<p>I'm trying to leverage the Jenkins credentials plugin to store sensitive data which I want to inject into Secrets within my Kubernetes cluster. I have a JenkinsFile which is used in my project to define the steps and I've added the following code to pull a username/password from a credential and pass to shell script to replace a placeholder in a file with the actual file:</p>

<pre><code>stages {
    stage('Build') {
        steps {
           withCredentials([usernamePassword(credentialsId: 'creds-test', passwordVariable: 'PASSWORD', usernameVariable: 'USERNAME')]) {
               sh '''
                  echo $USERNAME
                  echo $PASSWORD

                  chmod +x secrets-replace.sh
                  ./secrets-replace.sh USERNAME_PLACEHOLDER $USERNAME
                  ./secrets-replace.sh PASSWORD_PLACEHOLDER $PASSWORD
                '''
              }
              echo 'Building...'
              sh './gradlew build --refresh-dependencies'
        }
    }
    ...
}
</code></pre>

<p>However whenever this runs all I ever get is the masked **** value back, even when I pass it to the shell script. Here is part of the build log:</p>

<p><a href="https://i.stack.imgur.com/rXHwW.png" rel="noreferrer"><img src="https://i.stack.imgur.com/rXHwW.png" alt="Jenkins Log"></a></p>

<p>Is there something I need to configure to get access to the unmasked value?</p>

<p>Write the variable to a file in jenkins. Go to the jenkins workspace and look inside the file. The token will be present in plain text there.</p>
<p>UPDATE</p>
<p>Further easy way will be to print the <code>base64</code> encoded value of the credential and then decode it.</p>
