The existing implementation of ConfidentialStore in Jenkins relies on a secret key that is stored inside JENKINS_HOME/secrets/master.key which is used for encrypting the keys used to encrypt various other secrets. This key file is really only required during startup as the key is loaded into memory and used for unlocking the confidential store which allows for encrypting and decrypting data elsewhere in Jenkins.
This can potentially be improved in a couple ways:
- Add a CLI option or environment variable to specify the location of the master key file. This would make it simpler to locate it on removable file system or secret mount.
- Provide an unlock prompt similar to the admin password for uploading or specifying the master key on startup if there is no master key available to decrypt the confidential store.
Originally reported by 
jvz, imported from: Remove need to store master key in filesystem
- assignee:
vlatombe
- status: Closed
- priority: Minor
- component(s): core
- resolution: Fixed
- resolved: 2025-02-11T17:19:00+00:00
- votes: 2
- watchers: 6
- imported: 2025-11-24
Raw content of original issue
The existing implementation of ConfidentialStore in Jenkins relies on a secret key that is stored inside JENKINS_HOME/secrets/master.key which is used for encrypting the keys used to encrypt various other secrets. This key file is really only required during startup as the key is loaded into memory and used for unlocking the confidential store which allows for encrypting and decrypting data elsewhere in Jenkins.
This can potentially be improved in a couple ways:
- Add a CLI option or environment variable to specify the location of the master key file. This would make it simpler to locate it on removable file system or secret mount.
- Provide an unlock prompt similar to the admin password for uploading or specifying the master key on startup if there is no master key available to decrypt the confidential store.
The existing implementation of ConfidentialStore in Jenkins relies on a secret key that is stored inside JENKINS_HOME/secrets/master.key which is used for encrypting the keys used to encrypt various other secrets. This key file is really only required during startup as the key is loaded into memory and used for unlocking the confidential store which allows for encrypting and decrypting data elsewhere in Jenkins.
This can potentially be improved in a couple ways:
Originally reported by
jvz, imported from: Remove need to store master key in filesystem
Raw content of original issue