Portainer Kubernetes environment numeric ID.

Helm release name (DNS-1123 label, max 53).

Chart name within the repository (e.g. nginx).

Helm chart repository URL. Schemes: https://, http://, or oci:// (e.g. https://charts.example/helm, oci://registry.example/charts, https://gitlab.example/api/v4/projects/{id}/packages/helm/stable).

Portainer fetches the chart (HTTP index or OCI). This step does not send registry credentials — configure private OCI access in Portainer (registries / namespace access). The host must be reachable from Portainer, not only from Jenkins.

Do not put credentials in the URL (https://user:token@… / oci://user:token@… is rejected).

When checked, pass atomic: true to Portainer Helm install (rollback on failure when supported).

On by default. Creates the Namespace field via Portainer if it is missing, before install or upgrade. Existing namespaces are left unchanged. Requires cluster permission to create namespaces. Uncheck or set ensureNamespace: false to skip. Skipped when Validate only is checked.

When checked, uninstall the release (if present) then install.

Destructive — prefer the default upgrade path (re-POST install) unless you need a clean reinstall.

Kubernetes namespace for the release. Default: default.

Inherit from System: This setting is made in the System tab of Manage Jenkins.

Manual: set Portainer URL and Secret text Access token on this step.

Secret text credential holding the Portainer Access token.

Portainer API base URL (e.g. https://portainer.example:9443).

When checked, run connection resolve, Kubernetes preflight, and Values source checks (Manual YAML soft-parse; Repository URL/credentials/fetch), then log what would be installed — without Helm list, install, uninstall, or ensure-namespace. Build succeeds when checks pass.

Inline Helm values YAML when Values source is Manual YAML. Build logs record length and a short hash only.

Path to the values file relative to the repository root. Default values.yaml.

Optional Username/Password or Secret text for private Git repositories used to fetch the values file. Credentials are passed via GIT_ASKPASS on the agent (not embedded in the clone URL).

Git reference for the values repository. Default: refs/heads/main.

Examples:

• refs/heads/main
• refs/tags/v1.2.0
• refs/heads/${BRANCH_NAME}

Jenkins maps heads/tags to a short name for shallow clone on the agent.

In Repository mode: Git repository URL hosting the values file (not the chart repo).

Do not put credentials in the URL (no user:pass@host). Use Git credentials for private repos.

Example:

https://gitlab.example/group/helm-values.git

No source (default): omit values — chart defaults only.

Repository: Jenkins shallow-clones the Git repo and reads the values file, then sends string values to Portainer (no Git values API).

Manual YAML: paste values content; required when this mode is selected. Logs length and a short hash only.

When enabled, debug-level logs for HTTP requests will be duplicated in the build console.

Optional chart version. Empty uses the repository default / latest as resolved by Portainer.

Maximum seconds to wait after deploy until Kubernetes workloads are Ready (default 300). Always on — there is no opt-out flag.

On timeout the build fails and may include a short pods hint. Secrets and values are never written to the log.

Portainer Kubernetes environment numeric ID.

Optional Portainer Kubernetes stack name (lowercase alphanumeric, _ or -). Used only for Portainer bookkeeping and upsert-by-name; Kubernetes object names come from the manifest.

When empty, the create body omits StackName.

Optional Username/Password or Secret text for private Git repositories.

Path to the manifest YAML inside the repository (relative; default manifest.yaml).

Inherit from System: This setting is made in the System tab of Manage Jenkins.

Manual: set Portainer URL and Secret text Access token on this step.

Secret text credential holding the Portainer Access token.

Portainer API base URL (e.g. https://portainer.example:9443).

Git reference Portainer uses when cloning the manifest repository. Default: refs/heads/main.

Examples:

• refs/heads/main
• refs/tags/v1.2.0
• refs/heads/${BRANCH_NAME}

Git repository URL (https://gitlab.example/…). No userinfo in the URL — use Git credentials.

Repository: Portainer clones Git and applies the manifest file.

Manual YAML: paste manifest content; updates use Portainer file-content API.

When checked, run connection resolve, Kubernetes preflight, and Manual YAML checks, then log what would be applied — without create, stack update, or ensure-namespace.

Build succeeds when checks pass.

When enabled, debug-level logs for HTTP requests will be duplicated in the build console.

Maximum seconds to wait after apply until workloads are Ready (default 300). Always on.

Manual YAML: polls Deployment / StatefulSet / DaemonSet / Job from the YAML. ConfigMap / Secret-only manifests skip the wait. Git source: polls Portainer applications for the stack.

On timeout the build fails and may include a short pods hint.

Portainer environment (endpoint) numeric ID.

Stack types:

• compose for Docker standalone Compose stacks;
• swarm for Swarm stacks.

Used on create and to locate the stack for redeploy.

Must match Portainer naming rules: lowercase alphanumeric characters, _ or - (for example my-name or abc-123).

Path to the Compose file inside the Git repository (relative path ending in .yml or .yaml; no .. segments). Default: docker-compose.yml.

Optional environment variables for the stack, one per line.

• KEY=VALUE — literal or with ${VAR} from the build environment
• KEY alone — same as KEY=${KEY} (copy from the build environment)

Blank lines and lines starting with # are ignored.

RABBITMQ_ERLANG_COOKIE
RABBITMQ_DEFAULT_USER
IMAGE_TAG=1.2.3

If Vault overlay is configured (Inherit or Manual), Vault values win for the same keys. When Vault is Not connected, only these step variables are sent (unless Merge with existing stack env is enabled on update — then Portainer’s current Env is the base and step keys overlay it).

Optional. Username/Password or Secret text used by Portainer to clone a private repository.

When updating an existing stack, load current Portainer Env[] and overlay this step’s environment variables (step wins on the same keys). Vault overlay, if any, still wins last.

Default: disabled (step Env replaces Portainer Env). Enable to keep keys not listed in the step.

Create (stack not found) never merges; there is no existing Env yet.

Portainer connection types:

• Inherit from System (default) — Manage Jenkins → System → Portainer
• Manual (optional): set Portainer URL and API key credentials on this step.

Secret text credentials with the Portainer Access token.

Manual Portainer API base URL. Example: https://portainer.example:9443.

TLS uses the JDK truststore (no skip-SSL).

When checked, Portainer prunes services removed from the Compose file.

Git reference Portainer uses when cloning the stack repository. Default: refs/heads/main.

Examples:

• refs/heads/main
• refs/tags/v1.2.0
• refs/heads/${BRANCH_NAME}

Git repository URL hosting the YAML file.

Do not put credentials in the URL (no user:pass@host). Use Git credentials for private repos.

Example:

https://gitlab.example/group/stack.git

When checked, Portainer force-repulls images and redeploys the stack.

Inline Docker Compose / Swarm stack file content sent to Portainer as StackFileContent. Must be a YAML mapping with a non-empty services section.

Do not put secrets in the YAML when you can use step env or Vault overlay instead. Build logs record only YAML length and a short content hash.

Stack source types:

• Repository — Create the stack from Git if it does not exist on the endpoint; otherwise pull and redeploy the existing Git-backed stack.
• Manual YAML — Create the stack from inline Compose/Swarm YAML if it does not exist on the endpoint; otherwise update and redeploy the existing file-based stack. Content is validated (YAML mapping with a non-empty services section) before Portainer is called. Git-backed stacks cannot be converted this way.

When checked, run connection resolve, Portainer preflight, and Vault preflight (when Vault is connected), plus Manual YAML checks. Then log what would be deployed — without create, Git redeploy, file update, or Vault overlay. Build succeeds when checks pass.

Vault connection types:

• Not connected (default): disable Vault. No Vault HTTP or Vault Plugin calls. Stack Env[] uses step env only.
• Inherit from System: use the official HashiCorp Vault Plugin System configuration. Soft dependency — install the Vault Plugin for Inherit.
• Manual: self-contained HTTP AppRole on this step (vaultUrl + Username/Password). Vault Plugin is not required.

Path and KV mount are on Inherit/Manual only. Vault wins over step text env on key collisions.

When checked, mirror HTTP method/path and timing detail to the build console. By default that detail is only available via a Jenkins Log Recorder at FINE for this plugin.

Portainer environment ID for the Docker Swarm cluster (same as for Portainer Stack Deployment with stackType: swarm).

Directory in the repository containing config files, e.g. configs/swarm. Relative to the repo root.

Which files under Config path become Docker configs. Ant glob, relative to that folder (not the repo root).

Examples:

**/*        all files in that folder and subfolders (default)
*.json      only .json files in that folder (not subfolders)
**/*.conf   all .conf files, including subfolders

Folders themselves are not uploaded. Files whose names start with a dot (for example .gitignore) are skipped.

Portainer connection types:

• Inherit from System (default) — Manage Jenkins → System → Portainer
• Manual (optional): set Portainer URL and API key credentials on this step.

After all configs are ensured, delete older configs on the same Swarm that share the jenkins.portainer.config/base label but a different content-hash name. Deletion failures are logged as warnings.

Git reference Portainer uses when cloning the repository. Default: refs/heads/main.

Examples:

• refs/heads/main
• refs/tags/v1.2.0
• refs/heads/${BRANCH_NAME}

Git repository URL (http/https). No credentials in the URL — use Git credentials for private repos.

When checked, preflight and Git read run; the build log shows planned config names and env keys without creating or deleting Docker configs.

Portainer environment ID for the Docker Swarm cluster.

Portainer connection types:

• Inherit from System (default) — Manage Jenkins → System → Portainer
• Manual (optional): set Portainer URL and API key credentials on this step.

After secrets are ensured, delete older secrets with the same jenkins.portainer.secret/base label but a different hash name.

Failures (secret still in use) are logged; the step does not fail.

The names of the Vault KV v2 keys to copy. Enter one per line.

rabbitmq-erlang-cookie
rabbitmq_default_user
RABBITMQ_DEFAULT_PASS

Listed keys must exist at the path; the key set at the path must match this list. Lines starting with # are skipped. Values are never logged.

When checked, Portainer preflight, Vault preflight, and Vault read run; planned secret names are logged without creating or deleting Docker secrets. Values are not logged.

Inherit uses the HashiCorp Vault Plugin System configuration. Manual uses AppRole on this step (vaultUrl + Username/Password). Not connected is not available — secrets require Vault.