Consider this Jenkins pipeline snippet:
pipeline {
agent any
stages {
stage('Print Secret') {
steps {
withCredentials([string(credentialsId: 'my-secret', variable: 'SECRET')]) {
echo "Secret is: $SECRET"
}
}
}
}
}Assuming the credential 'my-secret' contains the value 's3cr3t!', what will Jenkins print in the console?
pipeline {
agent any
stages {
stage('Print Secret') {
steps {
withCredentials([string(credentialsId: 'my-secret', variable: 'SECRET')]) {
echo "Secret is: $SECRET"
}
}
}
}
}withCredentials injects the secret value into the environment variable.
The withCredentials block sets the environment variable SECRET to the value stored in the Jenkins credential with ID 'my-secret'. So echo prints the actual secret value.
Look at this Jenkins pipeline snippet:
pipeline {
agent any
environment {
SECRET = ''
}
stages {
stage('Get Secret') {
steps {
withCredentials([string(credentialsId: 'my-secret', variable: 'SECRET')]) {
echo "Secret is: $SECRET"
}
}
}
}
}The pipeline prints: Secret is:
Why is the secret value empty?
pipeline {
agent any
environment {
SECRET = ''
}
stages {
stage('Get Secret') {
steps {
withCredentials([string(credentialsId: 'my-secret', variable: 'SECRET')]) {
echo "Secret is: $SECRET"
}
}
}
}
}Check how environment variables are set and overridden in Jenkins pipelines.
The environment block sets SECRET to an empty string globally. The withCredentials block cannot override this because environment variables set in the environment block take precedence. So SECRET remains empty.
You want to use two credentials in a Jenkins pipeline: a username/password and a secret text. Which of the following withCredentials blocks correctly sets environment variables USER, PASS, and TOKEN?
withCredentials([usernamePassword(credentialsId: 'user-pass', usernameVariable: 'USER', passwordVariable: 'PASS'), string(credentialsId: 'token', variable: 'TOKEN')]) { // steps }
Check the exact parameter names for usernamePassword and string credential types.
Option A uses the correct parameter names: usernameVariable and passwordVariable for usernamePassword, and string for secret text. Option A uses wrong parameter names userVariable and passVariable. Option A misses passwordVariable. Option A uses secretText which is not the correct type for string credentials.
Which of the following is the best practice when using withCredentials in Jenkins pipelines?
Think about minimizing exposure of secrets.
Using withCredentials only around the steps that need the secret limits the exposure of sensitive data. Storing secrets in plain text or printing them in logs is insecure. Setting secrets globally increases risk.
Given this Jenkins pipeline snippet:
pipeline {
agent any
environment {
TOKEN = 'env-token'
}
stages {
stage('Use Credentials') {
steps {
withCredentials([string(credentialsId: 'secret-token', variable: 'TOKEN')]) {
echo "Token is: $TOKEN"
}
}
}
}
}What will be printed if the credential 'secret-token' has value 'cred-token'?
Consider precedence of environment variables set by withCredentials vs pipeline environment block.
The withCredentials block temporarily overrides the environment variable TOKEN inside its scope with the credential value 'cred-token'. So echo prints 'cred-token'. Outside the block, TOKEN is 'env-token'.