[FIXED] Retrieving secrets from HashiCorp Vault in jenkins pipeline using HashiCorp Vault Plugin

Issue

I have setup a connection between my Jenkins and Vault and by using "withVault" method https://www.jenkins.io/doc/pipeline/steps/hashicorp-vault-plugin/#hashicorp-vault-plugin

I am retrieving vault secrets from Vault in my jenkins pipeline. Secret is stored in the environment variable github_token, which is then used to form URL for accessing git in the pipeline. Retrieving secrets works, the problem is, that $github_token variable contains asterisks.

I need it to contain actual value of the the token

def secrets = [
    [path: 'ddci/data/test', engineVersion: 2, secretValues: [
        [envVar: 'github_token', vaultKey: 'token']
  ]]     
]

def configuration = [vaultUrl: 'https://vault.tools.sap/',
                     vaultNamespace: 's4',
                     vaultCredentialId: 'hashicorp_vault',
                     skipSslVerification: true,
                     engineVersion: 2]

pipeline { agent any

stages{  
stage('use token to authenticate GITHub') { 
    steps {
  withVault([configuration: configuration, vaultSecrets: secrets]) {
    sh 'git_url= https://username:${github_token}@github.tools.sap/AZURE-PIPELINES-SYSDEV/decdev-ci-verification'
    git url: '$git_url', branch: 'master'
    
    }
   }
  }
 }
}

Solution

The $github_token variable doesn't contain asterisks, Jenkins displays any Vault secret using asterisks on console, to protect the real value.

if you want to check the $github_token value, write it to a file in the workspace, doing something like this:

echo $github_token > token.txt

Some other problem is preventing you to access the GitHub server (Is the token correct? Is the path correct? Has the Jenkins node access to the GitHub?). Log to the Jenkins node and try to execute the same command manually.

Answered By - Marcelo Ávila de Oliveira
Answer Checked By - Dawn Plyler (JavaFixing Volunteer)