By default, run-time objects such as job steps and pipeline tasks run under the account used by the CloudBees CD/RO agent at install time. This approach works well in environments where it makes sense to run all jobs under a single user such as a build user. In this scenario, you install all agents to run as the designated user and every step of every job runs as that user.
Credentials
Credentials are used to access services and resources used during application deployments, release pipeline execution, or any other automated process orchestrated by CloudBees CD/RO.
When a run-time object is configured to run as a specific user other than that defined at install time, CloudBees CD/RO retrieves the user name and password from a stored credential. The credential is passed to the CloudBees CD/RO agent over an encrypted channel so the agent can authenticate itself to the operating system and set up a security context where the object runs with the user permissions in the credential.
-
For details about creating credentials, refer to Credential management.
-
Refer to Using credentials to enable them in your run-time objects.
Credential Types
Credentials are used for authentication and are classified as:
-
Impersonation
-
Attach Parameter
-
Attach
Impersonation
At runtime, an object may need to temporarily impersonate a different user. For example, as part of your pipeline you may need to run a task that generates a certificate using privileged corporate information; that task must run under a special high-privileged account, but you want the remainder of the steps in the build to use a less-privileged account.
CloudBees CD/RO allows you to select a credential on a per-task, per-job, or per-job-step basis that the CloudBees CD/RO agent uses to impersonate a particular user for the duration of run-time object.
To impersonate a credential in a procedure step:
-
From the CloudBees CD/RO main menu, navigate to and select a procedure.
-
On the procedure page, select Add procedure step to open the New procedure step dialog.
-
On the Credentials tab, select Add Credentials.
-
On the Add credential dialog, select the following details:
-
Credential type: Select credential type as Impersonation.
-
Project: Select the project that contains the credential. Use the search option to find your project by name.
-
Credential: Select a credential. Use the search option to find the credential by name.
-
-
Select Save credential.
For more information, refer to Impersonation.
Attach Parameter
In CloudBees CD/RO when configuring a procedure step, the Attach Parameter credential type allows the parameter to be passed at runtime.
To attach a credential parameter in a procedure step:
-
From the CloudBees CD/RO main menu, navigate to and select a procedure.
-
On the procedure page, select Add procedure step to open the New procedure step dialog.
-
On the Credentials tab, select Add Credentials.
-
On the Add credential dialog, select the following details:
-
Credential type: Select credential type as attach parameter.
-
Credential Parameter: Select the parameter that you want to pass during runtime. Use the search option to find the parameter.
-
-
Select Save credential.
Attach
In CloudBees CD/RO when configuring a procedure, step select the Attach credential type to link a pre-defined credential to the configuration.
To attach a credential in a procedure step:
-
From the CloudBees CD/RO main menu, navigate to and select a procedure.
-
On the procedure page, select Add procedure step to open the New procedure step dialog.
-
On the Credentials tab, select Add Credentials.
-
On the Add credential dialog, select the following details:
-
Credential type: Select credential type as attach.
-
Project: Select the project that contains the credential. Use the search option to find your project by name.
-
Credential: Select a credential. Use the search option to find the credential by name.
-
-
Select Save credential.