Answers: <p>Specifically for credentials, CloudBees recommends using the Credentials Plugins, which inject the credentials in the environment available to the invoked scripts. From <a href="https://support.cloudbees.com/hc/en-us/articles/203802500-Injecting-Secrets-into-Jenkins-Build-Jobs" rel="noreferrer">Injecting Secrets into Jenkins Build Jobs</a>:</p>
  
  <blockquote>
    <ul>
    <li><a href="https://wiki.jenkins-ci.org/display/JENKINS/Credentials+Plugin" rel="noreferrer">Credentials plugin</a> - provides a centralized way to define credentials that can be used by your Jenkins instance, plugins and
    build jobs.</li>
    <li><a href="https://wiki.jenkins-ci.org/display/JENKINS/Credentials+Binding+Plugin" rel="noreferrer">Credentials Binding plugin</a> - allows you to configure your build jobs to inject credentials as environment variables.</li>
    <li><a href="https://wiki.jenkins-ci.org/display/JENKINS/Plain+Credentials+Plugin" rel="noreferrer">Plain Credentials plugin</a> - a plugin dependency required by the Credentials Binding plugin.</li>
    </ul>
  </blockquote>
  
  <p>Inside your script you'd pick up the variable from the script's environment:</p>
  
  <pre><code>API_TOKEN = os.getenv('API_TOKEN')
  </code></pre>
  
  <p>In a similar way you can pass any arbitrary variables (other than credentials), using the <a href="https://wiki.jenkins.io/display/JENKINS/EnvInject+Plugin" rel="noreferrer">EnvInject Plugin</a> (watch for the warnings, tho). See related:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/31203816/jenkins-inject-environment-variable">Jenkins inject environment variable</a></li>
  <li><a href="https://stackoverflow.com/questions/21130931/environment-variables-in-jenkins">Environment variables in Jenkins</a></li>
  </ul>
  
  <p>Another possible approach is to configure Jenkins to pass the value as an argument to your script. Inside your script you'd pick up the value using your preferred method of processing the script arguments.</p>
  
Answers: CC BY-SA 4.0
Answers: 2018-06-27T13:46:47.543Z
Answers: 2018-06-27T13:46:47.543Z
Answers: Dan Cornilescu
Answers: <p>If you are using Pipeline (i.e. Jenkinsfile), use <a href="https://jenkins.io/doc/pipeline/steps/credentials-binding/" rel="nofollow noreferrer"><code>withCredentials</code></a>.  To give a quick and dirty example:</p>
  
  <pre><code>withCredentials([[
    $class: 'UsernamePasswordMultiBinding',
    credentialsId: 'my-credentials',
    usernameVariable: 'user',
    passwordVariable: 'pw',
  ]]) {
    sh("./my-python-script.py --user ${user} --password ${pw}")
  }
  </code></pre>
  
  <p>Your credentials will be automatically redacted from the console output to help prevent sensitive information from leaking.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-07-25T18:28:35.457Z
Answers: One thing to beware: credentials plugin hide secrets from jenkins console only.  Should the python script create a log and store the secret there, it will not be masked.   At present, I know of no way to clean a log file effectively.  Waiting on https://issues.jenkins-ci.org/browse/JENKINS-58664
Answers: Peter Kahn
Answers: CC BY-SA 4.0
Answers: 2018-06-27T16:08:35.993Z
Answers: 2018-10-03T15:32:40.703Z
Answers: 2018-10-03T15:32:40.703Z
Answers: jayhendren
Body: <p>I have a global jenkins credential and a config script that includes the line</p>
  
  <pre><code>API_TOKEN = "Token XXX"
  </code></pre>
  
  <p>For security reasons we can't keep the token in the script itself as its in version control. Is there a way to pass the jenkins credential to the python config script from jenkins?</p>
  
Comments: CC BY-SA 4.0
Comments: 2018-06-27T13:26:12.137Z
Comments: How is Jenkins configured to invoke your script?
Comments: Dan Cornilescu
Tags: <jenkins><python>
Title: Passing a jenkins credential (global) to a python script
UserDisplayName: CEamonn
ThreadText: # Passing a jenkins credential (global) to a python script
  
  (Asked by: username_0 on 2018-06-27)
  
  I have a global jenkins credential and a config script that includes the line
  
  ```
  API_TOKEN = "Token XXX"
  
  ```
  
  For security reasons we can't keep the token in the script itself as its in version control. Is there a way to pass the jenkins credential to the python config script from jenkins?
  
  **Tags:** jenkins, python
  
  > **Comments:**
  > **username_1**: How is Jenkins configured to invoke your script?  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2018-06-27. Score: 6
  
  Specifically for credentials, CloudBees recommends using the Credentials Plugins, which inject the credentials in the environment available to the invoked scripts. From [Injecting Secrets into Jenkins Build Jobs](https://support.cloudbees.com/hc/en-us/articles/203802500-Injecting-Secrets-into-Jenkins-Build-Jobs):
  
  > * [Credentials plugin](https://wiki.jenkins-ci.org/display/JENKINS/Credentials+Plugin) - provides a centralized way to define credentials that can be used by your Jenkins instance, plugins and
  >   build jobs.
  > * [Credentials Binding plugin](https://wiki.jenkins-ci.org/display/JENKINS/Credentials+Binding+Plugin) - allows you to configure your build jobs to inject credentials as environment variables.
  > * [Plain Credentials plugin](https://wiki.jenkins-ci.org/display/JENKINS/Plain+Credentials+Plugin) - a plugin dependency required by the Credentials Binding plugin.
  
  Inside your script you'd pick up the variable from the script's environment:
  
  ```
  API_TOKEN = os.getenv('API_TOKEN')
  
  ```
  
  In a similar way you can pass any arbitrary variables (other than credentials), using the [EnvInject Plugin](https://wiki.jenkins.io/display/JENKINS/EnvInject+Plugin) (watch for the warnings, tho). See related:
  
  * [Jenkins inject environment variable](https://stackoverflow.com/questions/31203816/jenkins-inject-environment-variable)
  * [Environment variables in Jenkins](https://stackoverflow.com/questions/21130931/environment-variables-in-jenkins)
  
  Another possible approach is to configure Jenkins to pass the value as an argument to your script. Inside your script you'd pick up the value using your preferred method of processing the script arguments.
  
  
  ---
  
  ### Answer by username_2 on 2018-06-27. Score: 4
  
  If you are using Pipeline (i.e. Jenkinsfile), use [`withCredentials`](https://jenkins.io/doc/pipeline/steps/credentials-binding/). To give a quick and dirty example:
  
  ```
  withCredentials([[
    $class: 'UsernamePasswordMultiBinding',
    credentialsId: 'my-credentials',
    usernameVariable: 'user',
    passwordVariable: 'pw',
  ]]) {
    sh("./my-python-script.py --user ${user} --password ${pw}")
  }
  
  ```
  
  Your credentials will be automatically redacted from the console output to help prevent sensitive information from leaking.
  
  > **Comments:**
  > **username_3**: One thing to beware: credentials plugin hide secrets from jenkins console only.  Should the python script create a log and store the secret there, it will not be masked.   At present, I know of no way to clean a log file effectively.  Waiting on https://issues.jenkins-ci.org/browse/JENKINS-58664  
  
  ---
  
  