Credential types and storage in Jenkins - Mini Project: Build & Apply

Credential Types and Storage in Jenkins

📖 Scenario: You are setting up Jenkins to securely store credentials needed for your build jobs. Jenkins supports different types of credentials like username/password, secret text, and SSH keys. Properly storing and using these credentials helps keep your automation safe.

🎯 Goal: Learn how to create and store different credential types in Jenkins using the Jenkinsfile syntax. You will define credentials, configure their types, and then use them in a simple Jenkins pipeline.

📋 What You'll Learn

Create a credentials dictionary with exact credential IDs and types

Add a configuration variable for the default credential ID

Write a Jenkins pipeline snippet that uses the stored credential

Print the credential ID used in the pipeline

💡 Why This Matters

🌍 Real World

Jenkins pipelines often need to access external systems like Git, Docker registries, or cloud providers. Storing credentials securely and using them in pipelines is essential to protect sensitive data.

💼 Career

Understanding Jenkins credential types and storage is a key skill for DevOps engineers and automation specialists to maintain secure CI/CD pipelines.

1

Create a dictionary of Jenkins credentials

Create a dictionary called credentials with these exact entries: 'cred1': 'usernamePassword', 'cred2': 'secretText', 'cred3': 'sshUserPrivateKey'.

Jenkins

# Your code here

Hint

Use a Python dictionary with keys as credential IDs and values as their types.

2

Add a default credential ID variable

Add a variable called default_cred and set it to the string 'cred2'.

Jenkins

credentials = {
    'cred1': 'usernamePassword',
    'cred2': 'secretText',
    'cred3': 'sshUserPrivateKey'
}
# Your code here

Hint

Just assign the string 'cred2' to a variable named default_cred.

3

Write a Jenkins pipeline snippet using the default credential

Write a variable called pipeline_snippet that contains this exact string: withCredentials([string(credentialsId: default_cred, variable: 'SECRET')]) { echo "Using credential: ${SECRET}" }.

Jenkins

credentials = {
    'cred1': 'usernamePassword',
    'cred2': 'secretText',
    'cred3': 'sshUserPrivateKey'
}
default_cred = 'cred2'
# Your code here

Hint

Use double quotes and escape inner quotes properly to match the exact string.

4

Print the Jenkins pipeline snippet

Write a print statement to display the value of pipeline_snippet.

Jenkins

credentials = {
    'cred1': 'usernamePassword',
    'cred2': 'secretText',
    'cred3': 'sshUserPrivateKey'
}
default_cred = 'cred2'
pipeline_snippet = "withCredentials([string(credentialsId: default_cred, variable: 'SECRET')]) { echo \"Using credential: ${SECRET}\" }"
# Your code here

Hint

Use print(pipeline_snippet) to show the pipeline snippet.

Practice

1. Which of the following is NOT a common Jenkins credential type?

easy

A. Database connection string

B. Secret text

C. SSH private key

D. Username and password

Solution

1. Step 1: Review common Jenkins credential types

   Jenkins commonly uses username/password, secret text, SSH keys, and secret files as credential types.

2. Step 2: Identify the option not listed as a credential type

   Database connection string is not a built-in Jenkins credential type; it can be stored as secret text but is not a distinct type.

3. Final Answer:

   Database connection string -> Option A

4. Quick Check:

   Credential types exclude database connection string [OK]

Hint: Remember Jenkins main credential types: user/pass, secret text, SSH keys [OK]

Common Mistakes:

• Confusing secret text with specific data types
• Assuming all data can be a credential type
• Thinking database strings are a separate credential type

2. Which syntax correctly defines a secret text credential in Jenkins pipeline script?

easy

A. credentials('my-secret-text')

B. withCredentials([string(credentialsId: 'my-secret-text', variable: 'SECRET')])

C. secretText('my-secret-text')

D. useSecret('my-secret-text')

Solution

1. Step 1: Understand Jenkins pipeline credential syntax

   Jenkins uses the withCredentials step with a list of credential bindings like string() for secret text.

2. Step 2: Match correct syntax for secret text

   The correct syntax is withCredentials([string(credentialsId: 'id', variable: 'VAR')]) to bind secret text to an environment variable.

3. Final Answer:

   withCredentials([string(credentialsId: 'my-secret-text', variable: 'SECRET')]) -> Option B

4. Quick Check:

   Use withCredentials and string binding for secret text [OK]

Hint: Use withCredentials and string() for secret text in pipelines [OK]

Common Mistakes:

• Using credentials() directly without withCredentials
• Using non-existent secretText() or useSecret() steps
• Confusing variable binding syntax

3. What will be the output of this Jenkins pipeline snippet if the secret text credential 'API_KEY' has value '12345'?

pipeline {
  agent any
  stages {
    stage('Show Secret') {
      steps {
        withCredentials([string(credentialsId: 'API_KEY', variable: 'KEY')]) {
          echo "API Key is: ${KEY}"
        }
      }
    }
  }
}

medium

A. API Key is: 12345

B. API Key is: ${KEY}

C. API Key is:

D. Error: credentials not found

Solution

1. Step 1: Understand withCredentials usage

   The withCredentials block binds the secret text with ID 'API_KEY' to the environment variable 'KEY'.

2. Step 2: Check echo statement output

   The echo command prints the value of ${KEY}, which is '12345' from the secret text credential.

3. Final Answer:

   API Key is: 12345 -> Option A

4. Quick Check:

   Secret text bound to variable prints actual value [OK]

Hint: withCredentials binds secrets to env vars, echo prints actual value [OK]

Common Mistakes:

• Expecting literal ${KEY} instead of variable substitution
• Assuming empty output if secret is set
• Confusing variable name or missing credentials

4. Identify the error in this Jenkins pipeline snippet that tries to use SSH credentials:

pipeline {
  agent any
  stages {
    stage('Use SSH') {
      steps {
        withCredentials([sshUserPrivateKey(credentialsId: 'ssh-key', keyFileVariable: 'KEYFILE')]) {
          sh 'ssh -i $KEYFILE user@host'
        }
      }
    }
  }
}

medium

A. The sh step cannot access environment variables

B. Incorrect use of keyFileVariable instead of usernameVariable

C. sshUserPrivateKey cannot be used in withCredentials

D. Missing usernameVariable in sshUserPrivateKey binding

Solution

1. Step 1: Review sshUserPrivateKey binding requirements

   sshUserPrivateKey requires both credentialsId and usernameVariable to bind the SSH username.

2. Step 2: Identify missing usernameVariable

   The snippet only uses keyFileVariable but misses usernameVariable, which is required for proper binding.

3. Final Answer:

   Missing usernameVariable in sshUserPrivateKey binding -> Option D

4. Quick Check:

   sshUserPrivateKey needs usernameVariable and keyFileVariable [OK]

Hint: sshUserPrivateKey needs usernameVariable and keyFileVariable [OK]

Common Mistakes:

• Omitting usernameVariable in sshUserPrivateKey
• Thinking keyFileVariable alone is enough
• Believing sh cannot use env variables

5. You want to securely use a secret file credential in a Jenkins pipeline to deploy a configuration file. Which is the correct way to access the secret file inside the pipeline?

hard

A. Use credentials('config-file') directly in the shell command

B. Use withCredentials([string(credentialsId: 'config-file', variable: 'CONFIG')]) and echo $CONFIG

C. Use withCredentials([file(credentialsId: 'config-file', variable: 'CONFIG')]) and refer to $CONFIG path

D. Store the file content as secret text and write it manually in the pipeline

Solution

1. Step 1: Understand secret file credential usage

   Secret files are accessed by binding them to a file path variable using file() in withCredentials.

2. Step 2: Use the file path variable in pipeline steps

   The variable (e.g., CONFIG) holds the path to the secret file, which can be used in shell commands safely.

3. Final Answer:

   Use withCredentials([file(credentialsId: 'config-file', variable: 'CONFIG')]) and refer to $CONFIG path -> Option C

4. Quick Check:

   Secret files bind to file path variables with file() [OK]

Hint: Use file() binding for secret files to get file path [OK]

Common Mistakes:

• Using string() for secret files instead of file()
• Trying to use credentials() directly in shell
• Manually writing file content instead of binding