<p>Hey I am new to kubernetes and playing around with jenkins deployment. I have deployed jenkins master pod through the <code>deployment.yaml</code> as well service and <code>pvc.yaml</code>. </p>

<p>I set the service as node port and but how do I secure and manage jenkins secret ? Do I need to create some sort of configmap for this ? I usually get jenkins secrets from kubectl logs . Any help or suggestion will be greatly appreciated to make this more secure :) </p>

jahmedcode
<p><strong>First let's clear some concepts and background:</strong></p>

<p>Since you are new to kubernetes, I'll help you understand the scenario better and give you suggestions to achieve your goal.</p>

<blockquote>
  <p>A <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#understanding-configmaps-and-pods" rel="nofollow noreferrer">ConfigMap</a> stores configuration data as key-value pairs. ConfigMap is <strong>similar</strong> to Secrets, but provides a means of working with strings that <strong>don’t contain</strong> sensitive information.</p>
</blockquote>

<p><em>I'm posting the description of Configmap to help you understand that it's powerful to handle data but it's not applicable for storing sensitive information, hence will not be mentioned below.</em></p>

<blockquote>
  <p><a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">Kubernetes Secrets</a> lets you store and manage sensitive information, such as passwords, OAuth tokens, and ssh keys. Storing confidential information in a Secret is safer and more flexible than putting it verbatim in a Pod definition or in a container image.</p>
</blockquote>

<p><em>Natively, Kubernetes uses secrets to handle objects that store sensitive data and it's authenticated by kubernetes-api, keeping it safe from external access unless it have a valid credential to cluster administration.</em></p>

<p>By default Jenkins stores the password in <strong>Secrets</strong>.</p>

<hr>

<p><strong>Deployment:</strong></p>

<ul>
<li><a href="https://opensource.com/article/19/6/jenkins-admin-password-helm-kubernetes" rel="nofollow noreferrer">This is the 101 guide to deploy Jenkins on Kubernetes</a>

<ul>
<li>It will show you the best way to extract the admin password extracting from the secret</li>
<li>It will show you how to access Jenkins UI.</li>
<li>The deployment is automated with <a href="https://helm.sh/docs/intro/quickstart/" rel="nofollow noreferrer">Helm</a> which is a powerful tool on Kubernetes. </li>
</ul></li>
</ul>

<hr>

<p><strong>Addressing your Questions:</strong></p>

<blockquote>
  <p>how do I secure and manage jenkins secret?</p>
</blockquote>

<ul>
<li>The Jenkins secret is secure by kubernetes credentials, only those who have access to the cluster can extract it, so it's relatively safe by default.

<ul>
<li>You can learn how Kubernetes manages authentication <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer">Here</a>.</li>
<li>Using this approach you can manage your users and password from Jenkins UI. You can learn about Jenkins Credentials <a href="https://jenkins.io/doc/book/using/using-credentials/" rel="nofollow noreferrer">here</a>.</li>
</ul></li>
</ul>

<blockquote>
  <p>Any help or suggestion will be greatly appreciated to make this more secure</p>
</blockquote>

<ul>
<li>After gaining some experience with Jenkins and Kubernetes and as your setup grows, you can start using several steps to enhance your overall security. Thus far we relied on the native security tools, but you can consider new approaches for distributed authentication. Here are some guides you can learn more:

<ul>
<li><a href="https://www.cyberark.com/threat-research-blog/configuring-and-securing-credentials-in-jenkins/" rel="nofollow noreferrer">Configuring and Securing Credentials in Jenkins</a></li>
<li><a href="https://jenkins.io/doc/book/using/using-credentials/" rel="nofollow noreferrer">Official Jenkins Credentials Documentation</a></li>
<li><a href="https://wiki.jenkins.io/display/JENKINS/OAuth+Credentials" rel="nofollow noreferrer">Using OAuth Credentials</a></li>
<li><a href="https://joostvdg.github.io/blogs/kubernetes-sso-keycloak/" rel="nofollow noreferrer">Third-party SSO Login with KeyCloak</a></li>
</ul></li>
</ul>

<p>If I can help you further let me know in the comments!</p>
