Managing Secrets in Jenkins

Below is a text-only guide for users based on the above video

The Akeyless Plugin for Jenkins fetches secrets from the Akeyless Platform at build time and injects them into your job as environment variables. The values never live in Jenkins, and Jenkins masks them in the build log.

This tutorial creates a static secret, an API Key Auth Method and an Access Role in Akeyless, then installs the plugin, adds the credential and runs a Freestyle job that reads the secret.

Prerequisites

1. An Akeyless account with access to the Akeyless Console.
2. An Akeyless Gateway that your Jenkins controller can reach.
3. A Jenkins controller where you can install plugins (Manage Jenkins permission).

Set up Akeyless

Create the static secret

In the Akeyless Console, go to Items > New > Static Secret, and fill in:

Name: app-creds

Location: /devops/jenkins

Format: Key/value, with two keys: username and password, each with its value. The values stay hidden as you type.

Click Finish.

The static secret app-creds is now in the /devops/jenkins folder.

Create the API Key Auth Method

Go to Users & Auth Methods > New > API Key > Next, and fill in:

Name: jenkins-api-key

Location: /devops/jenkins

Click Finish.

Akeyless shows the new Access ID and Access Key. The Access Key is shown only this once, so copy it now. Jenkins will need both.

Create the Access Role

Go to Access Roles > New, and fill in:

Name: jenkins-role

Location: /devops/jenkins

Click Next. Click Associate, search for jenkins-api-key, select it and click Add.

Click Next to set the rules. Click Add and set:

Type: Items

Path: /devops/jenkins/* (every item in that folder)

Permissions: Read and List. Nothing else.

Click Add. The rule is in the list.

Click Next through the remaining steps, and then Finish. jenkins-role now gives the API key read access to /devops/jenkins, and nothing more.

Check the Gateway

Go to Gateways and make sure your Gateway is Healthy. Open it to see its Gateway URL. That's the address Jenkins will connect to.

Configure Jenkins

Install the plugin

Go to Manage Jenkins > Plugins > Available plugins, and search for Akeyless. Tick its Install checkbox and click Install.

Jenkins installs the plugin's dependencies (such as Credentials and Credentials Binding) first, then the Akeyless plugin itself. No restart is needed.

Add the Akeyless credential

Go to Manage Jenkins > Credentials > Add Credentials, choose Akeyless API Key and click Next. Fill in:

Access ID: the Access ID of jenkins-api-key

Access Key: the Access Key you copied

ID: akeyless-api-key (the job will use this name)

Description: optional

Click Create.

The credential is saved.

Create and configure the job

Click New Item, name it app-deploy, choose Freestyle project and click OK.

In the Environment section, turn on Akeyless Plugin and fill in:

Gateway URL: your Gateway URL, ending in /api/v2, for example https://gateway.example.com/api/v2

Auth Method: the credential you just created

Open Advanced and set Timeout to 15000. The default is too short to reach the Gateway, so the build would time out.

Click Add Secret. In Name, type the secret's path: /devops/jenkins/app-creds. Then map each key to an environment variable:

Use Add a key/value pair for the second row.

Go to Build Steps > Add build step > Execute shell, and enter a command that uses the variables:

echo "Deploying the app as $APP_USER"
echo "Database password: $APP_PASS"
echo "Deployment complete"

Click Save.

Run the build

Click Build Now. Open build #1 and click Console Output. The plugin retrieves the secret, and both values show as asterisks:

Retrieving secret: /devops/jenkins/app-creds -- SUCCESS.
[app-deploy] $ /bin/sh -xe /tmp/jenkins...sh
+ echo Deploying the app as ****
Deploying the app as ****
+ echo Database password: ****
Database password: ****
+ echo Deployment complete
Deployment complete
Finished: SUCCESS

The build gets the credentials from Akeyless at run time, and they never appear in Jenkins or in the log.