Getting and put all secret in an env file on Jenkins and hashicorp vault

Viewed 2286

Currently we are building a jenkins deployment pipeline. On those build, for secret management we are using HachiCorp vault. For getting secret we using hashicorp-vault-plugin. Problem is we wants to declare all variables on pipeline scripts, like this - testing','testing_again', secret/another_test (we don't want that)

node {
    // define the secrets and the env variables
    // engine version can be defined on secret, job, folder or global.
    // the default is engine version 2 unless otherwise specified globally.
    def secrets = [
        [path: 'secret/testing', engineVersion: 1, secretValues: [
            [envVar: 'testing', vaultKey: 'value_one'],
            [envVar: 'testing_again', vaultKey: 'value_two']]],
        [path: 'secret/another_test', engineVersion: 2, secretValues: [
            [vaultKey: 'another_test']]]
    ]

    // optional configuration, if you do not provide this the next higher configuration
    // (e.g. folder or global) will be used
    def configuration = [vaultUrl: 'http://my-very-other-vault-url.com',
                         vaultCredentialId: 'my-vault-cred-id',
                         engineVersion: 1]
    // inside this block your credentials will be available as env variables
    withVault([configuration: configuration, vaultSecrets: secrets]) {
        sh 'echo $testing'
        sh 'echo $testing_again'
        sh 'echo $another_test'
    }
} 

But need some things like this -

  1. Get all the secret as key and value
  2. Put on a env file before Building the project
  3. After build project, destroy the env file.

Is it possible by jenkins hashicorp-vault-plugin Or get those secret from vault by curl and process by shell commend (Example is great).

1 Answers

in vault plugin impossible to put secrets to file. only immediately put to environment variable. After storing in env you can do whatever you want :) a that you could do something like

sh 'echo $YOURVAR > .env'

Get all the secret as key and value by vault concept you should know secret name for access to it. not sure how it should be in your case

p.s if you need file credentials you could use credentials credentials-binding plugins for jenkins

Related