Credential types and storage in Jenkins - Step-by-Step Execution

Process Flow - Credential types and storage

Start: Need Credential

↓

Choose Credential Type

↓

Store Credential Securely

↓

Use Credential in Pipeline

↓

Credential Accessed

↓

End

This flow shows how Jenkins credentials are chosen, stored securely, and then used in pipelines.

Execution Sample

Jenkins

withCredentials([
  string(credentialsId: 'API_KEY', variable: 'API_KEY'),
  usernamePassword(credentialsId: 'USER_PASS', usernameVariable: 'USER', passwordVariable: 'PASS')
]) {
  // Use credentials in steps, e.g., sh 'echo $API_KEY'
}

Uses two Jenkins credentials: a secret text (ID: API_KEY) and a username-password pair (ID: USER_PASS).

Process Table

Step	Action	Credential Type	Stored Value	Usage Context
1	Create credential	Secret text	API_KEY=12345	Available in pipeline as secret text
2	Create credential	Username and password	USER=user, PASS=pass	Available in pipeline as usernamePassword
3	Use credential	Secret text	API_KEY=12345	Injected into environment variable
4	Use credential	Username and password	USER=user, PASS=pass	Injected into environment variables or steps
5	End	-	-	Credentials used securely, not exposed in logs

💡 All credentials created and used securely in Jenkins pipeline

Status Tracker

Credential	Start	After Creation	After Usage	Final
API_KEY	None	Stored as secret text	Injected in pipeline	Secured, not visible
USER_PASS	None	Stored as usernamePassword	Injected in pipeline	Secured, not visible

Key Moments - 2 Insights

Why can't we see the actual password value in the pipeline logs?

Because Jenkins masks credentials in logs to keep them secret, as shown in execution_table step 5.

What happens if we choose the wrong credential type for our secret?

The pipeline may fail or expose secrets incorrectly; choosing the right type ensures proper storage and usage (see execution_table steps 1 and 2).

Visual Quiz - 3 Questions

Look at the execution table, what type of credential is created at step 2?

A Username and password

B Secret text

C SSH key

D Certificate

💡 Hint

Check the 'Credential Type' column at step 2 in the execution_table.

At which step are credentials injected into the pipeline environment?

A Step 1

B Step 3

C Step 5

D Step 2

💡 Hint

Look for 'Injected into environment variable' in the 'Usage Context' column.

If the API_KEY was not masked, what risk would increase?

A Pipeline would run faster

B Credential would be deleted automatically

C Secret could be exposed in logs

D No risk, masking is optional

💡 Hint

Refer to key_moments about why passwords are not visible in logs.

Concept Snapshot

Jenkins credentials store secrets securely.
Types include secret text, username/password, SSH keys.
Credentials are stored encrypted and masked in logs.
Use credentials in pipelines via environment injection.
Choose correct type to avoid exposure or errors.

Full Transcript

This visual execution shows how Jenkins handles credentials. First, you create credentials by choosing a type like secret text or username/password. Jenkins stores these securely and encrypts them. When you use them in a pipeline, Jenkins injects them as environment variables but masks their values in logs to keep them secret. This prevents accidental exposure. Choosing the right credential type is important for proper usage and security. The execution table traces creation and usage steps, while the variable tracker shows how credentials change state from creation to usage. Key moments clarify why secrets are hidden and the importance of correct types. The quiz tests understanding of credential types, usage steps, and security risks.