I'm looking for a way or guidance on a plugin that gives me the capability
of loading and using credentials that are served from a system external to
Jenkins. There is a combination of static credentials and dynamic
credentials. The use of the external system is required for static
credentials to gain centralized storage of credentials, and to support
proper auditing and logging when credentials are used. For dynamic
credentials, we can consume from the source directly (AWS STS AssumeRole).
I would like to use the Credentials Plugin as the interface into these
external systems.
For the purposes of this discussion:
- Static Credentials: Credentials that are statically saved within the
password system
- AD/LDAP username/password
- Dynamic Credentials: Credentials that are generated when requested
- For AWS: A list of IAM roles that can be assumed to generate an
access key, secret key, and token
The external systems are the source of truth for the credentials, I just
need a logical way to incorporate those secrets into the credentials
plugin. I have been looking through the list of Jenkins plugins but I am
unable to find a way to perform the following:
1) Dynamically load the list of credentials available to a job from the
external system
2) Define a scope for these external credentials
3) Any examples of any plugins that loads its list of credentials from an
external system
To be more complete, here are a couple use cases:
GIVEN:
> I have a Jenkins master in one AWS account, and a Jenkins agent in a
> development AWS account, and a Jenkins agent in a staging AWS account.
> WHEN:
> I have a job that is tied to the development AWS account and I list the
> available credentials (IAM Roles)
> THEN:
> I only see IAM roles within that account that matches the path (folder)
> defined in the Jenkins job
GIVEN:
> I have a set of Jenkins jobs that point to different github organizations,
> and the corresponding Github access tokens stored in Hashicorp Vault with
> the path secret/github/<organization>
> THEN:
> The only available credential for that job is retrieved from Vault with
> path /github/<organization>
Can some guidance be provided on how to accomplish this, or if its even
possible? I am considering writing a external-credentials plugin to
support this type of behavior but I am unsure if that is necessary or if I
can achieve this using existing plugins.
Any help/guidance would be appreciated.
Thanks,
Antonio
--
You received this message because you are subscribed to the Google Groups
"Jenkins Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/jenkinsci-dev/438dda98-b118-4687-acc8-1958ba7445b0%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
