Credentials use in pipelines served by pipelinelib is restricted by adding allowed credentials to the pipelinelib library. Find a more user-friendly way to do this.
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | jeena | T267699 Better way to restrict credentials available to pipelinelib | |||
| Resolved | jeena | T267700 Experiment with Jenkins folders for credentials restriction | |||
| Resolved | jeena | T269900 Pass allowed credentials parameters to pipeline builder via jjb job templates | |||
| Resolved | jeena | T269902 Allow overrides to pipeline builder for passing allowed credentials list |
Event Timeline
Comment Actions
We've decided to take multiple steps to restrict credentials usage in Jenkins:
- Create a whitelist of credentials for usage in test pipelines on a per-project basis
- Create a whitelist of credentials for usage in gate-and-submit and post-merge pipelines on a per-project basis
- Possibly create a global whitelist of credentials that are likely to be used by many projects in the test pipeline
- Move credentials outside of the global jenkins scope to be contained in jenkins folders so that they can only be accessed by certain jobs
The whitelists are intended to be defined in the integration/config repo and passed as parameters to the pipeline builder so that it's clear which projects are allowed to use which credentials.