<p>I'm using a JenkinsFile to pull a secret from Jenkins and use it further by setting it up as an environment variable. Below is my code snippet. How to set <code>env.K8S_CREDENTIALS_ID_STG</code> value from a script or a hardcoded value for starting point and pass it Kubernetes functions to deploy what Kubernetes is doing? I want to remove the dependency of storing secrets in Jenkins or Kubernetes. We have our own credential management from where we fetch secrets over API calls at runtime.</p>
<pre><code>steps {
    script {
        env.K8S_CREDENTIALS_ID_STG = 'ece-prm-agents-stg-token'
        withCredentials([usernamePassword(credentialsId: 'ece_auto', usernameVariable: 'DOCKER_USER', passwordVariable: 'DOCKER_PASS')]){
            statusCheck('pending', 'deploy to stg')
            try {
                glKubernetesDeleteBasic credentials: &quot;$env.K8S_CREDENTIALS_ID_STG&quot;,cluster: &quot;k8s-nonprod-ctc-aci.optum.com&quot;,namespace: &quot;ece-prm-stg&quot;, yaml: &quot;ece-kinds/k8/ece-prm-k8-depl-stg.yaml&quot;, env: &quot;Dev&quot;, isProduction: false
            }
            catch(Exception e) {
                echo &quot;${e}&quot;
            }
            try{
                glKubernetesCreateBasic credentials: &quot;$env.K8S_CREDENTIALS_ID_STG&quot;,cluster: &quot;k8s-nonprod-ctc-aci.optum.com&quot;,namespace: &quot;ece-prm-stg&quot;, yaml: &quot;ece-kinds/k8/ece-prm-k8-depl-stg.yaml&quot;, env: &quot;Dev&quot;, isProduction: false
                statusCheck('success', 'deploy to stg')
            } catch (Exception ex){
                statusCheck('failure', 'deploy to stg')
            }
        }
    }
}
</code></pre>
<p>How can I remove the dependency of having to store secrets in Jenkins?</p>

bosari
<p>I would write a Shared Library Step that accepts the name of the credential to get, then calls out to your Credentials API and returns the credential back to the pipeline</p>
<p>so something like</p>
<pre><code>steps {
  script {
    env.K8S_CREDENTIALS_ID_STG = getMyCredentials('ece-prm-agents-stg-token')
</code></pre>
<p>More info on Shared Libraries can be found here if you haven't used them before
<a href="https://www.jenkins.io/doc/book/pipeline/shared-libraries/" rel="nofollow noreferrer">https://www.jenkins.io/doc/book/pipeline/shared-libraries/</a></p>
<p>Of course if the API is Authd then you will have the secret zero problem but I would suggest that one being sensible to store in Jenkins</p>
