Answers: <p>I set credential globally in declarative pipeline like this and then my Jenkins could talk with Google Dataflow in all stages.  For example, I used a secret file (google service account). </p>
  
  <pre>
  <code>
  pipeline {
      agent any
      environment {
          //Secret File ID was defined in Jenkins -> Credentials -> System -> Global credentials
          GOOGLE_APPLICATION_CREDENTIALS = credentials('mySecretFileId')
  
          GCP_PROJECT_NAME = 'myProject'
      }
     stages {
               stage('step 1') {
                steps {
                  sh "gcloud auth activate-service-account --key-file ${env.GOOGLE_APPLICATION_CREDENTIALS}"
                  sh "gcloud config set project ${env.GCP_PROJECT_NAME}"
  
                  // access google dataflow
                  sh "gcloud dataflow jobs list --status=active"
                  // ....
                }
               }
               stage('stage 2') {
                 steps {
                    // access google dataflow
                    sh "gcloud dataflow jobs list --status=active"
                 }
               }
               //...
     }
  }   
  
  </code>
  </pre>
  
Answers: CC BY-SA 4.0
Answers: 2021-07-02T07:53:15.533Z
Answers: Best answer for this question.
Answers: Arockiasmy K
Answers: CC BY-SA 4.0
Answers: 2019-03-05T20:58:30.790Z
Answers: 2019-03-05T20:58:30.790Z
Answers: Qin Ma
Answers: <p>The credentials will only be visible within the block passed to <code>withCredentials</code>, not outside of that.  So, no, your credentials will not be visible to other stages.  To make your credentials visible to your entire Pipeline:</p>
  <ul>
  <li><p>If you are using Declarative Pipelines, you can put your credentials in an <code>environment{}</code> block at the top of your Pipeline, as documented in the <a href="https://www.jenkins.io/doc/book/pipeline/jenkinsfile/#handling-credentials" rel="nofollow noreferrer">official Jenkins handbook</a>:</p>
  <pre><code>pipeline {
      agent {
          // Your agent here
      }
      environment {
          MY_ENVIRONMENT_VARIABLE = credentials('my-credentials-id')
      }
      stages {
          // Your stages here
      }
  }
  </code></pre>
  </li>
  <li><p>If you use Scripted Pipelines, you can wrap your entire job in <code>withCredentials</code>.  This is not possible with Declarative.</p>
  </li>
  </ul>
  
Answers: CC BY-SA 4.0
Answers: 2023-05-05T21:04:25.107Z
Answers: Number 2 might have been correct at the time the answer was posted, but it absolutely is not correct at the time of this comment.
  An `environment{}` block with the `credentials()` method provides an implicit global `withCredentials`
Answers: Ken Rachynski
Answers: CC BY-SA 4.0
Answers: 2023-05-11T23:04:43.893Z
Answers: @KenRachynski I looked it up, and support for `credentials` in the `environment{}` block was added in April 2017, which is before I wrote this answer, but it seems to have been poorly documented at the time, especially compared to the `withCredentials` step which well predates Jenkins Pipelines.  I'm editing my answer to improve its accuracy.
Answers: jayhendren
Answers: CC BY-SA 4.0
Answers: 2018-11-06T19:56:55.530Z
Answers: 2023-05-11T23:11:23.237Z
Answers: 2023-05-11T23:11:23.237Z
Answers: jayhendren
Body: <p>In Jenkinsfile, I want to make an <code>ssh key</code> visible to all stages in the pipeline.</p>
  
  <p>From the official document, I learned that:</p>
  
  <ol>
  <li><code>environment</code> directive is used to defy environment variables for used within Jenkinsfile</li>
  <li>The scope of the variables defined depends on the placement of the <code>environment</code> directive</li>
  <li>One can set the <strong>some types of credentials</strong> inside<code>environment</code> directive with the help of the <code>credentials</code> helper</li>
  <li>The types of credentials supported by the helper are:
  
  <ul>
  <li>Secret text</li>
  <li>Usernames and passwords</li>
  <li>Secret files</li>
  </ul></li>
  </ol>
  
  <p>For other types of credentials, the document suggests using the <code>snippet generator</code>, which generates a step.</p>
  
  <p>Example of an ssh key step</p>
  
  <pre><code>withCredentials([sshUserPrivateKey(credentialsId: 'jenkins_aws_to_bitbucket', keyFileVariable: 'BITBUCKET_PRV_KEY')]) {
      // some block
  }
  </code></pre>
  
  <p>This is meant to be used in a <em>stage</em> like:</p>
  
  <pre><code>pipeline {
      agent {
          // define agent details
      }
      stages {
          stage('Example stage 1') {
              steps {
                  withCredentials(bindings: [sshUserPrivateKey(credentialsId: 'jenkins-ssh-key-for-abc', \
                                                               keyFileVariable: 'SSH_KEY_FOR_ABC')]) {
                    // 
                  }
                  withCredentials(bindings: [certificate(credentialsId: 'jenkins-certificate-for-xyz', \
                                                         keystoreVariable: 'CERTIFICATE_FOR_XYZ', \
                                                         passwordVariable: 'XYZ-CERTIFICATE-PASSWORD')]) {
                    // 
                  }
              }
          }
          stage('Example stage 2') {
              steps {
                  // 
              }
          }
      }
  }
  </code></pre>
  
  <p><a href="https://jenkins.io/doc/book/pipeline/jenkinsfile/" rel="noreferrer"><em>Snippet source</em></a></p>
  
  <p><strong>Question</strong></p>
  
  <ol>
  <li>If the steps are within a <em>stage</em>, are these credentials visible within other stages? </li>
  <li>If not, how to make these credentials <em>global</em> ~ visible within all stages</li>
  </ol>
  
Tags: <jenkins><jenkinsfile>
Title: How to make Jenkinsfile credential visible to many stages
UserDisplayName: Tran Triet
ThreadText: # How to make Jenkinsfile credential visible to many stages
  
  (Asked by: username_0 on 2018-10-30)
  
  In Jenkinsfile, I want to make an `ssh key` visible to all stages in the pipeline.
  
  From the official document, I learned that:
  
  1. `environment` directive is used to defy environment variables for used within Jenkinsfile
  2. The scope of the variables defined depends on the placement of the `environment` directive
  3. One can set the **some types of credentials** inside`environment` directive with the help of the `credentials` helper
  4. The types of credentials supported by the helper are:
     * Secret text
     * Usernames and passwords
     * Secret files
  
  For other types of credentials, the document suggests using the `snippet generator`, which generates a step.
  
  Example of an ssh key step
  
  ```
  withCredentials([sshUserPrivateKey(credentialsId: 'jenkins_aws_to_bitbucket', keyFileVariable: 'BITBUCKET_PRV_KEY')]) {
      // some block
  }
  
  ```
  
  This is meant to be used in a *stage* like:
  
  ```
  pipeline {
      agent {
          // define agent details
      }
      stages {
          stage('Example stage 1') {
              steps {
                  withCredentials(bindings: [sshUserPrivateKey(credentialsId: 'jenkins-ssh-key-for-abc', \
                                                               keyFileVariable: 'SSH_KEY_FOR_ABC')]) {
                    // 
                  }
                  withCredentials(bindings: [certificate(credentialsId: 'jenkins-certificate-for-xyz', \
                                                         keystoreVariable: 'CERTIFICATE_FOR_XYZ', \
                                                         passwordVariable: 'XYZ-CERTIFICATE-PASSWORD')]) {
                    // 
                  }
              }
          }
          stage('Example stage 2') {
              steps {
                  // 
              }
          }
      }
  }
  
  ```
  
  [*Snippet source*](https://jenkins.io/doc/book/pipeline/jenkinsfile/)
  
  **Question**
  
  1. If the steps are within a *stage*, are these credentials visible within other stages?
  2. If not, how to make these credentials *global* ~ visible within all stages
  
  **Tags:** jenkins, jenkinsfile
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_3 on 2018-11-06. Score: 8 | Accepted answer
  
  The credentials will only be visible within the block passed to `withCredentials`, not outside of that. So, no, your credentials will not be visible to other stages. To make your credentials visible to your entire Pipeline:
  
  * If you are using Declarative Pipelines, you can put your credentials in an `environment{}` block at the top of your Pipeline, as documented in the [official Jenkins handbook](https://www.jenkins.io/doc/book/pipeline/jenkinsfile/#handling-credentials):
  
    ```
    pipeline {
        agent {
            // Your agent here
        }
        environment {
            MY_ENVIRONMENT_VARIABLE = credentials('my-credentials-id')
        }
        stages {
            // Your stages here
        }
    }
  
    ```
  * If you use Scripted Pipelines, you can wrap your entire job in `withCredentials`. This is not possible with Declarative.
  
  > **Comments:**
  > **username_4**: Number 2 might have been correct at the time the answer was posted, but it absolutely is not correct at the time of this comment. An `environment{}` block with the `credentials()` method provides an implicit global `withCredentials`  
  > **username_3**: @username_4 I looked it up, and support for `credentials` in the `environment{}` block was added in April 2017, which is before I wrote this answer, but it seems to have been poorly documented at the time, especially compared to the `withCredentials` step which well predates Jenkins Pipelines.  I'm editing my answer to improve its accuracy.  
  
  ---
  
  ### Answer by username_1 on 2019-03-05. Score: 4
  
  I set credential globally in declarative pipeline like this and then my Jenkins could talk with Google Dataflow in all stages. For example, I used a secret file (google service account).
  
  ```
  
  pipeline {
      agent any
      environment {
          //Secret File ID was defined in Jenkins -> Credentials -> System -> Global credentials
          GOOGLE_APPLICATION_CREDENTIALS = credentials('mySecretFileId')
  
          GCP_PROJECT_NAME = 'myProject'
      }
     stages {
               stage('step 1') {
                steps {
                  sh "gcloud auth activate-service-account --key-file ${env.GOOGLE_APPLICATION_CREDENTIALS}"
                  sh "gcloud config set project ${env.GCP_PROJECT_NAME}"
  
                  // access google dataflow
                  sh "gcloud dataflow jobs list --status=active"
                  // ....
                }
               }
               stage('stage 2') {
                 steps {
                    // access google dataflow
                    sh "gcloud dataflow jobs list --status=active"
                 }
               }
               //...
     }
  }   
  
  ```
  
  > **Comments:**
  > **username_2**: Best answer for this question.  
  
  ---
  
  