Environment and Credentials

Part of the Jenkins course

Your pipeline needs to push an image to a registry, and the registry wants a password. The quickest thing that works is to paste it into the Jenkinsfile, and the Jenkinsfile lives in the repository, and now the password is in git history forever, readable by everyone with clone access and by anyone who ever gets clone access. Rotating it means finding every place it was copied to.

Jenkins has a proper answer. Secrets live in a credentials store inside Jenkins, referenced by a short ID, and the pipeline pulls them in at run time. Jenkins also masks known credential values in the console log, so an accidental echo prints asterisks rather than your token. This lesson covers the store, the two ways to pull from it, and the handful of ways people still manage to leak a secret anyway.