Handing Secrets in Jenkins pipeline

Question

I'm new to Jenkins world, I have a usecase where I have setup a jenkins pipeline using JenkinsFile. As part of deployment stage, we will invoke a few ansible script in the backend to get the image deployed into Kubernetes cluster running in cloud environment. The script expects few secrets in environment variable, so I like to understand which is the best option to handle secret in Jenkins, do I need them to enter into jenkins credentials and read them in jenkins environment tag like below. Or It is safe to get the value from the user using input plugin when executing the pipeline, but if I get from user then I would not able to completely automate pipeline will wait until user input the secret. Could you help in safe way to handle credentials.

pipeline{
  agent any {
    environment {
        SECRET_VALUE=credentials('SECRET_VALUE_FROM_JENKINS_CREDENTIALS')
    }
  }
}

Answer 1

It depends on your use case, Indeed both approaches as you mentioned above will work.

There shouldn't be any problem in keeping your secrets as Jenkins credentials, in my case, all my secrets are in the Hashicorp vault and my Jenkins credentials point to the vault location as an example...

      - usernamePassword:
          scope: GLOBAL
          id: serviceUser
          username: svc_admin
          password: "${secret/xyz/service_user/password}"
          description: My secret service user

The Jenkins deployment is via JCasC.