Vault with Jenkins

Run your deployment through gops vault run so Vault injects secrets only into the deploy command.

Configure the pipeline

Add GOPS_API_KEY as a protected secret in Jenkins, and set GOPS_PROJECT_ID as a protected variable. The API key must have permission to export Vault secrets for that project.

Deploy with Vault

Add this to Jenkinsfile. Change --path, --env, and npm run deploy to match your application.

pipeline {
  agent { docker { image 'node:20' } }
  stages {
    stage('Deploy') {
      steps {
        withCredentials([string(credentialsId: 'gops-api-key', variable: 'GOPS_API_KEY')]) {
          sh '''
            npm install --global @getgitops/cli
            npm ci
            gops vault run --api-url https://cloud.getgitops.com/api --api-key "$GOPS_API_KEY" --project-id "$GOPS_PROJECT_ID" --path / --env production -- npm run deploy
          '''
        }
      }
    }
  }
}

The command fetches secrets from Vault, makes them available only for the deploy process, and does not write an environment file to the repository or CI workspace.

See the official Jenkins documentation for its secret and variable configuration.