The jenkins-sync-plugin [1] seems to have support for creating credentials from correctly labelled secrets in OpenShift.

changes to OpenShift Secrets with the label "credential.sync.jenkins.openshift.io" set to "true" will result in those Secrets getting converted into Jenkins Credentials that are registered with the Jenkins Credentials Plugin.

Needs a small about investigation into how this works in practice, but looks likely this will be the approach to take.

[1] https://github.com/openshift/jenkins-sync-plugin/#openshift-jenkins-sync-plugin