Security: deny token retrieval about jenkins-client-plugin HOT 8 CLOSED

you can also use "sh 'oc whoami -t'", this isn't something the plugin can protect you from.

from jenkins-client-plugin.

Well the token is not stored in the .kube/config by the plugin, but explicitly provided by --roken=xxx or is it ?
Assuming the Jenkins OS user has no valid token (which it should), then I am pretty save

from jenkins-client-plugin.

The jenkins container has an openshift service account associated with it. That is the token you are seeing when you run oc whoami -t (unless you have setup other credentials).

The assumption is anyone who has permission to create/edit jobs on your jenkins server, already has meaningful permissions within your cluster. (after all, even if they can't get the token, you've allowed them to run oc operations with the token, that's the entire role of the openshift client plugin).

from jenkins-client-plugin.

Another candidate is

openshift.raw("oc config view")

At least the known tokens should scrabled. Right now it is printed in plain text

from jenkins-client-plugin.

again, no different from sh 'oc config view'.

from jenkins-client-plugin.

Ok. So if this is intended "by design" it should be properly documented (e.g. global credentials at the cluster level, meaning everyone peforming git commits in any repo built ona Jenkins Server can steal jenkins credentials). It is avious, but more on a "second thought" :)

from jenkins-client-plugin.

meaning everyone peforming git commits in any repo built ona Jenkins Server can steal jenkins credentials

it does not mean that. that is only the case if those users have permission to view your jenkins job logs and your jenkins job for some reason runs commands that print out the token.

Neither of those are prerequisites to having a CI system that builds/tests git commits by random users.

from jenkins-client-plugin.

(and nothing about this is unique to the jenkins client plugin or even jenkins on openshift. If you have a jenkins job that runs "cat /root/.ssh/id_rsa" you're in the same boat. don't do that, if you do do it, restrict who can see the job log, and don't let untrusted users create/edit jenkins jobs).

from jenkins-client-plugin.