WithCredentials block usage in Jenkins - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the output of this Jenkins pipeline snippet using withCredentials?

Consider this Jenkins pipeline snippet:

pipeline {
  agent any
  stages {
    stage('Print Secret') {
      steps {
        withCredentials([string(credentialsId: 'my-secret', variable: 'SECRET')]) {
          echo "Secret is: $SECRET"
        }
      }
    }
  }
}

Assuming the credential 'my-secret' contains the value 's3cr3t!', what will Jenkins print in the console?

Jenkins

pipeline {
  agent any
  stages {
    stage('Print Secret') {
      steps {
        withCredentials([string(credentialsId: 'my-secret', variable: 'SECRET')]) {
          echo "Secret is: $SECRET"
        }
      }
    }
  }
}

A Secret is: my-secret

B Secret is: s3cr3t!

C Secret is: null

D Secret is: $SECRET

💡 Hint

withCredentials injects the secret value into the environment variable.

The withCredentials block sets the environment variable SECRET to the value stored in the Jenkins credential with ID 'my-secret'. So echo prints the actual secret value.

❓ Troubleshoot

intermediate

Why does this Jenkins pipeline fail to access the secret inside withCredentials?

Look at this Jenkins pipeline snippet:

pipeline {
  agent any
  environment {
    SECRET = ''
  }
  stages {
    stage('Get Secret') {
      steps {
        withCredentials([string(credentialsId: 'my-secret', variable: 'SECRET')]) {
          echo "Secret is: $SECRET"
        }
      }
    }
  }
}

The pipeline prints: Secret is:

Why is the secret value empty?

Jenkins

pipeline {
  agent any
  environment {
    SECRET = ''
  }
  stages {
    stage('Get Secret') {
      steps {
        withCredentials([string(credentialsId: 'my-secret', variable: 'SECRET')]) {
          echo "Secret is: $SECRET"
        }
      }
    }
  }
}

A The environment variable SECRET is overridden by the empty value in the environment block before withCredentials runs.

B The credentialsId 'my-secret' does not exist in Jenkins credentials store.

C withCredentials does not support string type credentials.

D The echo command does not expand variables inside double quotes.

💡 Hint

Check how environment variables are set and overridden in Jenkins pipelines.

The environment block sets SECRET to an empty string globally. The withCredentials block cannot override this because environment variables set in the environment block take precedence. So SECRET remains empty.

❓ Configuration

advanced

How to correctly use multiple credentials in a withCredentials block?

You want to use two credentials in a Jenkins pipeline: a username/password and a secret text. Which of the following withCredentials blocks correctly sets environment variables USER, PASS, and TOKEN?

Jenkins

withCredentials([usernamePassword(credentialsId: 'user-pass', usernameVariable: 'USER', passwordVariable: 'PASS'), string(credentialsId: 'token', variable: 'TOKEN')]) {
  // steps
}

A withCredentials([usernamePassword(credentialsId: 'user-pass', usernameVariable: 'USER', passwordVariable: 'PASS'), string(credentialsId: 'token', variable: 'TOKEN')]) { /* steps */ }

B withCredentials([usernamePassword(credentialsId: 'user-pass', userVariable: 'USER', passVariable: 'PASS'), string(credentialsId: 'token', variable: 'TOKEN')]) { /* steps */ }

C withCredentials([usernamePassword(credentialsId: 'user-pass', usernameVariable: 'USER'), string(credentialsId: 'token', variable: 'TOKEN')]) { /* steps */ }

D withCredentials([usernamePassword(credentialsId: 'user-pass', usernameVariable: 'USER', passwordVariable: 'PASS'), secretText(credentialsId: 'token', variable: 'TOKEN')]) { /* steps */ }

💡 Hint

Check the exact parameter names for usernamePassword and string credential types.

Option A uses the correct parameter names: usernameVariable and passwordVariable for usernamePassword, and string for secret text. Option A uses wrong parameter names userVariable and passVariable. Option A misses passwordVariable. Option A uses secretText which is not the correct type for string credentials.

✅ Best Practice

advanced

What is the best practice for handling secrets in Jenkins pipelines using withCredentials?

Which of the following is the best practice when using withCredentials in Jenkins pipelines?

A Use environment block to set secret variables globally for all stages.

B Store secrets directly in pipeline scripts as plain text for easy access.

C Print secret values in console logs for debugging purposes.

D Use withCredentials only around the steps that need the secret, not globally in the pipeline.

💡 Hint

Think about minimizing exposure of secrets.

Using withCredentials only around the steps that need the secret limits the exposure of sensitive data. Storing secrets in plain text or printing them in logs is insecure. Setting secrets globally increases risk.

🔀 Workflow

expert

In which order are environment variables set when using withCredentials inside a pipeline with environment block?

Given this Jenkins pipeline snippet:

pipeline {
  agent any
  environment {
    TOKEN = 'env-token'
  }
  stages {
    stage('Use Credentials') {
      steps {
        withCredentials([string(credentialsId: 'secret-token', variable: 'TOKEN')]) {
          echo "Token is: $TOKEN"
        }
      }
    }
  }
}

What will be printed if the credential 'secret-token' has value 'cred-token'?

A Token is: $TOKEN

B Token is: env-token

C Token is: cred-token

D Token is: null

💡 Hint

Consider precedence of environment variables set by withCredentials vs pipeline environment block.

The withCredentials block temporarily overrides the environment variable TOKEN inside its scope with the credential value 'cred-token'. So echo prints 'cred-token'. Outside the block, TOKEN is 'env-token'.