Chapter 1. Adding secrets to Jenkins for secure integration with external tools
When you select Jenkins as your CI provider while creating an application, you must add secrets to Jenkins for secure integration with external tools. This enables Jenkins to perform essential tasks, such as vulnerability scanning, image signing, and attestation generation.
Prerequisites
- You must have the necessary permissions to create and manage Jenkins jobs, variables, and CI pipelines.
- You must have the username and password for the image registry, such as Quay.io, Jfrog Artifactory, or Sonatype Nexus, to and pull container images.
- You must have appropriate GitOps credentials.
You must have the following information for specific tasks that you want Jenkins pipeline to perform:
For ACS tasks:
- ROX Central server endpoint and token
For SBOM tasks:
- Cosign signing keys password, private key, and public key
- Trustification URL, client ID, secret, and supported CycloneDX version
NoteThe values used for these credentials are already Base64-encoded, so you do not need to convert them. You can find these credentials in your
private.envfile.
Procedure
- Open your Jenkins instance in a web browser and log in with your admin credentials.
- Select on your username at the top right corner of the Jenkins dashboard.
- From the left sidebar, select Credentials.
- Choose the appropriate domain where you want to add the credentials. Typically, it’s Global credentials (unrestricted).
- Select Add Credentials.
- From the Kind drop-down list, select Secret text.
- Keep the default value in the Scope drop-down list as Global (Jenkins).
- In the Secret field, enter your ACS API token.
-
In the ID field, enter
ROX_API_TOKEN. - In the Description field, enter an appropriate description for the credentials.
Repeat steps 5-10 for the following credentials:
Variable Description Provide image registry credentials for only one image registry.
QUAY_IO_CREDS_USRUsername for accessing Quay.io repository.
QUAY_IO_CREDS_PSWPassword for accessing Quay.io repository.
ARTIFACTORY_IO_CREDS_USRUsername for accessing JFrog Artifactory repository.
ARTIFACTORY_IO_CREDS_PSWPassword for accessing JFrog Artifactory repository.
NEXUS_IO_CREDS_USRUsername for accessing Sonatype Nexus repository.
NEXUS_IO_CREDS_PSWPassword for accessing Sonatype Nexus repository.
Set these variables if Jenkins runs on a non-local OpenShift instance, and the Rekor and TUF services are on different clusters.
REKOR_HOSTURL of your Rekor server.
TUF_MIRRORURL of your TUF service.
GitOps configuration for Jenkins
GITOPS_AUTH_PASSWORDThe token the system uses to update the GitOps repository for newly built images.
GITOPS_AUTH_USERNAME(optional)The parameter required for Jenkins to work with GitLab. You also need to uncomment a line with this parameter in a Jenkinsfile: GITOPS_AUTH_USERNAME = credentials('GITOPS_AUTH_USERNAME'). By default, this line is commented out.
Variable required for ACS tasks.
ROX_CENTRAL_ENDPOINTEndpoint for the ROX Central server.
ROX_API_TOKENAPI token for accessing the ROX server.
Variables required for SBOM tasks.
COSIGN_SECRET_PASSWORDPassword for Cosign signing key.
COSIGN_SECRET_KEYPrivate key for Cosign.
COSIGN_PUBLIC_KEYPublic key for Cosign.
TRUSTIFICATION_BOMBASTIC_API_URLURL for Trustification Bombastic API used in SBOM generation.
TRUSTIFICATION_OIDC_ISSUER_URLOIDC issuer URL used for authentication when interacting with the Trustification Bombastic API.
TRUSTIFICATION_OIDC_CLIENT_IDClient ID for authenticating to the Trustification Bombastic API using OIDC.
TRUSTIFICATION_OIDC_CLIENT_SECRETClient secret used alongside the client ID to authenticate to the Trustification Bombastic API.
TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSIONSpecifies the CycloneDX SBOM version that is supported and generated by the system.
Rerun the last pipeline run.
- Alternatively, switch to you application’s source repository in GitHub, make a minor change, and commit it to trigger a new pipeline run.
Additional resources
- If you selected Jenkins Continuous Integration (CI) when building your application, add your application to Jenkins.
