Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-73872

Folder credential injection in kubernetes cloud from declarative pipeline

      We use the jenkins cloudbees folder plugin to give a jenkins space per software team. They also store their own credentials in their own scoped folder.  With the kubernetes plugin we would like to give each software team their own configured cloud, while using their own folder scoped credential to be used with the configured cloud

      With the Kubernetes plugin the cloud configuration is stored globally, and thus also the credential. This means that scoped software teams could possibly read/misuse each other credential ID's which is bad from security perspective.

      We programmatically tried changing the credential ID (using groovy) to a folder scoped credential, however this was not allowed as the routine assumes the credential is in the global credential store because of default context being set here
      https://github.com/jenkinsci/kubernetes-plugin/blob/4296.v20a_7e4d77cf6/src/main/java/org/csanchez/jenkins/plugins/kubernetes/KubernetesFactoryAdapter.java#L126

      And eventually being used here
      https://github.com/jenkinsci/kubernetes-plugin/blob/4296.v20a_7e4d77cf6/src/main/java/org/csanchez/jenkins/plugins/kubernetes/KubernetesFactoryAdapter.java#L285

      So it would be nice to store the cloud configuration without a credential (which is already possible), and then dynamically inject the credentialsId on the spot, which also provides the right folder context (from the job). Such a declarative pipeline would look something like this:

      pipeline {
        agent {
          kubernetes {
            cloud 'team-a-cloud'
            credentialsId 'team-a-credential-id'
            yamlFile 'KubernetesPod.yaml'
          }
        }
        // ... stages, etc
      } 

      The credentialId and context should NOT be stored in the Cloud object as these values are temporary and only applicable for this job.

       

          [JENKINS-73872] Folder credential injection in kubernetes cloud from declarative pipeline

          There are no comments yet on this issue.

            markri Marco
            markri Marco
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: