Hashicorp Vault Pipeline Plugin

Enables the use of vault from within a pipeline.

Development

All build and test commands run inside Docker — no local Maven/JDK required.

make build    # build the test image (Jenkins 2.555.1 + JDK 21)
make test     # run the JUnit 5 test suite inside the image
make plugin   # produce target/hashicorp-vault-pipeline.hpi
make clean    # remove target/

The image caches Maven dependencies in its layer; the test run mounts ~/.m2 so subsequent runs skip downloads. Override the image tag or Maven cache location via env:

make build IMAGE=my-vault-test:dev
make test  M2=/tmp/m2

Integration smoke test (Jenkins + real Vault)

After make plugin, bring up Jenkins + HashiCorp Vault:

docker compose up --build

• Vault dev server: http://localhost:8200 (root token: root)
• Jenkins: http://localhost:8080 (admin / admin)
• Job vault-smoke-test is auto-created; it exercises vault() in environment{}, inline script{}, and withEnv macro expansion against a live Vault seeded with KV v1 and KV v2 secrets.

Dependencies

• hashicorp-vault-plugin
• credentials-plugin

Examples

Using global vault configuration

pipeline {
    agent any
    environment {
        SECRET = vault path: 'secrets', key: 'username'
    }
    stages {
        stage("read vault key") {
            steps {
                echo "${SECRET}"
            }
        }
    }
}

Using pipeline specific configuration

pipeline {
    agent any
    environment {
        SECRET = vault path: 'secrets', key: 'username', vaultUrl: 'https://my-vault.com:8200', credentialsId: 'my-creds', engineVersion: "2"
    }
    stages {
        stage("read vault key") {
            steps {
                echo "${SECRET}"
            }
        }
    }
}

Masking secrets in console output

By default, the plugin does not hide any accidental printing of secret to console. This becomes an issue because set -x is set by default in pipeline, so each command with the secrets being passed in will be printed.

Masked Password Plugin is Required

pipeline {
    agent any
    environment {
        SECRET1    = vault path: 'secrets', key: 'password1', vaultUrl: 'https://my-vault.com:8200', credentialsId: 'my-creds', engineVersion: "2"
        SECRET2    = vault path: 'secrets', key: 'password2', vaultUrl: 'https://my-vault.com:8200', credentialsId: 'my-creds', engineVersion: "2"
        NOT_SECRET = vault path: 'secrets', key: 'username', vaultUrl: 'https://my-vault.com:8200', credentialsId: 'my-creds', engineVersion: "2"
    }
    stages {
        stage("read vault key") {
            steps {
              wrap([$class: 'MaskPasswordsBuildWrapper', varPasswordPairs: [[password: env['SECRET1'], var: 'SECRET'], [password: env['SECRET2'], var: 'SECRET']]]) {
                echo "These secrets will be masked: ${SECRET1} and ${SECRET2}"
                echo "This secret will be printed in clear text: ${NOT_SECRET}"
              }
            }
        }
    }
}