18

I am trying to migrate the credentials from one Jenkins to another but usernames/passwords are hashed in ${JENKINS_HOME}/credentials.xml

I found this answer, but the problem is it doesn't explain where would someone find the encryption key in order to successfully migrate credentials.

Any help is greatly appreciated!

EDIT: More information.. my ${JENKINS_HOME} is on a separate volume which I detach and re-attach onto the new VM, and it still doesn't work with me.

2 Answers 2

36

I found this analysis (link is dead as of June 2020, archived here) very helpful. In a nutshell:

Jenkins uses the master.key to encrypt the key hudson.util.Secret. This key is then used to encrypt the password in credentials.xml.

When I need to bootstrap new Jenkins instances with some default passwords, I use a template directory tree that contains

  • secrets/hudson.util.Secret and
  • secrets/master.key

This works fine.

5
  • I also had to template com.cloudbees.plugins.credentials.SecretBytes.KEY to make the things work.
    – Misko
    Commented Jan 8, 2021 at 10:53
  • What's the importance of secret.key and secret.not-so-secret key ? @Alex O Commented Dec 21, 2021 at 8:17
  • 1
    @Kishor U, as far as I can see, secret.key.not-so-secret does not contain a key -- it's a boolean indicator file that's used to fix a security issue
    – Alex O
    Commented Dec 21, 2021 at 9:11
  • Yeah, true. But even though I didn't copy my secret.key, I was able to copy my credentials from one machine to the other. Commented Dec 21, 2021 at 10:57
  • 1
    @Kishor U, the key in secret.key is deprecated since 2013, so its content probably won't matter any more these days.
    – Alex O
    Commented Dec 21, 2021 at 11:36
11

Regarding JENKINS migration, I recently experienced this situation and after few testings, my workaround worked for me.

Here is what I did:

  1. I moved below files and folders from Source Jenkins to target:

    • $JENKINS_HOME/secret.key
    • $JENKINS_HOME/secrets
    • $JENKINS-HOME/users
    • $JENKINS_HOME/credentials.xml
  2. Please note: These files are not required to move:

    • $JENKINS_HOME/identity.key.enc
    • $JENKINS_HOME/secrets/org.jenkinsci.main.modules.instance_identity.InstanceIdentity.KEY

otherwise you will see below error after starting Jenkins:

java.lang.AssertionError: InstanceIdentity is missing its singleton
  1. Jenkins will automatically generate those two files. Once started, you should be good.
2
  • what's about the secrets/master.key file?
    – BMW
    Commented Aug 17, 2020 at 23:42
  • master.key is not required to migrate. It will be used of newer instance. Commented Nov 24, 2021 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.