Currently we are building a jenkins deployment pipeline. On those build, for secret management we are using HachiCorp vault. For getting secret we using hashicorp-vault-plugin. Problem is we wants to declare all variables on pipeline scripts, like this - testing','testing_again', secret/another_test (we don't want that)
node {
// define the secrets and the env variables
// engine version can be defined on secret, job, folder or global.
// the default is engine version 2 unless otherwise specified globally.
def secrets = [
[path: 'secret/testing', engineVersion: 1, secretValues: [
[envVar: 'testing', vaultKey: 'value_one'],
[envVar: 'testing_again', vaultKey: 'value_two']]],
[path: 'secret/another_test', engineVersion: 2, secretValues: [
[vaultKey: 'another_test']]]
]
// optional configuration, if you do not provide this the next higher configuration
// (e.g. folder or global) will be used
def configuration = [vaultUrl: 'http://my-very-other-vault-url.com',
vaultCredentialId: 'my-vault-cred-id',
engineVersion: 1]
// inside this block your credentials will be available as env variables
withVault([configuration: configuration, vaultSecrets: secrets]) {
sh 'echo $testing'
sh 'echo $testing_again'
sh 'echo $another_test'
}
}
But need some things like this -
- Get all the secret as key and value
- Put on a env file before Building the project
- After build project, destroy the env file.
Is it possible by jenkins hashicorp-vault-plugin Or get those secret from vault by curl and process by shell commend (Example is great).