Search code examples
jenkinsjenkins-pipelinejenkins-pluginshashicorp-vault

Retrieving secrets from HashiCorp Vault in jenkins pipeline using HashiCorp Vault Plugin

I have setup a connection between my Jenkins and Vault and by using "withVault" method https://www.jenkins.io/doc/pipeline/steps/hashicorp-vault-plugin/#hashicorp-vault-plugin

I am retrieving vault secrets from Vault in my jenkins pipeline. Secret is stored in the environment variable github_token, which is then used to form URL for accessing git in the pipeline. Retrieving secrets works, the problem is, that $github_token variable contains asterisks.

I need it to contain actual value of the the token

def secrets = [
    [path: 'ddci/data/test', engineVersion: 2, secretValues: [
        [envVar: 'github_token', vaultKey: 'token']
  ]]     
]

def configuration = [vaultUrl: 'https://vault.tools.sap/',
                     vaultNamespace: 's4',
                     vaultCredentialId: 'hashicorp_vault',
                     skipSslVerification: true,
                     engineVersion: 2]

pipeline { agent any

stages{  
stage('use token to authenticate GITHub') { 
    steps {
  withVault([configuration: configuration, vaultSecrets: secrets]) {
    sh 'git_url= https://username:${github_token}@github.tools.sap/AZURE-PIPELINES-SYSDEV/decdev-ci-verification'
    git url: '$git_url', branch: 'master'
    
    }
   }
  }
 }
}

enter image description here

Solution

  • The $github_token variable doesn't contain asterisks, Jenkins displays any Vault secret using asterisks on console, to protect the real value.

    if you want to check the $github_token value, write it to a file in the workspace, doing something like this:

    echo $github_token > token.txt

    Some other problem is preventing you to access the GitHub server (Is the token correct? Is the path correct? Has the Jenkins node access to the GitHub?). Log to the Jenkins node and try to execute the same command manually.