Answers: <blockquote>
    <p>I looked at Jenkins plugins for vault, but they only work for fetching secrets from Vault.</p>
  </blockquote>
  
  <p>It depends how the current configuration looks like that is used to deploy apps. </p>
  
  <p><a href="https://github.com/jenkinsci/hashicorp-vault-plugin" rel="nofollow noreferrer">https://github.com/jenkinsci/hashicorp-vault-plugin</a></p>
  
  <p>If one uses Jenkins pipelines, then one could replace the keyId with the one that is defined in Hashicorp vault.</p>
  
  <blockquote>
  <pre><code>node {
    // define the secrets and the env variables
    def secrets = [
        [$class: 'VaultSecret', path: 'secret/testing', secretValues: [
            [$class: 'VaultSecretValue', envVar: 'testing', vaultKey: 'value_one'],
            [$class: 'VaultSecretValue', envVar: 'testing_again', vaultKey: 'value_two']]],
        [$class: 'VaultSecret', path: 'secret/another_test', secretValues: [
            [$class: 'VaultSecretValue', envVar: 'another_test', vaultKey: 'value']]]
    ]
  
    // optional configuration, if you do not provide this the next higher configuration
    // (e.g. folder or global) will be used
    def configuration = [$class: 'VaultConfiguration',
                         vaultUrl: 'http://my-very-other-vault-url.com',
                         vaultCredentialId: 'my-vault-cred-id']
  
    // inside this block your credentials will be available as env variables
    wrap([$class: 'VaultBuildWrapper', configuration: configuration, vaultSecrets: secrets]) {
        sh 'echo $testing'
        sh 'echo $testing_again'
        sh 'echo $another_test'
    }
  }
  </code></pre>
  </blockquote>
  
Answers: CC BY-SA 3.0
Answers: 2017-12-31T11:54:41.520Z
Answers: 2017-12-31T11:54:41.520Z
Answers: 030
Body: <p>I'm setting up Vault to store secrets. SSH backend with OTP auth looks like a good way to stop managing SSH keys for access.</p>
  
  <p>I have SSH backend working, and am looking at hooking up Jenkins with the SSH-OTP auth so that I can remove the deployment keys too.</p>
  
  <p>I looked at Jenkins plugins for vault, but they only work for fetching secrets from Vault.</p>
  
  <p>Are there plugins or any Jenkins hacks for this purpose, or if not, is it possible to write one of my own?</p>
  
  <p><strong>Note</strong>: Right now, Jenkins uses SSH keys. I want to eliminate the use of keys, and configure Jenkins to get an SSH OTP from Vault every time it needs to SSH into some host for a deploy.</p>
  
Comments: CC BY-SA 3.0
Comments: 2017-08-11T06:12:32.323Z
Comments: Could you explain what does not work?
Comments: 030
Comments: CC BY-SA 3.0
Comments: 2017-12-31T11:45:46.600Z
Comments: If you use abbreviations, please define them the first time. In the mean time, I assume that you mean One-Time SSH Password when you talk about OTP. You could also add documentation links you have read to the question.
Comments: 030
Comments: CC BY-SA 4.0
Comments: 2019-12-23T07:54:53.547Z
Comments: Could you indicate whether you solved the issue?
Comments: 030
Tags: <jenkins><hashicorp-vault>
Title: Use Vault SSH OTP backend with Jenkins
UserDisplayName: grumpyops
ThreadText: # Use Vault SSH OTP backend with Jenkins
  
  (Asked by: username_0 on 2017-05-03)
  
  I'm setting up Vault to store secrets. SSH backend with OTP auth looks like a good way to stop managing SSH keys for access.
  
  I have SSH backend working, and am looking at hooking up Jenkins with the SSH-OTP auth so that I can remove the deployment keys too.
  
  I looked at Jenkins plugins for vault, but they only work for fetching secrets from Vault.
  
  Are there plugins or any Jenkins hacks for this purpose, or if not, is it possible to write one of my own?
  
  **Note**: Right now, Jenkins uses SSH keys. I want to eliminate the use of keys, and configure Jenkins to get an SSH OTP from Vault every time it needs to SSH into some host for a deploy.
  
  **Tags:** jenkins, hashicorp-vault
  
  > **Comments:**
  > **username_1**: Could you explain what does not work?  
  > **username_1**: If you use abbreviations, please define them the first time. In the mean time, I assume that you mean One-Time SSH Password when you talk about OTP. You could also add documentation links you have read to the question.  
  > **username_1**: Could you indicate whether you solved the issue?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-12-31. Score: 1
  
  > I looked at Jenkins plugins for vault, but they only work for fetching secrets from Vault.
  
  It depends how the current configuration looks like that is used to deploy apps.
  
  <https://github.com/jenkinsci/hashicorp-vault-plugin>
  
  If one uses Jenkins pipelines, then one could replace the keyId with the one that is defined in Hashicorp vault.
  
  > ```
  > node {
  >   // define the secrets and the env variables
  >   def secrets = [
  >       [$class: 'VaultSecret', path: 'secret/testing', secretValues: [
  >           [$class: 'VaultSecretValue', envVar: 'testing', vaultKey: 'value_one'],
  >           [$class: 'VaultSecretValue', envVar: 'testing_again', vaultKey: 'value_two']]],
  >       [$class: 'VaultSecret', path: 'secret/another_test', secretValues: [
  >           [$class: 'VaultSecretValue', envVar: 'another_test', vaultKey: 'value']]]
  >   ]
  >
  >   // optional configuration, if you do not provide this the next higher configuration
  >   // (e.g. folder or global) will be used
  >   def configuration = [$class: 'VaultConfiguration',
  >                        vaultUrl: 'http://my-very-other-vault-url.com',
  >                        vaultCredentialId: 'my-vault-cred-id']
  >
  >   // inside this block your credentials will be available as env variables
  >   wrap([$class: 'VaultBuildWrapper', configuration: configuration, vaultSecrets: secrets]) {
  >       sh 'echo $testing'
  >       sh 'echo $testing_again'
  >       sh 'echo $another_test'
  >   }
  > }
  >
  > ```
  
  
  ---
  
  