Issue
When using CloudBees CI, if a credential exists on both the controller and the operations center with the same ID, the expected resolution behavior may be inconsistent depending on the credential provider/store.
-
If both are created in the Jenkins-internal credentials store, the controller credential overrides the operations center’s.
-
However, if the operations center’s credentials is in the Jenkins-internal credential store, but the controller’s is in a CloudBees Hashicorp Vault credentials store, then the operations center’s credential unexpectedly overrides the controller’s credential.
It is expected that the local controller credential, regardless of its store (Hashicorp Vault or Jenkins-internal), should take precedence over the operations center’s credential.
Resolution
Currently, there is no official resolution. This behavior has been identified as a product defect and is being investigated by the Engineering team. Please check the release notes for future updates regarding a fixed version or patch.
Workaround
To prevent this credential override conflict, ensure that any Hashicorp Vault credential created on a controller uses a unique ID that is not already in use by any other credential on the operations center.
If the credential is required on the controller, you can either:
-
Delete the credential from the operations center and create the Hashicorp Vault credentials on all controllers with the same ID.
-
Rename the Hashicorp Vault credential on the controllers to use a unique ID.