Integrate with Jenkins

integration overview the integration relies on four building blocks that work together a kron pam vault account (for example, a linux or windows account) whose secret jenkins needs to retrieve a kron pam application token, scoped to the jenkins host address and bound to the vault account, used to authenticate api requests the kron pam secret plugin, installed in jenkins, which exposes a "kron pam secret credential" credential type a jenkins credential of that type, configured with the aapm rest url and the request payload (including the application token), which is then bound to a job as an environment variable step by step guide step 1 – locate the target account in kron pam vault in the kron pam console, navigate to secrets > vault and locate the account group and account that jenkins will need to access in this example, the jenkinstest account under the linuxbase account group is used step 2 – create an application token for jenkins application tokens allow external applications, such as jenkins, to authenticate to kron pam aapm rest endpoints navigate to secrets > vault > application token and create a new token enter an application name (e g jenkins plugin) set the authentication type to kron application token enter the application network address range or hostname of the jenkins host (e g \<jenkins host ip>/32 ) this restricts the token to requests originating from that address select the vault account(s) that jenkins should be able to retrieve (e g jenkinstest@/linuxbase) optionally enable add event user and select an event username for audit purposes, then click next after completing the wizard, kron pam generates the application token value this token must be copied and stored securely — it is required in the next steps and cannot be retrieved again after the dialog is closed the token value in figure 4 has been redacted before publishing this document, because it is a live credential step 3 – install and verify the kron pam secret plugin in jenkins the kron pam secret plugin must be installed in jenkins before the new credential type becomes available if the plugin is not yet installed, download the kronpamsecretplugin hpi file and upload it manually log into jenkins as an administrator navigate to dashboard > manage jenkins > manage plugins > advanced tab in the upload plugin section, browse for kronpamsecretplugin hpi and click upload restart jenkins after the plugin has been uploaded step 4 – add a kron pam secret credential in jenkins with the plugin enabled, a new credential type becomes available navigate to dashboard > manage jenkins > credentials > system > global credentials (unrestricted) > add credentials, and select kron pam secret credential from the list of credential kinds jenkins then presents the kron pam secret credential form, to be completed in the next step step 5 – configure the credential data the credential definition tells jenkins which aapm rest endpoint to call and what request payload to send, including the application token generated in step 2 set scope to global (jenkins, nodes, items, all child items, etc ) set url to the aapm password request endpoint of your kron pam host, for example https //\[kron pam host]/aioc rest web/rest/aapm/request/password in data, provide a json payload identifying the account and request options, including tenantid, comment, passwordchangerequired, passwordexpirationinminute and the application token set id to a recognizable name (e g aapm secret) this is the identifier used later when binding the credential to a job click create (or save, when updating an existing credential) the token value in figure 11 has been redacted for the same reason as figure 4 in the live environment this field contains the full application token generated in step 2 step 6 – confirm credential usage opening the credential detail page shows a usage section, which lists the jenkins jobs referencing it this is useful for auditing which pipelines depend on a given kron pam secret step 7 – bind the secret to a jenkins job open the target project (freestyle project in this example) and click configure under the environment section, enable use secret text(s) or file(s), then add a binding under bindings, click add and select kron pam secret credential set the variable name that the build steps will use to reference the secret (e g kron pam secret) under credentials, choose specific credentials and select the kron pam credential created in step 5 (e g kron pam credential\ aapm secret) (optional) additional credentials can be bound the same way using the add button step 8 – use the secret in a build step the bound variable is injected as an environment variable into the build step, so it can be referenced without ever appearing in plain text in the job configuration in this example, an execute windows batch command build step uses the secret to authenticate an ssh session via plink plink ssh hostkey "ssh ed25519 255 sha256 " jenkinstest\@10 20 30 40 pw %kron pam secret% batch cat /home/jenkinstest/jenkinsfile figure 14 – build step referencing the secret via the %kron pam secret% environment variable save (or apply) the job configuration once the build step is complete step 9 – verify via kron pam audit logs every time a jenkins build runs and retrieves the secret, kron pam records the request navigate to secrets > audit in the kron pam console to confirm that check password events for the relevant account (e g jenkinstest under /linuxbase) are logged with a succeeded result result jenkins is now integrated with kron pam aapm through the kron pam secret plugin jenkins jobs bound to the configured credential can retrieve the target account's secret at build time via an environment variable, without the secret ever being stored in the job configuration, in source control, or in plain text logs every retrieval is recorded in the kron pam audit trail, providing traceability between jenkins builds and vault access