XtraSecurity + Jenkins Integration

Secure your Jenkins pipelines with XtraSecurity.

Install Jenkins Credentials Plugin

1. Manage Jenkins → Manage Plugins
2. Search "Credentials plugin"
3. Install and restart Jenkins

Create Jenkins Credentials

1. Manage Jenkins → Manage Credentials
2. Click "Add Credentials"
3. Type: "Username with password"
4. Username: xtra-api-key
5. Password: sk_live_xxx
6. ID: xtrasecurity-api-key

Declarative Pipeline

pipeline {
  agent any
  
  environment {
    XTRA_KEY = credentials('xtrasecurity-api-key')
  }
  
  stages {
    stage('Get Secrets') {
      steps {
        sh '''
          npm install -g @xtrasecurity/cli
          xtra auth --username $XTRA_KEY_USR --password $XTRA_KEY_PSW
          export DATABASE_URL=$(xtra get database_url)
          export API_KEY=$(xtra get api_key)
          echo "Secrets loaded"
        '''
      }
    }
    
    stage('Deploy') {
      steps {
        sh 'npm run deploy'
      }
    }
  }
}

Scripted Pipeline

node {
  withCredentials([usernamePassword(credentialsId: 'xtrasecurity-api-key', 
                                     usernameVariable: 'XTRA_USER', 
                                     passwordVariable: 'XTRA_PASS')]) {
    stage('Build') {
      sh '''
        npm install -g @xtrasecurity/cli
        xtra auth --username $XTRA_USER --password $XTRA_PASS
        export DB_URL=$(xtra get db_url)
        npm run build
      '''
    }
    
    stage('Deploy') {
      sh 'npm run deploy'
    }
  }
}

Using Shared Library

Create vars/xtraSecrets.groovy:

def call(Map config, Closure body) {
  withCredentials([usernamePassword(credentialsId: 'xtrasecurity-api-key',
                                     usernameVariable: 'XTRA_USER',
                                     passwordVariable: 'XTRA_PASS')]) {
    sh '''
      npm install -g @xtrasecurity/cli
      xtra auth --username $XTRA_USER --password $XTRA_PASS
      xtra export --format env > .env.${BUILD_NUMBER}
    '''
    body()
  }
}

Use in pipeline:

xtraSecrets {
  stage('Deploy') {
    sh 'npm run deploy'
  }
}