<p>I set credential globally in declarative pipeline like this and then my Jenkins could talk with Google Dataflow in all stages.  For example, I used a secret file (google service account). </p>

<pre>
<code>
pipeline {
    agent any
    environment {
        //Secret File ID was defined in Jenkins -> Credentials -> System -> Global credentials
        GOOGLE_APPLICATION_CREDENTIALS = credentials('mySecretFileId')

        GCP_PROJECT_NAME = 'myProject'
    }
   stages {
             stage('step 1') {
              steps {
                sh "gcloud auth activate-service-account --key-file ${env.GOOGLE_APPLICATION_CREDENTIALS}"
                sh "gcloud config set project ${env.GCP_PROJECT_NAME}"

                // access google dataflow
                sh "gcloud dataflow jobs list --status=active"
                // ....
              }
             }
             stage('stage 2') {
               steps {
                  // access google dataflow
                  sh "gcloud dataflow jobs list --status=active"
               }
             }
             //...
   }
}   

</code>
</pre>

CC BY-SA 4.0
2021-07-02T07:53:15.533Z
Best answer for this question.
Arockiasmy K
CC BY-SA 4.0
2019-03-05T20:58:30.790Z
2019-03-05T20:58:30.790Z
Qin Ma
<p>The credentials will only be visible within the block passed to <code>withCredentials</code>, not outside of that.  So, no, your credentials will not be visible to other stages.  To make your credentials visible to your entire Pipeline:</p>
<ul>
<li><p>If you are using Declarative Pipelines, you can put your credentials in an <code>environment{}</code> block at the top of your Pipeline, as documented in the <a href="https://www.jenkins.io/doc/book/pipeline/jenkinsfile/#handling-credentials" rel="nofollow noreferrer">official Jenkins handbook</a>:</p>
<pre><code>pipeline {
    agent {
        // Your agent here
    }
    environment {
        MY_ENVIRONMENT_VARIABLE = credentials('my-credentials-id')
    }
    stages {
        // Your stages here
    }
}
</code></pre>
</li>
<li><p>If you use Scripted Pipelines, you can wrap your entire job in <code>withCredentials</code>.  This is not possible with Declarative.</p>
</li>
</ul>

CC BY-SA 4.0
2023-05-05T21:04:25.107Z
Number 2 might have been correct at the time the answer was posted, but it absolutely is not correct at the time of this comment.
An `environment{}` block with the `credentials()` method provides an implicit global `withCredentials`
Ken Rachynski
CC BY-SA 4.0
2023-05-11T23:04:43.893Z
@KenRachynski I looked it up, and support for `credentials` in the `environment{}` block was added in April 2017, which is before I wrote this answer, but it seems to have been poorly documented at the time, especially compared to the `withCredentials` step which well predates Jenkins Pipelines.  I'm editing my answer to improve its accuracy.
jayhendren
CC BY-SA 4.0
2018-11-06T19:56:55.530Z
2023-05-11T23:11:23.237Z
2023-05-11T23:11:23.237Z
jayhendren
<p>In Jenkinsfile, I want to make an <code>ssh key</code> visible to all stages in the pipeline.</p>

<p>From the official document, I learned that:</p>

<ol>
<li><code>environment</code> directive is used to defy environment variables for used within Jenkinsfile</li>
<li>The scope of the variables defined depends on the placement of the <code>environment</code> directive</li>
<li>One can set the <strong>some types of credentials</strong> inside<code>environment</code> directive with the help of the <code>credentials</code> helper</li>
<li>The types of credentials supported by the helper are:

<ul>
<li>Secret text</li>
<li>Usernames and passwords</li>
<li>Secret files</li>
</ul></li>
</ol>

<p>For other types of credentials, the document suggests using the <code>snippet generator</code>, which generates a step.</p>

<p>Example of an ssh key step</p>

<pre><code>withCredentials([sshUserPrivateKey(credentialsId: 'jenkins_aws_to_bitbucket', keyFileVariable: 'BITBUCKET_PRV_KEY')]) {
    // some block
}
</code></pre>

<p>This is meant to be used in a <em>stage</em> like:</p>

<pre><code>pipeline {
    agent {
        // define agent details
    }
    stages {
        stage('Example stage 1') {
            steps {
                withCredentials(bindings: [sshUserPrivateKey(credentialsId: 'jenkins-ssh-key-for-abc', \
                                                             keyFileVariable: 'SSH_KEY_FOR_ABC')]) {
                  // 
                }
                withCredentials(bindings: [certificate(credentialsId: 'jenkins-certificate-for-xyz', \
                                                       keystoreVariable: 'CERTIFICATE_FOR_XYZ', \
                                                       passwordVariable: 'XYZ-CERTIFICATE-PASSWORD')]) {
                  // 
                }
            }
        }
        stage('Example stage 2') {
            steps {
                // 
            }
        }
    }
}
</code></pre>

<p><a href="https://jenkins.io/doc/book/pipeline/jenkinsfile/" rel="noreferrer"><em>Snippet source</em></a></p>

<p><strong>Question</strong></p>

<ol>
<li>If the steps are within a <em>stage</em>, are these credentials visible within other stages? </li>
<li>If not, how to make these credentials <em>global</em> ~ visible within all stages</li>
</ol>

<jenkins><jenkinsfile>
How to make Jenkinsfile credential visible to many stages
Tran Triet
# How to make Jenkinsfile credential visible to many stages

(Asked by: username_0 on 2018-10-30)

In Jenkinsfile, I want to make an ssh key visible to all stages in the pipeline.
From the official document, I learned that:

environment directive is used to defy environment variables for used within Jenkinsfile
The scope of the variables defined depends on the placement of the environment directive
One can set the some types of credentials insideenvironment directive with the help of the credentials helper
The types of credentials supported by the helper are:


Secret text
Usernames and passwords
Secret files


For other types of credentials, the document suggests using the snippet generator, which generates a step.
Example of an ssh key step
withCredentials([sshUserPrivateKey(credentialsId: 'jenkins_aws_to_bitbucket', keyFileVariable: 'BITBUCKET_PRV_KEY')]) {
    // some block
}

This is meant to be used in a stage like:
pipeline {
    agent {
        // define agent details
    }
    stages {
        stage('Example stage 1') {
            steps {
                withCredentials(bindings: [sshUserPrivateKey(credentialsId: 'jenkins-ssh-key-for-abc', \
                                                             keyFileVariable: 'SSH_KEY_FOR_ABC')]) {
                  // 
                }
                withCredentials(bindings: [certificate(credentialsId: 'jenkins-certificate-for-xyz', \
                                                       keystoreVariable: 'CERTIFICATE_FOR_XYZ', \
                                                       passwordVariable: 'XYZ-CERTIFICATE-PASSWORD')]) {
                  // 
                }
            }
        }
        stage('Example stage 2') {
            steps {
                // 
            }
        }
    }
}

Snippet source
Question

If the steps are within a stage, are these credentials visible within other stages? 
If not, how to make these credentials global ~ visible within all stages

**Tags:** jenkins, jenkinsfile


---

## 2 answers

### Answer by username_3 on 2018-11-06. Score: 8 | Accepted answer

The credentials will only be visible within the block passed to withCredentials, not outside of that.  So, no, your credentials will not be visible to other stages.  To make your credentials visible to your entire Pipeline:

If you are using Declarative Pipelines, you can put your credentials in an environment{} block at the top of your Pipeline, as documented in the official Jenkins handbook:
pipeline {
    agent {
        // Your agent here
    }
    environment {
        MY_ENVIRONMENT_VARIABLE = credentials('my-credentials-id')
    }
    stages {
        // Your stages here
    }
}


If you use Scripted Pipelines, you can wrap your entire job in withCredentials.  This is not possible with Declarative.

> **Comments:**
> **username_4**: Number 2 might have been correct at the time the answer was posted, but it absolutely is not correct at the time of this comment. An `environment{}` block with the `credentials()` method provides an implicit global `withCredentials`  
> **username_3**: @KenRachynski I looked it up, and support for `credentials` in the `environment{}` block was added in April 2017, which is before I wrote this answer, but it seems to have been poorly documented at the time, especially compared to the `withCredentials` step which well predates Jenkins Pipelines.  I'm editing my answer to improve its accuracy.  

---

### Answer by username_1 on 2019-03-05. Score: 4

I set credential globally in declarative pipeline like this and then my Jenkins could talk with Google Dataflow in all stages.  For example, I used a secret file (google service account). 


pipeline {
    agent any
    environment {
        //Secret File ID was defined in Jenkins -> Credentials -> System -> Global credentials
        GOOGLE_APPLICATION_CREDENTIALS = credentials('mySecretFileId')

        GCP_PROJECT_NAME = 'myProject'
    }
   stages {
             stage('step 1') {
              steps {
                sh "gcloud auth activate-service-account --key-file ${env.GOOGLE_APPLICATION_CREDENTIALS}"
                sh "gcloud config set project ${env.GCP_PROJECT_NAME}"

                // access google dataflow
                sh "gcloud dataflow jobs list --status=active"
                // ....
              }
             }
             stage('stage 2') {
               steps {
                  // access google dataflow
                  sh "gcloud dataflow jobs list --status=active"
               }
             }
             //...
   }
}

> **Comments:**
> **username_2**: Best answer for this question.  

---

