Credential types and storage in Jenkins - Step-by-Step Execution

Process Flow - Credential types and storage

Start: Need Credential

↓

Choose Credential Type

↓

Store Credential Securely

↓

Use Credential in Pipeline

↓

Credential Accessed

↓

End

This flow shows how Jenkins credentials are chosen, stored securely, and then used in pipelines.

Execution Sample

Jenkins

withCredentials([
  string(credentialsId: 'API_KEY', variable: 'API_KEY'),
  usernamePassword(credentialsId: 'USER_PASS', usernameVariable: 'USER', passwordVariable: 'PASS')
]) {
  // Use credentials in steps, e.g., sh 'echo $API_KEY'
}

Uses two Jenkins credentials: a secret text (ID: API_KEY) and a username-password pair (ID: USER_PASS).

Process Table

Step	Action	Credential Type	Stored Value	Usage Context
1	Create credential	Secret text	API_KEY=12345	Available in pipeline as secret text
2	Create credential	Username and password	USER=user, PASS=pass	Available in pipeline as usernamePassword
3	Use credential	Secret text	API_KEY=12345	Injected into environment variable
4	Use credential	Username and password	USER=user, PASS=pass	Injected into environment variables or steps
5	End	-	-	Credentials used securely, not exposed in logs

💡 All credentials created and used securely in Jenkins pipeline

Status Tracker

Credential	Start	After Creation	After Usage	Final
API_KEY	None	Stored as secret text	Injected in pipeline	Secured, not visible
USER_PASS	None	Stored as usernamePassword	Injected in pipeline	Secured, not visible

Key Moments - 2 Insights

Why can't we see the actual password value in the pipeline logs?

Because Jenkins masks credentials in logs to keep them secret, as shown in execution_table step 5.

What happens if we choose the wrong credential type for our secret?

The pipeline may fail or expose secrets incorrectly; choosing the right type ensures proper storage and usage (see execution_table steps 1 and 2).

Visual Quiz - 3 Questions

Look at the execution table, what type of credential is created at step 2?

A Username and password

B Secret text

C SSH key

D Certificate

💡 Hint

Check the 'Credential Type' column at step 2 in the execution_table.

At which step are credentials injected into the pipeline environment?

A Step 1

B Step 3

C Step 5

D Step 2

💡 Hint

Look for 'Injected into environment variable' in the 'Usage Context' column.

If the API_KEY was not masked, what risk would increase?

A Pipeline would run faster

B Credential would be deleted automatically

C Secret could be exposed in logs

D No risk, masking is optional

💡 Hint

Refer to key_moments about why passwords are not visible in logs.

Concept Snapshot

Jenkins credentials store secrets securely.
Types include secret text, username/password, SSH keys.
Credentials are stored encrypted and masked in logs.
Use credentials in pipelines via environment injection.
Choose correct type to avoid exposure or errors.

Full Transcript

This visual execution shows how Jenkins handles credentials. First, you create credentials by choosing a type like secret text or username/password. Jenkins stores these securely and encrypts them. When you use them in a pipeline, Jenkins injects them as environment variables but masks their values in logs to keep them secret. This prevents accidental exposure. Choosing the right credential type is important for proper usage and security. The execution table traces creation and usage steps, while the variable tracker shows how credentials change state from creation to usage. Key moments clarify why secrets are hidden and the importance of correct types. The quiz tests understanding of credential types, usage steps, and security risks.

Practice

1. Which of the following is NOT a common Jenkins credential type?

easy

A. Database connection string

B. Secret text

C. SSH private key

D. Username and password

Solution

1. Step 1: Review common Jenkins credential types

   Jenkins commonly uses username/password, secret text, SSH keys, and secret files as credential types.

2. Step 2: Identify the option not listed as a credential type

   Database connection string is not a built-in Jenkins credential type; it can be stored as secret text but is not a distinct type.

3. Final Answer:

   Database connection string -> Option A

4. Quick Check:

   Credential types exclude database connection string [OK]

Hint: Remember Jenkins main credential types: user/pass, secret text, SSH keys [OK]

Common Mistakes:

• Confusing secret text with specific data types
• Assuming all data can be a credential type
• Thinking database strings are a separate credential type

2. Which syntax correctly defines a secret text credential in Jenkins pipeline script?

easy

A. credentials('my-secret-text')

B. withCredentials([string(credentialsId: 'my-secret-text', variable: 'SECRET')])

C. secretText('my-secret-text')

D. useSecret('my-secret-text')

Solution

1. Step 1: Understand Jenkins pipeline credential syntax

   Jenkins uses the withCredentials step with a list of credential bindings like string() for secret text.

2. Step 2: Match correct syntax for secret text

   The correct syntax is withCredentials([string(credentialsId: 'id', variable: 'VAR')]) to bind secret text to an environment variable.

3. Final Answer:

   withCredentials([string(credentialsId: 'my-secret-text', variable: 'SECRET')]) -> Option B

4. Quick Check:

   Use withCredentials and string binding for secret text [OK]

Hint: Use withCredentials and string() for secret text in pipelines [OK]

Common Mistakes:

• Using credentials() directly without withCredentials
• Using non-existent secretText() or useSecret() steps
• Confusing variable binding syntax

3. What will be the output of this Jenkins pipeline snippet if the secret text credential 'API_KEY' has value '12345'?

pipeline {
  agent any
  stages {
    stage('Show Secret') {
      steps {
        withCredentials([string(credentialsId: 'API_KEY', variable: 'KEY')]) {
          echo "API Key is: ${KEY}"
        }
      }
    }
  }
}

medium

A. API Key is: 12345

B. API Key is: ${KEY}

C. API Key is:

D. Error: credentials not found

Solution

1. Step 1: Understand withCredentials usage

   The withCredentials block binds the secret text with ID 'API_KEY' to the environment variable 'KEY'.

2. Step 2: Check echo statement output

   The echo command prints the value of ${KEY}, which is '12345' from the secret text credential.

3. Final Answer:

   API Key is: 12345 -> Option A

4. Quick Check:

   Secret text bound to variable prints actual value [OK]

Hint: withCredentials binds secrets to env vars, echo prints actual value [OK]

Common Mistakes:

• Expecting literal ${KEY} instead of variable substitution
• Assuming empty output if secret is set
• Confusing variable name or missing credentials

4. Identify the error in this Jenkins pipeline snippet that tries to use SSH credentials:

pipeline {
  agent any
  stages {
    stage('Use SSH') {
      steps {
        withCredentials([sshUserPrivateKey(credentialsId: 'ssh-key', keyFileVariable: 'KEYFILE')]) {
          sh 'ssh -i $KEYFILE user@host'
        }
      }
    }
  }
}

medium

A. The sh step cannot access environment variables

B. Incorrect use of keyFileVariable instead of usernameVariable

C. sshUserPrivateKey cannot be used in withCredentials

D. Missing usernameVariable in sshUserPrivateKey binding

Solution

1. Step 1: Review sshUserPrivateKey binding requirements

   sshUserPrivateKey requires both credentialsId and usernameVariable to bind the SSH username.

2. Step 2: Identify missing usernameVariable

   The snippet only uses keyFileVariable but misses usernameVariable, which is required for proper binding.

3. Final Answer:

   Missing usernameVariable in sshUserPrivateKey binding -> Option D

4. Quick Check:

   sshUserPrivateKey needs usernameVariable and keyFileVariable [OK]

Hint: sshUserPrivateKey needs usernameVariable and keyFileVariable [OK]

Common Mistakes:

• Omitting usernameVariable in sshUserPrivateKey
• Thinking keyFileVariable alone is enough
• Believing sh cannot use env variables

5. You want to securely use a secret file credential in a Jenkins pipeline to deploy a configuration file. Which is the correct way to access the secret file inside the pipeline?

hard

A. Use credentials('config-file') directly in the shell command

B. Use withCredentials([string(credentialsId: 'config-file', variable: 'CONFIG')]) and echo $CONFIG

C. Use withCredentials([file(credentialsId: 'config-file', variable: 'CONFIG')]) and refer to $CONFIG path

D. Store the file content as secret text and write it manually in the pipeline

Solution

1. Step 1: Understand secret file credential usage

   Secret files are accessed by binding them to a file path variable using file() in withCredentials.

2. Step 2: Use the file path variable in pipeline steps

   The variable (e.g., CONFIG) holds the path to the secret file, which can be used in shell commands safely.

3. Final Answer:

   Use withCredentials([file(credentialsId: 'config-file', variable: 'CONFIG')]) and refer to $CONFIG path -> Option C

4. Quick Check:

   Secret files bind to file path variables with file() [OK]

Hint: Use file() binding for secret files to get file path [OK]

Common Mistakes:

• Using string() for secret files instead of file()
• Trying to use credentials() directly in shell
• Manually writing file content instead of binding