[FIXED] How does Jenkins credentials work or apply to agent in a pipeline

Issue

I've following two pieces of code one work and other doesn't. I need to understand if the agent is declared inside the stage, credentials are recognised and if the the agent is declared on top/global level, then credentials don't work and ends un in error. Could anyone help understand why it is so and how this can be worked out?

Error:

pipeline 
{
    environment {
    DOCKER_REGISTRY='xxxxxxxxx'
    DOCKER_CREDENTIAL='dcaas-r'
  }
  agent 
  {
     docker { 
     image "xxxxxxxxx/dotnet:latest"
     registryUrl env.DOCKER_REGISTRY
     registryCredentialsId env.DOCKER_CREDENTIAL
     reuseNode true
     }
  }    
    stages 
    {
        stage('Test') 
        {
            steps 
            {
                sh 'dotnet --version' 
            }
        }
    }
}

Error response from daemon: Head "xxxxx/dotnet/manifests/latest": unknown: Authentication is required

Success:

pipeline 
    {
        agent any
        environment {
        DOCKER_REGISTRY='xxxxxxxxx'
        DOCKER_CREDENTIAL='dcaas-r'
      }
   
        stages 
        {
            stage('Test') 
            {
               agent 
               {
                  docker { 
                  image "xxxxxxxxx/dotnet:latest"
                  registryUrl env.DOCKER_REGISTRY
                  registryCredentialsId env.DOCKER_CREDENTIAL
                  reuseNode true
                  }
               } 
                steps 
                {
                    sh 'dotnet --version' 
                }
            }
        }
    }

What could be done, in order to not to write same agent block in all stages?

Solution

If you have a global agent directive, then you do not need to specify the docker values as environment variables because

• they are not environment variables
• they are only used once
• they are not dynamic

It would appear like:

agent {
  docker { 
    image                 'xxxxxxxxx/dotnet:latest'
    registryUrl           'xxxxxxxxx'
    registryCredentialsId 'dcaas-r'
    reuseNode             true
  }
}    

You will only view logs for the stages, and so global directives are not logged. This means you will be unable to see image retrieval logs for the docker agent in the global directive.

Answered By - Matt Schuchard
Answer Checked By - Candace Johnson (JavaFixing Volunteer)