Fortanix Data Security Manager Jenkins Plugin Library

1.0 Introduction

Jenkins is a widely used Continuous Integration (CI) and Continuous Delivery (CD) tool. For many Jenkins projects, the server needs access to secrets, such as database passwords or SSH keys. However, Jenkins cannot adequately protect these secrets; therefore, they should be stored in Fortanix-Data-Security-Manager (DSM). A Jenkins plugin establishes a connection to Fortanix DSM and enables the retrieval of secrets from this platform.

This article describes the installation of Jenkins, the deployment of the Jenkins plugin, and a demonstration of the solution.

2.0 Prerequisites

This plugin has been tested on servers with the following specifications:

Operating System: Ubuntu 24.04 or later
RAM: 2GB
Hard Drive: 25GB
A good and stable internet connection is required.

3.0 Installation

This section describes the steps to begin installing Jenkins and then deploying the Jenkins plugin. These instructions for installation are sourced from Debian Jenkins Packages.

3.1 Install Jenkins

Perform the following steps:

curl -fsSL https://pkg.jenkins.io/debian-stable/jenkins.io-2023.key | sudo tee /usr/share/keyrings/jenkins-keyring.asc > /dev/null
echo deb [signed-by=/usr/share/keyrings/jenkins-keyring.asc] https://pkg.jenkins.io/debian-stable binary/ | sudo tee /etc/apt/sources.list.d/jenkins.list > /dev/null

Run the following command to update the Jenkins package list:
```
sudo apt-get update
```
Run the following command to install the required dependencies:
```
sudo apt-get install fontconfig openjdk-11-jre
```
Run the following command to install Jenkins:
```
sudo apt-get install jenkins
```
Run the following command to start Jenkins:
```
sudo systemctl start jenkins 
```
Enter the URL: http://<JENKINS_SERVER>:8080/ in a web browser.
Enter the password available in the /var/lib/jenkins/secrets/initialAdminPassword file in the Administration password field to unlock Jenkins.

For further configuration, refer to How to Install Jenkins on Ubuntu 20.04 | DigitalOcean documentation.

3.2 Download the HPI File

You must download the Hemera Photo-Object Image (HPI) file from https://github.com/fortanix/dsm-secrets-jenkins-plugin/releases to install the Jenkins plugin.

It is recommended to build the plugin with OpenJDK 11 on a 64-bit.

Run the following command to generate the binary:

mvn clean package

The output of this command is an hpi file.

3.3 Install Jenkins Plugin

Perform the following steps to deploy the Jenkins plugin within Jenkins:

Log in to Jenkins with valid credentials.
Navigate to Manage Jenkins → Manage Plugins.
Figure 1: Manage Jenkins
Figure 2: Manage plugins
Select the Advanced settings tab and click Browse… under the Deploy Plugin section to select the plugin. After selecting the plugin, click Deploy.
Figure 3: Browse button

4.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

4.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, https://eu.smartkey.io.

For detailed steps on how to set up the Fortanix DSM, refer to the User's Guide: Sign Up for Fortanix Data Security Manager SaaS documentation.

4.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

For more information on how to set up an account in Fortanix DSM, refer to the User's Guide: Getting Started with Fortanix Data Security Manager - UI.

4.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

In the DSM left navigation panel, click the Groups menu item, and then click the + button to create a new group.
Figure 5: Add groups
On the Adding new group page, do the following:
1. Title: Enter a name for your group.
2. Description (optional): Enter a short description of the group.
Click SAVE to create the new group.

The new group is added to the Fortanix DSM successfully.

4.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

In the DSM left navigation panel, click the Apps menu item, and then click the + button to create a new app.
Figure 6: Add application
On the Adding new app page, do the following:
1. App name: Enter the name for your application.
2. ADD DESCRIPTION (optional): Enter a short description of the application.
3. Authentication method: Select the default API Key as the authentication method from the drop down menu. For more information on these authentication methods, refer to the User's Guide: Authentication.
4. Assigning the new app to groups: Select the group created in Section 4.3: Creating a Group from the list.
Click SAVE to add the new application.

The new application is added to the Fortanix DSM successfully.

4.5 Copying the API Key

Perform the following steps to copy the API key from the Fortanix DSM:

In the DSM left navigation panel, click the Apps menu item, and then click the app created in Section 4.4: Creating an Application to go to the detailed view of the app.
On the INFO tab, click VIEW API KEY DETAILS.
From the API Key Details dialog box, copy the API Key of the app to use it while creating the Jenkins project.

4.6 Creating a Security Object

Perform the following steps to import a new exportable RSA key in the Fortanix DSM:

In the DSM left navigation panel, click the Security Objects menu item, and then click the + button to create a new security object.
Figure 7: Adding security object
On the Add new Security Object page, do the following:
1. Security Object name: Enter the name for your security object.
2. Group: Select the group as created in Section 4.3: Creating a Group.
3. Select the IMPORT radio button.
4. In the Choose a type section, select the RSA key type.
5. In the Place value here or import from file section, select the value format type as Hex, Base64, or Raw, and click UPLOAD A FILE to upload the key file.
6. In the Key operations permitted section, select the required operations to define the actions that can be performed with the cryptographic keys, such as encryption, decryption, signing, and verifying.
  NOTE
  Ensure that the Export permission is selected.
Click IMPORT to create the new security object.
Copy the name of the security object to later map it in the Jenkins project.

The new security object is added to the Fortanix DSM successfully.

5.0 Jenkins Plugin Demo

The following sections describe the steps to demonstrate the Jenkins plugin.

5.1 Create Jenkins Project

Perform the following steps:

Log in to the Jenkins user interface (UI).
From the left navigation panel, click + New Item to create a new Jenkins project.
Figure 8: New item button
In the new Jenkins project, from the left navigation panel, navigate to Configure → Source Code Management.
In the Build Environment section, select the Fortanix DSM Secrets check box.
To add a new Fortanix DSM credential, click Add and then select Jenkins from the drop down menu.
Figure 9: Add Jenkins
In the Jenkins Credentials Provider: Jenkins form, enter the following details to configure the credentials:
1. Domain: Enter the domain that this credential belongs to. By default, Global credentials (unrestricted) is selected.
2. Kind: Select the Fortanix DSM Client Credentials option from the drop down menu.
3. Scope: Defines where this credential will be used. By default, Global (Jenkins, node, items, all child items, etc) is selected.
4. API Endpoint: Enter the Fortanix DSM URL. For example, https://eu.smartkey.io.
5. API Key: Paste the API key copied in Section 4.5: Copying the API Key.
6. ID: Enter a unique ID for this credential. Some characters, such as spaces are not allowed in the ID field. If the ID field is not set, a UUID will be created by Jenkins instead.
7. Description: Enter a description for this credential.
Click Add.
Figure 10: Jenkins credential provider form
In the Secret section, enter the following:
1. Path: Define the path as the name of the security object in Fortanix DSM.
2. Environment Variable: The name of the environment variable, as available in Jenkins.
3. Click Add a secret to map the secret in Jenkins.
  Figure 11: Add a Secret
To demonstrate that the value of the secret is retrieved from Fortanix DSM, in the Build Steps section, click the Add build step and select the Execute shell option from the drop down menu.
Figure 12: Execute Shell
In the Execute shell form, enter the value of the environment variable defined above.
Click Save to complete the project configuration.
Figure 13: Save the Execute Shell
In the Jenkins project left navigation panel, click Build Now to initiate the build.
Figure 14: Build Now Button
The build result is shown at the bottom right corner. To view the build results, click any of the builds.
Figure 15: List of Builds
In the Build information, click Console Output.
Figure 16: Console Output
The password is displayed in the console output.
Figure 17: Password