Credential types and storage in Jenkins - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Jenkins Credential Types

Which Jenkins credential type is best suited to store a username and password pair securely?

A Username with password

B Certificate

C SSH Username with private key

D Secret text

💡 Hint

Think about which type explicitly stores both username and password together.

The 'Username with password' credential type is designed to securely store a username and its associated password. Other types store different secrets like text, SSH keys, or certificates.

💻 Command Output

intermediate

Jenkins CLI Credential Listing Output

What is the output of the following Jenkins CLI command when listing credentials in a folder named 'projectA'?

java -jar jenkins-cli.jar -s http://jenkins.example.com/ list-credentials projectA

A Error: No credentials found in folder 'projectA'

B

[id: 'cred1', type: 'Username with password', description: 'GitHub creds']
[id: 'cred2', type: 'Secret text', description: 'API token']

C SyntaxError: Invalid command format

D [id: 'cred1', type: 'SSH Username with private key', description: 'Deploy key']

💡 Hint

Assume the folder 'projectA' contains two credentials: one username/password and one secret text.

The command lists all credentials in the specified folder. Since 'projectA' has two credentials, the output shows both with their ids, types, and descriptions.

❓ Configuration

advanced

Jenkinsfile Using Credentials Binding

Which Jenkinsfile snippet correctly uses the 'usernamePassword' credentials binding to inject username and password environment variables?

A

pipeline {
  agent any
  environment {
    CREDS = credentials('my-cred-id')
  }
  stages {
    stage('Build') {
      steps {
        echo "User: $CREDS_USR"
        echo "Pass: $CREDS_PSW"
      }
    }
  }
}

B

pipeline {
  agent any
  environment {
    USER = credentials('my-cred-id')
  }
  stages {
    stage('Build') {
      steps {
        echo "User: $USER"
      }
    }
  }
}

C

pipeline {
  agent any
  stages {
    stage('Build') {
      steps {
        withCredentials([string(credentialsId: 'my-cred-id', variable: 'TOKEN')]) {
          echo "Token: $TOKEN"
        }
      }
    }
  }
}

D

pipeline {
  agent any
  stages {
    stage('Build') {
      steps {
        withCredentials([usernamePassword(credentialsId: 'my-cred-id', usernameVariable: 'USER', passwordVariable: 'PASS')]) {
          echo "User: $USER"
          echo "Pass: $PASS"
        }
      }
    }
  }
}

💡 Hint

Look for the correct use of withCredentials and variable names for username and password.

Option D correctly uses withCredentials with usernamePassword binding and defines separate variables for username and password. Other options misuse environment or credential types.

❓ Troubleshoot

advanced

Jenkins Credential Access Error

A Jenkins pipeline fails with the error: java.lang.IllegalArgumentException: No credentials found with id 'deploy-key'. What is the most likely cause?

A The pipeline syntax for accessing credentials is incorrect and causes this error.

B The Jenkins agent does not have internet access to fetch the credential.

C The credential with id 'deploy-key' does not exist or is not accessible in the current folder or global scope.

D The Jenkins master is offline and cannot provide credentials.

💡 Hint

Consider where credentials are stored and their scope in Jenkins.

This error usually means Jenkins cannot find the credential with the given id in the current folder or global credentials store. It is a scope or existence issue, not network or syntax.

✅ Best Practice

expert

Secure Storage of API Tokens in Jenkins

Which is the most secure and recommended way to store and use API tokens in Jenkins pipelines?

A Store the API token as a 'Secret text' credential and use <code>withCredentials</code> to inject it as an environment variable during the pipeline run.

B Hardcode the API token directly in the Jenkinsfile for easy access.

C Store the API token in a plain text file on the Jenkins master and read it during the build.

D Use the 'Username with password' credential type but leave the username empty.

💡 Hint

Think about avoiding exposure of secrets and following Jenkins best practices.

Storing API tokens as 'Secret text' credentials and injecting them securely during pipeline execution prevents exposure in code or logs. Hardcoding or storing in files is insecure. Using username/password with empty username is not appropriate.

Practice

1. Which of the following is NOT a common Jenkins credential type?

easy

A. Database connection string

B. Secret text

C. SSH private key

D. Username and password

Solution

1. Step 1: Review common Jenkins credential types

   Jenkins commonly uses username/password, secret text, SSH keys, and secret files as credential types.

2. Step 2: Identify the option not listed as a credential type

   Database connection string is not a built-in Jenkins credential type; it can be stored as secret text but is not a distinct type.

3. Final Answer:

   Database connection string -> Option A

4. Quick Check:

   Credential types exclude database connection string [OK]

Hint: Remember Jenkins main credential types: user/pass, secret text, SSH keys [OK]

Common Mistakes:

• Confusing secret text with specific data types
• Assuming all data can be a credential type
• Thinking database strings are a separate credential type

2. Which syntax correctly defines a secret text credential in Jenkins pipeline script?

easy

A. credentials('my-secret-text')

B. withCredentials([string(credentialsId: 'my-secret-text', variable: 'SECRET')])

C. secretText('my-secret-text')

D. useSecret('my-secret-text')

Solution

1. Step 1: Understand Jenkins pipeline credential syntax

   Jenkins uses the withCredentials step with a list of credential bindings like string() for secret text.

2. Step 2: Match correct syntax for secret text

   The correct syntax is withCredentials([string(credentialsId: 'id', variable: 'VAR')]) to bind secret text to an environment variable.

3. Final Answer:

   withCredentials([string(credentialsId: 'my-secret-text', variable: 'SECRET')]) -> Option B

4. Quick Check:

   Use withCredentials and string binding for secret text [OK]

Hint: Use withCredentials and string() for secret text in pipelines [OK]

Common Mistakes:

• Using credentials() directly without withCredentials
• Using non-existent secretText() or useSecret() steps
• Confusing variable binding syntax

3. What will be the output of this Jenkins pipeline snippet if the secret text credential 'API_KEY' has value '12345'?

pipeline {
  agent any
  stages {
    stage('Show Secret') {
      steps {
        withCredentials([string(credentialsId: 'API_KEY', variable: 'KEY')]) {
          echo "API Key is: ${KEY}"
        }
      }
    }
  }
}

medium

A. API Key is: 12345

B. API Key is: ${KEY}

C. API Key is:

D. Error: credentials not found

Solution

1. Step 1: Understand withCredentials usage

   The withCredentials block binds the secret text with ID 'API_KEY' to the environment variable 'KEY'.

2. Step 2: Check echo statement output

   The echo command prints the value of ${KEY}, which is '12345' from the secret text credential.

3. Final Answer:

   API Key is: 12345 -> Option A

4. Quick Check:

   Secret text bound to variable prints actual value [OK]

Hint: withCredentials binds secrets to env vars, echo prints actual value [OK]

Common Mistakes:

• Expecting literal ${KEY} instead of variable substitution
• Assuming empty output if secret is set
• Confusing variable name or missing credentials

4. Identify the error in this Jenkins pipeline snippet that tries to use SSH credentials:

pipeline {
  agent any
  stages {
    stage('Use SSH') {
      steps {
        withCredentials([sshUserPrivateKey(credentialsId: 'ssh-key', keyFileVariable: 'KEYFILE')]) {
          sh 'ssh -i $KEYFILE user@host'
        }
      }
    }
  }
}

medium

A. The sh step cannot access environment variables

B. Incorrect use of keyFileVariable instead of usernameVariable

C. sshUserPrivateKey cannot be used in withCredentials

D. Missing usernameVariable in sshUserPrivateKey binding

Solution

1. Step 1: Review sshUserPrivateKey binding requirements

   sshUserPrivateKey requires both credentialsId and usernameVariable to bind the SSH username.

2. Step 2: Identify missing usernameVariable

   The snippet only uses keyFileVariable but misses usernameVariable, which is required for proper binding.

3. Final Answer:

   Missing usernameVariable in sshUserPrivateKey binding -> Option D

4. Quick Check:

   sshUserPrivateKey needs usernameVariable and keyFileVariable [OK]

Hint: sshUserPrivateKey needs usernameVariable and keyFileVariable [OK]

Common Mistakes:

• Omitting usernameVariable in sshUserPrivateKey
• Thinking keyFileVariable alone is enough
• Believing sh cannot use env variables

5. You want to securely use a secret file credential in a Jenkins pipeline to deploy a configuration file. Which is the correct way to access the secret file inside the pipeline?

hard

A. Use credentials('config-file') directly in the shell command

B. Use withCredentials([string(credentialsId: 'config-file', variable: 'CONFIG')]) and echo $CONFIG

C. Use withCredentials([file(credentialsId: 'config-file', variable: 'CONFIG')]) and refer to $CONFIG path

D. Store the file content as secret text and write it manually in the pipeline

Solution

1. Step 1: Understand secret file credential usage

   Secret files are accessed by binding them to a file path variable using file() in withCredentials.

2. Step 2: Use the file path variable in pipeline steps

   The variable (e.g., CONFIG) holds the path to the secret file, which can be used in shell commands safely.

3. Final Answer:

   Use withCredentials([file(credentialsId: 'config-file', variable: 'CONFIG')]) and refer to $CONFIG path -> Option C

4. Quick Check:

   Secret files bind to file path variables with file() [OK]

Hint: Use file() binding for secret files to get file path [OK]

Common Mistakes:

• Using string() for secret files instead of file()
• Trying to use credentials() directly in shell
• Manually writing file content instead of binding