devops-lib-gcp/docs/wiki/pages/concepts/secrets-and-auth.md

Generated 2026-05-21 at base-sha 5399a5ddc36b. Type: concept. 6 sources.

Secrets, SSH keys, and downstream auth

How the pipeline authenticates to every external system, in one place. Every entry below comes from a real withCredentials { ... } block or env var read in the current code.

Downstreams + auth mechanisms

Downstream	Credential / mechanism	Code site
GitHub clone/push (HTTPS)	env.GITHUB_CRED = 'svc-devops-meesho' (gitUsernamePassword)	gitActions.groovy:13, buildGo.groovy:300, buildNode.groovy:413
GitHub clone (SSH, private repos)	credentialsId: 'ssh-private-key' written to ./id_github_jenkins (0600)	addSSHKey.groovy:4-5
Vault (GCP secrets)	env.vaultToken string	buildNode.groovy:555, constructParam.groovy:170,175 (vault-prd.meeshogcp.in, vault-dev.meeshogcp.in)
JFrog (Maven deploy)	-DuseProdRepo=true / -DuseTestRepo=true Maven profile	onlyPushtoJfrog.groovy:43-47
GCP Docker registry	gcloud auth configure-docker (SDK ambient auth)	buildGo.groovy:126, buildNode.groovy:374
AWS ECR	aws ecr get-login-password ... | docker login --password-stdin	buildNode.groovy:371, buildPython.groovy:93, buildMaven.groovy:566, buildGradle.groovy:520, buildPhp.groovy:59
ArgoCD	env.argoCreds (usernamePassword); argocd login ${env.argoURL}:443	deployArgoCD.groovy:490, 522
npm registry	.npmrc from AWS Secrets Manager or Vault → written to workspace	buildNode.groovy:63-68, 337
SonarQube	env.sonarToken string; withSonarQubeEnv { ... } against sonarqube-prd	buildMaven.groovy:245-251, buildNode.groovy:406
Ringmaster	credentialsId: 'ringmaster-token' (usernamePassword)	deployRingmaster.groovy:115, notify.groovy:117

The SSH key write path

addSSHKey.groovy:3-7 writes the credential file inside withCredentials { ... }:

withCredentials([sshUserPrivateKey(credentialsId: 'ssh-private-key', keyFileVariable: 'FILE')]) {
    sh "cat ${FILE} > ./id_github_jenkins; chmod 600 ./id_github_jenkins; ..."
}

There is a race window between the cat write and the chmod — a co-resident process could read the file with default umask permissions for that brief interval. There is also no cleanup of ./id_github_jenkins after use. Both are flagged in BUGS_AND_IMPROVEMENTS_REPORT.md.

The key file is NOT cat'd to stdout / logs — earlier PR-review concerns (PR #634) about that pattern have been remediated; the current cat ${FILE} > ./id_github_jenkins is a file write, not a print. See review-learnings.md for the historical trail.

NEVER DO

• Never print or cat an SSH private key to stdout / logs. Always go through withCredentials + a 0600 file. (Graduated rule — see CLAUDE.md NEVER DO.)
• Never hard-code bare IPs as curl/HTTP targets. Use DNS hostnames. Known existing violation: securityScan.groovy:11 — final String url = '172.31.5.29:63232/scans'. Flagged for remediation; do not add new violations.
• Never pass passwords on the command line where they'll appear in ps. ArgoCD's login at deployArgoCD.groovy:494, 525 does pass --password ${ARGO_PASSWORD} on argv — also flagged.

Where the secrets actually live

System	Where the credential is provisioned
Jenkins credential store	svc-devops-meesho, ssh-private-key, argoCreds, ringmaster-token, sonarToken, vaultToken
Vault (vault-prd.meeshogcp.in / vault-dev.meeshogcp.in)	runtime service secrets, MEESHO_NPMRC_SECRET
AWS Secrets Manager	MEESHO_NPMRC_SECRET (alternate fetch path)
GCP IAM service accounts	Docker registry, GKE access — via ambient gcloud auth