credentials-plugin icon indicating copy to clipboard operation
credentials-plugin copied to clipboard

feat: add merge support for casc defined system credentials

Open cronik opened this issue 2 years ago • 1 comments

Enables support for merging casc defined credentials with existing credentials (i.e. manually created).

In some environments it is desirable to define some credentials declaratively while also be able to define credentials through the UI (which out otherwise be defined in plain text or in encoded format which could be easily transferable).

One such example is mixing vault credentials defined in casc config with those defined directly through Jenkins. In the below casc example it is assumed the the vault-approle credential was created through the Jenkins UI. Currently this is not possible since the casc system credentials will remove all non-casc defined credentials on restart.

unclassified:
  hashicorpVault:
    configuration:
      vaultCredentialId: "vault-approle"
      vaultUrl: "https://myvault.mycorp.net"
credentials:
  system:
    domainCredentials:
      - credentials:
          - vaultUsernamePasswordCredentialImpl:
              description: "vault managed credential"
              id: "my-vault-cred"
              path: "kv/jenkins"
              scope: GLOBAL

To enable merging behavior set the env var CASC_CREDENTIALS_MERGE_STRATEGY=merge or system property -Dcasc.credentials.merge.strategy=merge

fixes JENKINS-64079

  • [x] Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
  • [x] Ensure that the pull request title represents the desired changelog entry
  • [ ] Please describe what you did
  • [x] Link to relevant issues in GitHub or Jira
  • [x] Link to relevant pull requests, esp. upstream and downstream changes
  • [ ] Ensure you have provided tests - that demonstrates feature works or fixes the issue

cronik avatar Jan 24 '23 19:01 cronik