Chapter 1. Adding secrets to Jenkins for integration with external tools

Procedure

1. If you have already installed Trusted Software Supply Chain (TSSC) on an OpenShift cluster you will be able to configure all the secrets and variables automatically by running the ci-set-org-vars.sh script packaged in the tssc-cli image.

   1. Make sure you have an integration secret for jenkins as described in Integrating Jenkins
   2. Follow instruction to run the installation container described in Download the installation program image

   3. Once inside the installation container, run the following command:

      $ bash-5.1$ ./scripts/ci-set-org-vars.sh -b jenkins

      Copy to Clipboard Toggle word wrap

      The script creates the required jenkins credentials and environment variables with all the required variables and secrets described in the following steps.

2. Open your Jenkins instance in a web browser and log in with your admin credentials.
3. Select your username at the top right corner of the Jenkins dashboard.
4. From the left sidebar, select Manage Jenkins.
5. In the Security section select Credentials.
6. Under Stores scoped to Jenkins select System.
7. Choose a domain where you want to add the credentials. Typically, it’s Global credentials (unrestricted), click this domain name.
8. Select Add Credentials.
9. From the Kind drop-down list, select Secret text.
10. Keep the default value in the Scope drop-down list as Global (Jenkins…​).
11. Enter information related to your secret in the UI fields.
12. Select Create.

13. Repeat steps 7-11 to add the following credentials:

    Note

    For image registries, Quay is the default option. To use JFrog Artifactory or Sonatype Nexus, uncomment lines with corresponding variables in 2 Jenkinsfiles in both the gitops-template and source-repo folders in your cloned tssc-sample-templates GitHub repository.

    Expand

    Table 1.1. Image registry and GitOps secrets

    Variable	Description
    QUAY_IO_CREDS	Username and password for accessing your Quay.io repository. This is the default option that is uncommented in Jenkinsfiles.
    ARTIFACTORY_IO_CREDS	Username and password for accessing your JFrog Artifactory repository.
    NEXUS_IO_CREDS	Username and password for accessing your Sonatype Nexus repository.
    GITOPS_AUTH_PASSWORD	The token the system uses to update the GitOps repository for newly built images.

    Show more
    Expand

    Table 1.2. Secrets required for ACS and SBOM tasks

    Variable	Description
    ROX_API_TOKEN	API token for accessing the ROX server.
    COSIGN_SECRET_PASSWORD	Password for Cosign signing key.
    COSIGN_SECRET_KEY	Private key for Cosign.
    TRUSTIFICATION_OIDC_CLIENT_SECRET	Client secret used alongside the client ID to authenticate to the Trustification Bombastic API.

    Show more
14. Rerun the last pipeline run. Alternatively, switch to you application’s source repository in GitHub, make a minor change, and commit it to trigger a new pipeline run.