The following plugin provides functionality available through Pipeline-compatible steps. Read more about how to integrate steps into your Pipeline in the Steps section of the Pipeline Syntax page.

For a list of other such plugins, see the Pipeline Steps Reference page.

HashiCorp Vault Plugin

withVault: Vault Plugin

  • vaultSecrets
      Array / List of Nested Object
    • path
      The path of the secret in the vault server as described here.
      • Type: String
    • secretValues
        Array / List of Nested Object
      • vaultKey
        The vault key whose value will populate the environment variable.
        • Type: String
      • envVar (optional)
        The environment variable to set with the value of the vault key.
        If field is left empty. The value from vault key will be used for environment variable.
        • Type: String
    • engineVersion (optional)
      The vault K/V engine version. Currently supports versions 1 or 2. (Only applicable when using vaults Key/Value secrets engine. See here)
      If set to default it will use what is configured on folder or global configuration.
      • Type: int
  • configuration (optional)
      Nested Object
    • engineVersion (optional)
      The vault K/V engine version. Currently supports versions 1 or 2. (Only applicable when using vaults Key/Value secrets engine. See here)
      If set to default it will use what is configured on folder or global configuration.
      • Type: int
    • failIfNotFound (optional)
      • Type: boolean
    • prefixPath (optional)
      • Type: String
    • skipSslVerification (optional)
      • Type: boolean
    • timeout (optional)
      • Type: int
    • vaultCredential (optional)
        Nested Choice of Objects
      • $class: 'VaultAppRoleCredential'
        • scope
          Determines where this credential can be used.
          System
          This credential is only available to the object on which the credential is associated. Typically you would use system-scoped credentials for things like email auth, slave connection, etc, i.e. where the Jenkins instance itself is using the credential. Unlike the global scope, this significantly restricts where the credential can be used, thereby providing a higher degree of confidentiality to the credential.
          Global
          This credential is available to the object on which the credential is associated and all objects that are children of that object. Typically you would use global-scoped credentials for things that are needed by jobs.

          In general, a credential is defined in one place (e.g., the credentials configuration page under "Manage Jenkins") and then used in another place (e.g., when connecting to a new SSH slave). The scope allows you to say "this credential is only used by these places" by looking at the relationship between the two locations.

          • Values: SYSTEM, GLOBAL, USER
        • id
          An internal unique ID by which these credentials are identified from jobs and other configuration. Normally left blank, in which case an ID will be generated, which is fine for jobs created using visual forms. Useful to specify explicitly when using credentials from scripted configuration.
          • Type: String
        • description
          An optional description to help tell similar credentials apart.
          • Type: String
        • roleId
          • Type: String
        • secretId
          • Type: class hudson.util.Secret
        • path
          • Type: String
        • namespace (optional)
          The Vault Namespace the mount path is located. If the auth mount path is on the root namespace use "/", if namespace is empty the global namespace or credential namespace will be used if specified.

          Note: Namespaces are a feature of Vault Enterprise.

          • Type: String
      • $class: 'VaultGCPCredential'
        • scope
          Determines where this credential can be used.
          System
          This credential is only available to the object on which the credential is associated. Typically you would use system-scoped credentials for things like email auth, slave connection, etc, i.e. where the Jenkins instance itself is using the credential. Unlike the global scope, this significantly restricts where the credential can be used, thereby providing a higher degree of confidentiality to the credential.
          Global
          This credential is available to the object on which the credential is associated and all objects that are children of that object. Typically you would use global-scoped credentials for things that are needed by jobs.

          In general, a credential is defined in one place (e.g., the credentials configuration page under "Manage Jenkins") and then used in another place (e.g., when connecting to a new SSH slave). The scope allows you to say "this credential is only used by these places" by looking at the relationship between the two locations.

          • Values: SYSTEM, GLOBAL, USER
        • id
          An internal unique ID by which these credentials are identified from jobs and other configuration. Normally left blank, in which case an ID will be generated, which is fine for jobs created using visual forms. Useful to specify explicitly when using credentials from scripted configuration.
          • Type: String
        • description
          An optional description to help tell similar credentials apart.
          • Type: String
        • role
          • Type: String
        • audience
          • Type: String
        • namespace (optional)
          The Vault Namespace the mount path is located. If the auth mount path is on the root namespace use "/", if namespace is empty the global namespace or credential namespace will be used if specified.

          Note: Namespaces are a feature of Vault Enterprise.

          • Type: String
      • $class: 'VaultGithubTokenCredential'
        • scope
          Determines where this credential can be used.
          System
          This credential is only available to the object on which the credential is associated. Typically you would use system-scoped credentials for things like email auth, slave connection, etc, i.e. where the Jenkins instance itself is using the credential. Unlike the global scope, this significantly restricts where the credential can be used, thereby providing a higher degree of confidentiality to the credential.
          Global
          This credential is available to the object on which the credential is associated and all objects that are children of that object. Typically you would use global-scoped credentials for things that are needed by jobs.

          In general, a credential is defined in one place (e.g., the credentials configuration page under "Manage Jenkins") and then used in another place (e.g., when connecting to a new SSH slave). The scope allows you to say "this credential is only used by these places" by looking at the relationship between the two locations.

          • Values: SYSTEM, GLOBAL, USER
        • id
          An internal unique ID by which these credentials are identified from jobs and other configuration. Normally left blank, in which case an ID will be generated, which is fine for jobs created using visual forms. Useful to specify explicitly when using credentials from scripted configuration.
          • Type: String
        • description
          An optional description to help tell similar credentials apart.
          • Type: String
        • accessToken
          • Type: class hudson.util.Secret
        • mountPath (optional)
          • Type: String
        • namespace (optional)
          The Vault Namespace the mount path is located. If the auth mount path is on the root namespace use "/", if namespace is empty the global namespace or credential namespace will be used if specified.

          Note: Namespaces are a feature of Vault Enterprise.

          • Type: String
      • $class: 'VaultKubernetesCredential'
        • scope
          Determines where this credential can be used.
          System
          This credential is only available to the object on which the credential is associated. Typically you would use system-scoped credentials for things like email auth, slave connection, etc, i.e. where the Jenkins instance itself is using the credential. Unlike the global scope, this significantly restricts where the credential can be used, thereby providing a higher degree of confidentiality to the credential.
          Global
          This credential is available to the object on which the credential is associated and all objects that are children of that object. Typically you would use global-scoped credentials for things that are needed by jobs.

          In general, a credential is defined in one place (e.g., the credentials configuration page under "Manage Jenkins") and then used in another place (e.g., when connecting to a new SSH slave). The scope allows you to say "this credential is only used by these places" by looking at the relationship between the two locations.

          • Values: SYSTEM, GLOBAL, USER
        • id
          An internal unique ID by which these credentials are identified from jobs and other configuration. Normally left blank, in which case an ID will be generated, which is fine for jobs created using visual forms. Useful to specify explicitly when using credentials from scripted configuration.
          • Type: String
        • description
          An optional description to help tell similar credentials apart.
          • Type: String
        • role
          • Type: String
        • mountPath (optional)
          • Type: String
        • namespace (optional)
          The Vault Namespace the mount path is located. If the auth mount path is on the root namespace use "/", if namespace is empty the global namespace or credential namespace will be used if specified.

          Note: Namespaces are a feature of Vault Enterprise.

          • Type: String
      • $class: 'VaultTokenCredential'
        • scope
          Determines where this credential can be used.
          System
          This credential is only available to the object on which the credential is associated. Typically you would use system-scoped credentials for things like email auth, slave connection, etc, i.e. where the Jenkins instance itself is using the credential. Unlike the global scope, this significantly restricts where the credential can be used, thereby providing a higher degree of confidentiality to the credential.
          Global
          This credential is available to the object on which the credential is associated and all objects that are children of that object. Typically you would use global-scoped credentials for things that are needed by jobs.

          In general, a credential is defined in one place (e.g., the credentials configuration page under "Manage Jenkins") and then used in another place (e.g., when connecting to a new SSH slave). The scope allows you to say "this credential is only used by these places" by looking at the relationship between the two locations.

          • Values: SYSTEM, GLOBAL, USER
        • id
          An internal unique ID by which these credentials are identified from jobs and other configuration. Normally left blank, in which case an ID will be generated, which is fine for jobs created using visual forms. Useful to specify explicitly when using credentials from scripted configuration.
          • Type: String
        • description
          An optional description to help tell similar credentials apart.
          • Type: String
        • token
          • Type: class hudson.util.Secret
      • $class: 'VaultTokenFileCredential'
        • scope
          Determines where this credential can be used.
          System
          This credential is only available to the object on which the credential is associated. Typically you would use system-scoped credentials for things like email auth, slave connection, etc, i.e. where the Jenkins instance itself is using the credential. Unlike the global scope, this significantly restricts where the credential can be used, thereby providing a higher degree of confidentiality to the credential.
          Global
          This credential is available to the object on which the credential is associated and all objects that are children of that object. Typically you would use global-scoped credentials for things that are needed by jobs.

          In general, a credential is defined in one place (e.g., the credentials configuration page under "Manage Jenkins") and then used in another place (e.g., when connecting to a new SSH slave). The scope allows you to say "this credential is only used by these places" by looking at the relationship between the two locations.

          • Values: SYSTEM, GLOBAL, USER
        • id
          An internal unique ID by which these credentials are identified from jobs and other configuration. Normally left blank, in which case an ID will be generated, which is fine for jobs created using visual forms. Useful to specify explicitly when using credentials from scripted configuration.
          • Type: String
        • description
          An optional description to help tell similar credentials apart.
          • Type: String
        • filepath
          • Type: String
    • vaultCredentialId (optional)
      • Type: String
    • vaultNamespace (optional)
      • Type: String
    • vaultUrl (optional)
      • Type: String

wrap([$class: 'VaultBuildWrapper']): Vault Plugin

  • vaultSecrets
      Array / List of Nested Object
    • path
      The path of the secret in the vault server as described here.
      • Type: String
    • secretValues
        Array / List of Nested Object
      • vaultKey
        The vault key whose value will populate the environment variable.
        • Type: String
      • envVar (optional)
        The environment variable to set with the value of the vault key.
        If field is left empty. The value from vault key will be used for environment variable.
        • Type: String
    • engineVersion (optional)
      The vault K/V engine version. Currently supports versions 1 or 2. (Only applicable when using vaults Key/Value secrets engine. See here)
      If set to default it will use what is configured on folder or global configuration.
      • Type: int
  • configuration (optional)
      Nested Object
    • engineVersion (optional)
      The vault K/V engine version. Currently supports versions 1 or 2. (Only applicable when using vaults Key/Value secrets engine. See here)
      If set to default it will use what is configured on folder or global configuration.
      • Type: int
    • failIfNotFound (optional)
      • Type: boolean
    • prefixPath (optional)
      • Type: String
    • skipSslVerification (optional)
      • Type: boolean
    • timeout (optional)
      • Type: int
    • vaultCredential (optional)
        Nested Choice of Objects
      • $class: 'VaultAppRoleCredential'
        • scope
          Determines where this credential can be used.
          System
          This credential is only available to the object on which the credential is associated. Typically you would use system-scoped credentials for things like email auth, slave connection, etc, i.e. where the Jenkins instance itself is using the credential. Unlike the global scope, this significantly restricts where the credential can be used, thereby providing a higher degree of confidentiality to the credential.
          Global
          This credential is available to the object on which the credential is associated and all objects that are children of that object. Typically you would use global-scoped credentials for things that are needed by jobs.

          In general, a credential is defined in one place (e.g., the credentials configuration page under "Manage Jenkins") and then used in another place (e.g., when connecting to a new SSH slave). The scope allows you to say "this credential is only used by these places" by looking at the relationship between the two locations.

          • Values: SYSTEM, GLOBAL, USER
        • id
          An internal unique ID by which these credentials are identified from jobs and other configuration. Normally left blank, in which case an ID will be generated, which is fine for jobs created using visual forms. Useful to specify explicitly when using credentials from scripted configuration.
          • Type: String
        • description
          An optional description to help tell similar credentials apart.
          • Type: String
        • roleId
          • Type: String
        • secretId
          • Type: class hudson.util.Secret
        • path
          • Type: String
        • namespace (optional)
          The Vault Namespace the mount path is located. If the auth mount path is on the root namespace use "/", if namespace is empty the global namespace or credential namespace will be used if specified.

          Note: Namespaces are a feature of Vault Enterprise.

          • Type: String
      • $class: 'VaultGCPCredential'
        • scope
          Determines where this credential can be used.
          System
          This credential is only available to the object on which the credential is associated. Typically you would use system-scoped credentials for things like email auth, slave connection, etc, i.e. where the Jenkins instance itself is using the credential. Unlike the global scope, this significantly restricts where the credential can be used, thereby providing a higher degree of confidentiality to the credential.
          Global
          This credential is available to the object on which the credential is associated and all objects that are children of that object. Typically you would use global-scoped credentials for things that are needed by jobs.

          In general, a credential is defined in one place (e.g., the credentials configuration page under "Manage Jenkins") and then used in another place (e.g., when connecting to a new SSH slave). The scope allows you to say "this credential is only used by these places" by looking at the relationship between the two locations.

          • Values: SYSTEM, GLOBAL, USER
        • id
          An internal unique ID by which these credentials are identified from jobs and other configuration. Normally left blank, in which case an ID will be generated, which is fine for jobs created using visual forms. Useful to specify explicitly when using credentials from scripted configuration.
          • Type: String
        • description
          An optional description to help tell similar credentials apart.
          • Type: String
        • role
          • Type: String
        • audience
          • Type: String
        • namespace (optional)
          The Vault Namespace the mount path is located. If the auth mount path is on the root namespace use "/", if namespace is empty the global namespace or credential namespace will be used if specified.

          Note: Namespaces are a feature of Vault Enterprise.

          • Type: String
      • $class: 'VaultGithubTokenCredential'
        • scope
          Determines where this credential can be used.
          System
          This credential is only available to the object on which the credential is associated. Typically you would use system-scoped credentials for things like email auth, slave connection, etc, i.e. where the Jenkins instance itself is using the credential. Unlike the global scope, this significantly restricts where the credential can be used, thereby providing a higher degree of confidentiality to the credential.
          Global
          This credential is available to the object on which the credential is associated and all objects that are children of that object. Typically you would use global-scoped credentials for things that are needed by jobs.

          In general, a credential is defined in one place (e.g., the credentials configuration page under "Manage Jenkins") and then used in another place (e.g., when connecting to a new SSH slave). The scope allows you to say "this credential is only used by these places" by looking at the relationship between the two locations.

          • Values: SYSTEM, GLOBAL, USER
        • id
          An internal unique ID by which these credentials are identified from jobs and other configuration. Normally left blank, in which case an ID will be generated, which is fine for jobs created using visual forms. Useful to specify explicitly when using credentials from scripted configuration.
          • Type: String
        • description
          An optional description to help tell similar credentials apart.
          • Type: String
        • accessToken
          • Type: class hudson.util.Secret
        • mountPath (optional)
          • Type: String
        • namespace (optional)
          The Vault Namespace the mount path is located. If the auth mount path is on the root namespace use "/", if namespace is empty the global namespace or credential namespace will be used if specified.

          Note: Namespaces are a feature of Vault Enterprise.

          • Type: String
      • $class: 'VaultKubernetesCredential'
        • scope
          Determines where this credential can be used.
          System
          This credential is only available to the object on which the credential is associated. Typically you would use system-scoped credentials for things like email auth, slave connection, etc, i.e. where the Jenkins instance itself is using the credential. Unlike the global scope, this significantly restricts where the credential can be used, thereby providing a higher degree of confidentiality to the credential.
          Global
          This credential is available to the object on which the credential is associated and all objects that are children of that object. Typically you would use global-scoped credentials for things that are needed by jobs.

          In general, a credential is defined in one place (e.g., the credentials configuration page under "Manage Jenkins") and then used in another place (e.g., when connecting to a new SSH slave). The scope allows you to say "this credential is only used by these places" by looking at the relationship between the two locations.

          • Values: SYSTEM, GLOBAL, USER
        • id
          An internal unique ID by which these credentials are identified from jobs and other configuration. Normally left blank, in which case an ID will be generated, which is fine for jobs created using visual forms. Useful to specify explicitly when using credentials from scripted configuration.
          • Type: String
        • description
          An optional description to help tell similar credentials apart.
          • Type: String
        • role
          • Type: String
        • mountPath (optional)
          • Type: String
        • namespace (optional)
          The Vault Namespace the mount path is located. If the auth mount path is on the root namespace use "/", if namespace is empty the global namespace or credential namespace will be used if specified.

          Note: Namespaces are a feature of Vault Enterprise.

          • Type: String
      • $class: 'VaultTokenCredential'
        • scope
          Determines where this credential can be used.
          System
          This credential is only available to the object on which the credential is associated. Typically you would use system-scoped credentials for things like email auth, slave connection, etc, i.e. where the Jenkins instance itself is using the credential. Unlike the global scope, this significantly restricts where the credential can be used, thereby providing a higher degree of confidentiality to the credential.
          Global
          This credential is available to the object on which the credential is associated and all objects that are children of that object. Typically you would use global-scoped credentials for things that are needed by jobs.

          In general, a credential is defined in one place (e.g., the credentials configuration page under "Manage Jenkins") and then used in another place (e.g., when connecting to a new SSH slave). The scope allows you to say "this credential is only used by these places" by looking at the relationship between the two locations.

          • Values: SYSTEM, GLOBAL, USER
        • id
          An internal unique ID by which these credentials are identified from jobs and other configuration. Normally left blank, in which case an ID will be generated, which is fine for jobs created using visual forms. Useful to specify explicitly when using credentials from scripted configuration.
          • Type: String
        • description
          An optional description to help tell similar credentials apart.
          • Type: String
        • token
          • Type: class hudson.util.Secret
      • $class: 'VaultTokenFileCredential'
        • scope
          Determines where this credential can be used.
          System
          This credential is only available to the object on which the credential is associated. Typically you would use system-scoped credentials for things like email auth, slave connection, etc, i.e. where the Jenkins instance itself is using the credential. Unlike the global scope, this significantly restricts where the credential can be used, thereby providing a higher degree of confidentiality to the credential.
          Global
          This credential is available to the object on which the credential is associated and all objects that are children of that object. Typically you would use global-scoped credentials for things that are needed by jobs.

          In general, a credential is defined in one place (e.g., the credentials configuration page under "Manage Jenkins") and then used in another place (e.g., when connecting to a new SSH slave). The scope allows you to say "this credential is only used by these places" by looking at the relationship between the two locations.

          • Values: SYSTEM, GLOBAL, USER
        • id
          An internal unique ID by which these credentials are identified from jobs and other configuration. Normally left blank, in which case an ID will be generated, which is fine for jobs created using visual forms. Useful to specify explicitly when using credentials from scripted configuration.
          • Type: String
        • description
          An optional description to help tell similar credentials apart.
          • Type: String
        • filepath
          • Type: String
    • vaultCredentialId (optional)
      • Type: String
    • vaultNamespace (optional)
      • Type: String
    • vaultUrl (optional)
      • Type: String

Was this page helpful?

Please submit your feedback about this page through this quick form.

Alternatively, if you don't wish to complete the quick form, you can simply indicate if you found this page helpful?

    


See existing feedback here.