How to hide parameters such as APIKey from Jenkins pipeline console output - linux

Question

How can I hide certain parameters or **** them when I execute scripts inside stage.
The command that is producing the output which I want to hide is:
sh "./wsagent_execute.sh -s -apiKey ${WHITESOURCE_API_KEY} -projectToken ${WHITESOURCE_PROJECT_TOKEN} -C ${configPath} -d ${directoryPath} -logLevel info"
The parameters I want to hide are -apiKey and -projectToken. How can I do it?

Answer 1

If you get your credentials from a vault, you can use Mask Passwords plugin. It does not state that it supports Pipelines but actually it does.
pipeline {
agent any
stages {
stage('doing something') {
steps {
script {
def current_nano = "1616407597607795668"
sh label: "Now you see it", script: "echo ${current_nano}"
maskPasswords(varPasswordPairs: [[password: current_nano, var: 'IGNORE']]) {
sh label: "Now you don't", script: "echo ${current_nano}"
}
}
}
}
}
}
Output:
[Pipeline] Start of Pipeline
[Pipeline] node
Running on Jenkins in /var/jenkins_home/workspace/
[Pipeline] {
[Pipeline] stage
[Pipeline] { (doing something)
[Pipeline] script
[Pipeline] {
[Pipeline] sh (Now you see it)
+ echo 1616407597607795668
1616407597607795668
[Pipeline] maskPasswords
[Pipeline] {
[Pipeline] sh (Now you don't)
+ echo ********
********
[Pipeline] }
[Pipeline] // maskPasswords
[Pipeline] }
[Pipeline] // script
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
Finished: SUCCESS

Answer 2

Are these keys calculated in the pipeline or are they statics?
You can try to use it like credentials in Jenkins and you don't see their values in the log.

Answer 3

If you use a secret define in Jenkins credential, Jenkins will automatically mask that for you and in the log, it will show as ****
let's say you have defined your apiKey in jenkins credential with Id: apikey. Than you can use that on your pipeline like below example.
more details can be found here
node() {
withCredentials([string(credentialsId: 'apikey', variable: 'TOKEN')]) {
sh "./wsagent_execute.sh -s -apiKey $TOKEN -projectToken ${WHITESOURCE_PROJECT_TOKEN} -C ${configPath} -d ${directoryPath} -logLevel info"
}
}
If you are not happy with that use mask password or something similar plugins