check:

   Credentials binding = secure secret injection [OK]

Hint: Remember: credentials() hides secrets as env variables [OK]

Common Mistakes:

• Thinking credentials speed up pipelines
• Confusing credentials binding with user creation
• Assuming credentials generate passwords automatically

2. Which of the following is the correct syntax to bind a username and password credential in a Jenkins declarative pipeline?

easy

A. withSecret([userPass('myCred', 'USER', 'PASS')]) { ... }

B. credentials('myCred', 'USER', 'PASS') { ... }

C. bindCredentials('myCred', 'USER', 'PASS') { ... }

D. withCredentials([usernamePassword(credentialsId: 'myCred', usernameVariable: 'USER', passwordVariable: 'PASS')]) { ... }

Solution

1. Step 1: Recall the correct Jenkins credentials binding syntax

   The correct syntax uses withCredentials with a list containing usernamePassword specifying credential ID and variable names.

2. Step 2: Match the syntax with options

   withCredentials([usernamePassword(credentialsId: 'myCred', usernameVariable: 'USER', passwordVariable: 'PASS')]) { ... } matches the exact syntax Jenkins expects for username/password binding.

3. Final Answer:

   withCredentials([usernamePassword(credentialsId: 'myCred', usernameVariable: 'USER', passwordVariable: 'PASS')]) { ... } -> Option D

4. Quick Check:

   Correct syntax = withCredentials + usernamePassword [OK]

Hint: Look for withCredentials and usernamePassword keywords [OK]

Common Mistakes:

• Using non-existent functions like bindCredentials
• Mixing up credentials() with withCredentials syntax
• Incorrect parameter names or missing brackets

3. Given this Jenkins pipeline snippet:

withCredentials([string(credentialsId: 'token123', variable: 'API_TOKEN')]) {
  sh 'echo $API_TOKEN'
}

What will be the output in the Jenkins console log?

medium

A. The secret will be masked and replaced with '****' in the log

B. The string '$API_TOKEN' will be printed literally

C. The actual secret value stored in 'token123' will be printed

D. An error will occur because environment variables can't be used in sh

Solution

1. Step 1: Understand how withCredentials injects secrets

   It sets the secret as an environment variable for the shell command.

2. Step 2: Recognize Jenkins log masking behavior

   Jenkins automatically masks secrets in console output, replacing them with '****'.

3. Final Answer:

   The secret will be masked and replaced with '****' in the log -> Option A

4. Quick Check:

   Jenkins masks secrets in logs = masked output [OK]

Hint: Secrets never show in logs; Jenkins masks them [OK]

Common Mistakes:

• Expecting the secret to print plainly
• Thinking environment variables won't work in sh
• Confusing literal string output with variable expansion

4. You wrote this Jenkins pipeline snippet:

withCredentials([string(credentialsId: 'mySecret', variable: 'SECRET')]) {
  echo "$SECRET"
}

But the secret value is printed in the console log unmasked. What is the likely cause?

medium

A. The credentialsId 'mySecret' does not exist in Jenkins

B. Using echo instead of sh prevents masking

C. The variable name 'SECRET' is reserved and cannot be masked

D. The pipeline is missing the environment block

Solution

1. Step 1: Understand Jenkins masking scope

   Jenkins masks secrets only in shell or batch commands, not in pipeline echo steps.

2. Step 2: Identify why echo prints unmasked

   The echo step prints directly to console without masking, exposing the secret.

3. Final Answer:

   Using echo instead of sh prevents masking -> Option B

4. Quick Check:

   Masking works in sh, not pipeline echo [OK]

Hint: Use sh to mask secrets, not pipeline echo [OK]

Common Mistakes:

• Assuming all prints mask secrets
• Thinking missing credentials cause unmasked output
• Believing environment block controls masking

5. You want to securely use multiple credentials (a username/password and a secret text) in a Jenkins scripted pipeline. Which snippet correctly binds both credentials and uses them in shell commands?

hard

A. withCredentials([usernamePassword('userPassId', 'USER', 'PASS'), string('tokenId', 'TOKEN')]) {
sh 'echo $USER $PASS $TOKEN'
}

B. credentials(['userPassId', 'tokenId']) {
sh 'echo $USER'
sh 'echo $PASS'
sh 'echo $TOKEN'
}

C. withCredentials([usernamePassword(credentialsId: 'userPassId', usernameVariable: 'USER', passwordVariable: 'PASS'), string(credentialsId: 'tokenId', variable: 'TOKEN')]) {
sh 'echo $USER $PASS $TOKEN'
}

D. withCredentials([usernamePassword(credentialsId: 'userPassId', usernameVariable: 'USER', passwordVariable: 'PASS'), string('tokenId', 'TOKEN')]) {
sh 'echo $USER'
sh 'echo $PASS'
sh 'echo $TOKEN'
}

Solution

1. Step 1: Understand binding multiple credentials

   Use withCredentials with a list of credential bindings specifying IDs and variable names.

2. Step 2: Check correct syntax and usage in shell

   withCredentials([usernamePassword(credentialsId: 'userPassId', usernameVariable: 'USER', passwordVariable: 'PASS'), string(credentialsId: 'tokenId', variable: 'TOKEN')]) { sh 'echo $USER $PASS $TOKEN' } correctly binds both credentials and uses a single shell command to echo all variables.

3. Final Answer:

   withCredentials([usernamePassword(credentialsId: 'userPassId', usernameVariable: 'USER', passwordVariable: 'PASS'), string(credentialsId: 'tokenId', variable: 'TOKEN')]) { sh 'echo $USER $PASS $TOKEN' } -> Option C

4. Quick Check:

   Multiple credentials + correct syntax = withCredentials([usernamePassword(credentialsId: 'userPassId', usernameVariable: 'USER', passwordVariable: 'PASS'), string(credentialsId: 'tokenId', variable: 'TOKEN')]) { sh 'echo $USER $PASS $TOKEN' } [OK]

Hint: Use withCredentials with list and proper variable names [OK]

Common Mistakes:

• Using invalid credentials() function for multiple secrets
• Incorrect parameter order or missing keys
• Splitting shell commands unnecessarily