Kubernetes (Openshift) secret in a Jenkins slave

Recently I created data - science model training and upload CI/CD pipeline in OpenShift.
I had next idea:

• Data-scientist creates new model and uploads it in a repository.
• A repository triggers web-hook and notifies OpenShift about pushed / merged commit. Jenkins starts an execution of commands described in Jenkinsfile.
• Jenkinsfile in my case contains list of commands to create a container, train a model there, test it, wrap it and then synchronize it  with a responsible Jenkins slave (slave started the process). Then slave uploads an artifact in to a system. 

The only problem I met implementing this solution was injecting certificates into a Jenkins slave.
I tried different ideas - mounting secrets as volumes to a shared folder in Jenkins master, using Kubernetes plugin form for attaching secrets... - I didn't get any result.

Help, I received from my colleague Michael, solution is quite simple, but not easy to found.

1. Create a special type of 'ssh-auth' of secret in OpenShit. A template is below:

   
           apiVersion: v1
           data:
             ssh-privatekey: >-
               ...
           kind: Secret
           metadata:
             creationTimestamp: 
             labels:
              credential.sync.jenkins.openshift.io: 'true'
             name: ...
             namespace: ....
           type: kubernetes.io/ssh-auth
   

2. Check Jenkins -> Credentials - your secret should be visible there by name will be slightly modified
   
3. In your Jenkins file use special systaxis to get data from secret:

   
   withCredentials([
              sshUserPrivateKey(
                 credentialsId: 'ns-client-cert',
                 keyFileVariable: 'cert'
              ),
              sshUserPrivateKey(
                 credentialsId: 'ns-client-pem',
                 keyFileVariable: 'pem'
              )
           ])
           {
               sh "python some_script.py --cert=\${cert} --pem=\${pem}"
           }
   

4. Any output in Jenkins log of secured data will be modified to "****".