Why Environment variables access in Jenkins? - Purpose & Use Cases

The Big Idea

What if changing a password didn't mean hunting through dozens of scripts?

The Scenario

Imagine you have a Jenkins pipeline that needs to connect to different servers and databases. You write the server addresses and passwords directly inside your scripts every time.

The Problem

This manual way is risky and slow. If you change a password, you must update every script. It's easy to make mistakes, and sensitive data can leak if scripts are shared.

The Solution

Using environment variables in Jenkins lets you store these details safely outside your scripts. Your pipeline can access them anytime without hardcoding, making updates simple and secure.

Before vs After

✗ Before

sh 'ssh user@192.168.1.10'
sh 'export DB_PASS=secret123'
sh 'connect-db $DB_PASS'

✓ After

sh 'ssh user@${SERVER_IP}'
sh 'connect-db $DB_PASS'
// SERVER_IP and DB_PASS are environment variables set in Jenkins

What It Enables

You can manage sensitive data and configuration easily, making your pipelines safer, cleaner, and easier to maintain.

Real Life Example

A company uses environment variables to store API keys and database passwords in Jenkins. When keys rotate, they update only one place, and all pipelines use the new keys automatically.

Key Takeaways

Hardcoding secrets in scripts is risky and error-prone.

Environment variables keep sensitive data safe and separate from code.

They make updating and managing configurations simple and secure.

Practice

1. In a Jenkins Pipeline script, how do you access an environment variable named BUILD_NUMBER?

easy

A. Using BUILD_NUMBER directly without prefix

B. Using env.BUILD_NUMBER

C. Using getEnv('BUILD_NUMBER')

D. Using $BUILD_NUMBER inside the script block

Solution

1. Step 1: Understand Jenkins environment variable access

   Jenkins Pipeline exposes environment variables via the env object.

2. Step 2: Access the variable using the correct syntax

   You access BUILD_NUMBER as env.BUILD_NUMBER in the script.

3. Final Answer:

   Using env.BUILD_NUMBER -> Option B

4. Quick Check:

   env.VARIABLE_NAME = correct access [OK]

Hint: Always prefix environment variables with env. in Jenkins [OK]

Common Mistakes:

• Trying to use variable name without env prefix
• Using shell-style $VARIABLE inside Groovy script
• Calling non-existent getEnv() method

2. Which of the following is the correct syntax to print the environment variable JOB_NAME in a Jenkins Pipeline script block?

easy

A. println("JOB_NAME")

B. echo $JOB_NAME

C. println(env.JOB_NAME)

D. print(JOB_NAME)

Solution

1. Step 1: Identify the correct way to print env variables in Groovy script

   In Jenkins Pipeline Groovy scripts, use println(env.VARIABLE) to print environment variables.

2. Step 2: Check each option

   println("JOB_NAME") prints the string "JOB_NAME" literally. echo $JOB_NAME uses shell syntax, invalid in Groovy. print(JOB_NAME) attempts to print JOB_NAME directly, but it's not available in Groovy scope without env prefix.

3. Final Answer:

   println(env.JOB_NAME) -> Option C

4. Quick Check:

   Use println(env.VARIABLE) to print env vars in script [OK]

Hint: Use println(env.VARIABLE) inside script blocks [OK]

Common Mistakes:

• Using shell syntax like $VARIABLE inside Groovy
• Printing variable name as string instead of value
• Trying to access variables without env. prefix

3. Given this Jenkins Pipeline snippet:

pipeline {
  agent any
  stages {
    stage('Print Env') {
      steps {
        script {
          echo "Branch is: ${env.BRANCH_NAME}"
        }
      }
    }
  }
}

What will be the output if the environment variable BRANCH_NAME is set to feature-123?

medium

A. Branch is: feature-123

B. Branch is: ${env.BRANCH_NAME}

C. Branch is: BRANCH_NAME

D. Error: BRANCH_NAME not found

Solution

1. Step 1: Understand string interpolation in Jenkins Pipeline

   Using double quotes with ${env.BRANCH_NAME} interpolates the variable value.

2. Step 2: Substitute the environment variable value

   Since BRANCH_NAME is set to "feature-123", the output will be "Branch is: feature-123".

3. Final Answer:

   Branch is: feature-123 -> Option A

4. Quick Check:

   Double quotes + ${env.VAR} = variable value [OK]

Hint: Use double quotes and ${env.VAR} for variable interpolation [OK]

Common Mistakes:

• Using single quotes which prevent interpolation
• Printing variable name literally without ${}
• Assuming env variables are undefined

4. You wrote this Jenkins Pipeline snippet:

pipeline {
  agent any
  environment {
    MY_VAR = 'hello'
  }
  stages {
    stage('Test') {
      steps {
        script {
          echo env.MY_VAR
        }
      }
    }
  }
}

But the output is empty. What is the likely cause?

medium

A. The environment block syntax is incorrect; use MY_VAR='hello' with quotes and no spaces around =

B. Environment variables must be accessed as env['MY_VAR'] not env.MY_VAR

C. The environment variable was not set correctly; use MY_VAR='hello' without spaces

D. You cannot access environment variables inside script blocks

Solution

1. Step 1: Check environment block syntax

   In Jenkins Pipeline, environment variables must be assigned with no spaces around = and values in quotes, like MY_VAR='hello'.

2. Step 2: Identify the syntax error in the snippet

   The snippet uses MY_VAR = 'hello' with spaces around = which is invalid and causes the variable not to be set.

3. Final Answer:

   The environment block syntax is incorrect; use MY_VAR='hello' with quotes and no spaces around = -> Option A

4. Quick Check:

   Use no spaces around = in environment block [OK]

Hint: No spaces around = in environment block assignments [OK]

Common Mistakes:

• Adding spaces around = in environment variable assignment
• Trying to access env vars incorrectly
• Assuming script block can't access env vars

5. You want to pass a secret API key stored as an environment variable API_KEY to a shell command in Jenkins Pipeline. Which is the best way to do this securely?

hard

A. Use sh "curl -H 'Authorization: Bearer $API_KEY' https://api.example.com"

B. Use sh(script: "curl -H 'Authorization: Bearer ${env.API_KEY}' https://api.example.com")

C. Use sh(script: "curl -H 'Authorization: Bearer $API_KEY' https://api.example.com", environment: [API_KEY: env.API_KEY])

D. Use Jenkins credentials binding plugin to inject API_KEY and access it as env.API_KEY inside sh

Solution

1. Step 1: Understand secure handling of secrets in Jenkins

   Secrets like API keys should be stored in Jenkins credentials and injected securely, not hardcoded or exposed in logs.

2. Step 2: Use credentials binding plugin

   This plugin injects secrets as environment variables during the build, accessible as env.API_KEY inside sh without exposing them in logs.

3. Final Answer:

   Use Jenkins credentials binding plugin to inject API_KEY and access it as env.API_KEY inside sh -> Option D

4. Quick Check:

   Use credentials plugin for secrets, not plain env vars [OK]

Hint: Use Jenkins credentials plugin for secrets, not plain env vars [OK]

Common Mistakes:

• Passing secrets directly in shell commands risking exposure
• Using string interpolation exposing secrets in logs
• Not using Jenkins credentials plugin for sensitive data