Skip to content
Integrations
CI/CD & DevOps
Jenkins

Jenkins

Overview

This page covers how to check out Britive profiles from within Jenkins pipelines so that build nodes receive short-lived cloud credentials at runtime instead of storing long-lived secrets as Jenkins credentials.

Jenkins supports two integration approaches and an optional shared library for reuse across pipelines:

MethodWhen to Use
Britive CLI (PyBritive) in sh stepScripted or declarative pipelines with shell access
REST API via httpRequestWhen using the HTTP Request plugin or a Groovy HTTP client — see the Britive API documentation
Shared Library stepWhen standardizing credential checkout across many pipelines in the same Jenkins instance

Prerequisites

RequirementDetails
Britive service identityCreate a service identity in the Britive console; generate a token
Britive profileProfile must be active, have an expiration set, and have a policy granting the service identity access
Jenkins credentials storeStore BRITIVE_API_TOKEN as a Jenkins secret text credential; store BRITIVE_TENANT as a plain text credential or environment variable
Britive CLI (if using CLI method)Install PyBritive on the Jenkins agent, or add an install step to the pipeline

Environment Variables

VariableRequiredWhere to SetDescription
BRITIVE_API_TOKENYesJenkins secret text credential (referenced with credentials())Service identity token — PyBritive reads this automatically
BRITIVE_TENANTYesJenkins credential or environment blockBritive tenant subdomain (see Finding Your Tenant Name)
BRITIVE_PROFILENoenvironment block or parameterProfile to check out, as Application/Environment/Profile

CLI Usage

Declarative Pipeline

Jenkinsfile
pipeline {
  agent any
  environment {
    BRITIVE_API_TOKEN = credentials('britive-token')
    BRITIVE_TENANT    = 'company'   // tenant name from https://company.britive-app.com
  }
  stages {
    stage('Deploy with Britive JIT credentials') {
      steps {
        sh '''
          pip install pybritive==2.3.2
          eval "$(pybritive checkout "AWS Production/Prod Account/ci-deploy" -m env-nix)"
          aws sts get-caller-identity
        '''
      }
    }
  }
}

Scripted Pipeline

Jenkinsfile
node {
  withCredentials([string(credentialsId: 'britive-token', variable: 'BRITIVE_API_TOKEN')]) {
    sh '''
      eval "$(pybritive checkout "AWS Production/Prod Account/ci-deploy" -m env-nix)"
      aws sts get-caller-identity
    '''
  }
}

pybritive checkout Flags

FlagRequiredDefaultDescription
PROFILE (argument)Yes—Profile as application name/environment name/profile name
-m, --modeNotextOutput mode: env-nix (shell exports), json, integrate (write AWS credentials file), awscredentialprocess, gcloudauth, azlogin, and more
-j, --justificationNo—Justification string if the profile policy requires one
-b, --blocktimeNo3 / 60Seconds to wait before polling for credentials (60 for approval-gated profiles)
-a, --aliasNo—Save an alias for shorter future checkouts
--ticket-type / --ticket-idNo—ITSM ticket details if the profile requires a ticket

Jenkins sh steps run in separate subprocesses. Variables exported in one sh step are not available in the next — run the eval and the commands that use the credentials inside the same sh block.

REST API Usage

Use the Jenkins HTTP Request plugin or a Groovy HttpURLConnection to call the Britive REST API directly from a pipeline script. Authenticate with the service identity token in the Authorization: TOKEN <token> header. See the Britive API documentation for endpoint details.

Shared Library Integration

If many pipelines in the same Jenkins instance check out Britive profiles, wrap the install + checkout pattern in a shared library step so each pipeline needs a single line:

vars/britiveCheckout.groovy
def call(String profile, String body) {
  sh """
    pip install --quiet pybritive==2.3.2
    eval "\$(pybritive checkout "${profile}" -m env-nix)"
    ${body}
  """
}
Jenkinsfile
@Library('britive-shared-lib') _
britiveCheckout('AWS Production/Prod Account/ci-deploy', 'aws sts get-caller-identity')

Credential Injection

CloudCredential Variables Injected
AWSAWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN
GCPGOOGLE_APPLICATION_CREDENTIALS
AzureAZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID
SnowflakeSNOWFLAKE_USER, SNOWFLAKE_PASSWORD, SNOWFLAKE_ACCOUNT

Security Considerations

PracticeWhy It Matters
Use credentials() binding, not env variablesJenkins masks credentials-bound values in logs automatically
Do not print environment variables in sh stepsEven masked credentials can be exposed if the full environment is echoed
Run checkout on the agent, not the controllerKeeps credentials off the Jenkins controller node
Don’t write credentials to files on the agentKeep them in the sh block’s environment; if a file is unavoidable, delete it in a post { always } block

Related

Last updated on