Where to store secrets
Manage Jenkins → Credentials → System → Global credentials → Add Credentials
| Kind | Example |
|---|---|
| Username with password | Docker Hub, Git |
| Secret text | API tokens, license keys |
| SSH Username with private key | Deploy keys |
| Secret file | kubeconfig, JSON keys |
Use in freestyle jobs
Bind credentials in the job (Credentials Binding plugin) or reference them in Pipeline (Day 3). Never paste tokens into shell steps in plain text that gets committed to a job config screenshot or wiki.
Good practices
- Prefer least privilege tokens
- Rotate credentials regularly
- Scope credentials to folders when teams share a controller
- Do not log secret values (
set +x/ mask passwords)
Anyone with Job/Configure or credentials permissions can often extract secrets. Lock down Jenkins auth (users, matrix auth, or SSO) before production use.