Configure credentials in within specific folders

[calumgoodchild]

What feature do you want to see added?

Please can we allow credentials to be configured within folders, e.g:

- string:
  description: "Test Cred"
  id: "example"
  scope: GLOBAL
  secret: "infra-scope-test"
  folder: "example-folder"

Rational: We want to create credentials in code that are not accessible to all folders. Currently this is a security issue and allow any credentials created to be accessed by any folder and any build.

Upstream changes

No response

[timja]

@lemeurherve / @dduportal if you could share how you do this that would be appreciated. I know you've posted it a few times before.

[lemeurherve]

Sure, see:

• General how-to: granular credentials management using configuration as code plugin  #2544 (comment)
  Linking to:
  • "How To Define Credentials at a Folder Level in Jenkins" video: https://www.youtube.com/watch?v=Zt3W47y-v3Y
  • A simple example: Folder credentials and its chicken-and-egg problem #782 (comment)
• In Jenkins Infrastructure: Multi branch pipeline is not able to connect to GitHub using JCASC #2753 (comment)

[dduportal]

We use JobDSL in our JCasC setups (see https://github.com/jenkinsci/configuration-as-code-plugin/blob/master/docs/user/seed-jobs.md?plain=1), with a Helm chart to benefit from its templating engine which generates JobDSL code.

• You can find it here: https://github.com/jenkins-infra/helm-charts/tree/main/charts/jenkins-jobs

• Real life setup with many examples of credentials per folder, using this chart: https://github.com/jenkins-infra/kubernetes-management/blob/3ac2b14630723894493b1e2ecd35c1546a903c00/config/jenkins-jobs_infra.ci.jenkins.io.yaml#L21

• The template partial file of the Helm chart which would help you to find the JobDSL precise syntax (`folderCredentialsProperty {} block) of credentials per folder/multibranch jobs: https://github.com/jenkins-infra/helm-charts/blob/main/charts/jenkins-jobs/templates/_jobDSL_credentials.tpl

  • Note: the JobDSL API viewer on our Jenkins instances came really handy to be sure we have the right syntax for our specific credentials (EC2 credentials on AWS hosted controllers, Azure credentials for Azure hosted controllers, etc.)

Hope it helps, don't hesitate to ask for more details if needed

[calumgoodchild]

Thanks very much both. I'll have a look at setting this up and comeback if I've got any questions.