This is what I originally developed pytest-variables for (https://pypi.org/project/pytest-variables/). Maybe you’ll find that useful, but it sounds like you already have a similar solution. For Jenkins, we use the credentials plugin to store the variables files, and then reference them from the jobs via environment variables. See https://github.com/mozilla/mozillians-tests/blob/master/Jenkinsfile#L40 and https://github.com/mozilla/mozillians-tests/blob/master/Jenkinsfile#L53 for an example of where we use this in a Jenkins declarative pipeline.

On 23 Sep 2018, at 19:47, Floris Bruynooghe <flub@devork.be> wrote:

Hi Derek,

On Sat 22 Sep 2018 at 09:19 -0700, Derek Sisson wrote:
I currently use a local yaml file, with passwords keyed to account ids,
along with a data model of users in the codebase keyed to the same IDs. My
conftest queries the yaml file with the ids to grab the passwords, and it's
set up to throw exceptions if there is anything out of sync between the
data model and the yaml file data.

Cumbersome, but works.... locally. I need to port the framework to Jenkins,
so I need a better and secure system.

Suggestions on better ways of managing passwords and secrets in a
pytest/jenkins context?

This isn't really a pytest question to be fair.  It's just that you
happen to stumble into secrets management via testing, which is
certainly one common way of discovering this rabbit hole.

The simple version which is still somewhat sub-optimal is pass the
secrets via environment variables or something, for Jenkins specifically
you should probably look at it's Credentials Binding plugin or so.

The full-blow solution is to use something like vaultproject.io to
manage secrets.  Obviously this is a fair amount of work but you'll get
good secrets management at the end.


Cheers,
Floris
_______________________________________________
pytest-dev mailing list
pytest-dev@python.org
https://mail.python.org/mailman/listinfo/pytest-dev