1、添加nexus仓库

  1. #Add repository
  2. helm repo add sonatype https://sonatype.github.io/helm3-charts/

2、更改values.yaml文件

配置文件values.yaml中定义了所有我们需要的配置，我们可以自定义内容

  • 修改公共镜像为私有镜像 ```css image:

    Sonatype Official Public Image

    repository: sonatype/nexus3 tag: 3.33.1 pullPolicy: IfNotPresent

拉取公共镜像sonatype/nexus3:3.33.1 并推送到私有仓库，防止官方镜像变更，影响服务稳定

  2. - **修改服务访问ingress域名**
  3. ```css
  4. ......
  5. ingress:
  6.   enabled: true
  7.   annotations: {kubernetes.io/ingress.class: nginx}
  8.     # kubernetes.io/ingress.class: nginx
  9.     # kubernetes.io/tls-acme: "true"
  10.   hostPath: /
  11.   hostRepo: nexus.123.top
  12.   tls:
  13.     - secretName: nexus-123-tls
  14.       hosts:
  15.         - nexus.123.top
  16. ......
  • 数据持久化

在容器中运行的服务默认随着服务死亡，数据释放，而nexus 中存放着我们所需要的依赖jar包，不能随意丢失数据。
我这里使用的是阿里云上提供的storageClass，只需要申明需要的磁盘类型和大小即可。

  1. .......
  2. persistence:
  3.   enabled: true
  4.   accessMode: ReadWriteOnce
  5.   ## If defined, storageClass: <storageClass>
  6.   ## If set to "-", storageClass: "", which disables dynamic provisioning
  7.   ## If undefined (the default) or set to null, no storageClass spec is
  8.   ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
  9.   ##   GKE, AWS & OpenStack)
  10.   ##
  11.   # existingClaim:
  12.   # annotations:
  13.   #  "helm.sh/resource-policy": keep
  14.   storageClass: "alicloud-disk-essd"
  15.   storageSize: 100Gi
  16.   # If PersistentDisk already exists you can create a PV for it by including the 2 following keypairs.
  17.   # pdName: nexus-data-disk
  18.   # fsType: ext4
  19. ......
  • java垃圾回收器可用CPU内核数

在nexus 3.16.1 以后启动运行后会提示下面错误
image.png
java垃圾回收器会计算其用于各种操作 (例如GC和ForkJoinPool) 的线程池大小的CPU数量，我们可以根据提示在java运行环境变量（JAVA_OPTS）中添加 “-XX:ActiveProcessorCount=4”

  1. ...... 
  2. env:
  3.     - name: install4jAddVmParams
  4.       value: "-Xms1200M -Xmx1200M -XX:MaxDirectMemorySize=2G -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap -XX:ActiveProcessorCount=4"
  5.     - name: NEXUS_SECURITY_RANDOMPASSWORD
  6.       value: "true"
  7. ......

完整values.yaml文件如下：

  1. statefulset:
  2.   # This is not supported
  3.   enabled: false
  4. # By default deploymentStrategy is set to rollingUpdate with maxSurge of 25% and maxUnavailable of 25% . you can change type to `Recreate` or can uncomment `rollingUpdate` specification and adjust them to your usage.
  5. deploymentStrategy: Recreate
  6. image:
  7.   # Sonatype Official Public Image
  8.   repository: sonatype/nexus3
  9.   tag: 3.33.1
  10.   pullPolicy: IfNotPresent
  12. nexus:
  13.   docker:
  14.     enabled: false
  15.     registries: []
  16.     #  - host: chart.local
  17.     #    port: 5000
  18.     #    secretName: registrySecret
  19.   env:
  20.     - name: install4jAddVmParams
  21.       value: "-Xms1200M -Xmx1200M -XX:MaxDirectMemorySize=2G -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap"
  22.     - name: NEXUS_SECURITY_RANDOMPASSWORD
  23.       value: "true"
  24.   properties:
  25.     override: false
  26.     data:
  27.       nexus.scripts.allowCreation: true
  28.       # See this article for ldap configuratioon options https://support.sonatype.com/hc/en-us/articles/216597138-Setting-Advanced-LDAP-Connection-Properties-in-Nexus-Repository-Manager
  29.       #nexus.ldap.env.java.naming.security.authentication: simple
  30.   # nodeSelector:
  31.   #   cloud.google.com/gke-nodepool: default-pool
  32.   resources: {}
  33.     # requests:
  34.       ## Based on https://support.sonatype.com/hc/en-us/articles/115006448847#mem
  35.       ## and https://twitter.com/analytically/status/894592422382063616:
  36.       ##   Xms == Xmx
  37.       ##   Xmx <= 4G
  38.       ##   MaxDirectMemory >= 2G
  39.       ##   Xmx + MaxDirectMemory <= RAM * 2/3 (hence the request for 4800Mi)
  40.       ##   MaxRAMFraction=1 is not being set as it would allow the heap
  41.       ##     to use all the available memory.
  42.       # cpu: 250m
  43.       # memory: 4800Mi
  44.   # The ports should only be changed if the nexus image uses a different port
  45.   nexusPort: 8081
  47.   securityContext:
  48.     fsGroup: 2000
  49.   podAnnotations: {}
  50.   livenessProbe:
  51.     initialDelaySeconds: 30
  52.     periodSeconds: 30
  53.     failureThreshold: 6
  54.     timeoutSeconds: 10
  55.     path: /
  56.   readinessProbe:
  57.     initialDelaySeconds: 30
  58.     periodSeconds: 30
  59.     failureThreshold: 6
  60.     timeoutSeconds: 10
  61.     path: /
  62.   # hostAliases allows the modification of the hosts file inside a container
  63.   hostAliases: []
  64.   # - ip: "192.168.1.10"
  65.   #   hostnames:
  66.   #   - "example.com"
  67.   #   - "www.example.com"
  70. imagePullSecrets: []
  71. nameOverride: ""
  72. fullnameOverride: ""
  74. deployment:
  75.   # # Add annotations in deployment to enhance deployment configurations
  76.   annotations: {}
  77.   # # Add init containers. e.g. to be used to give specific permissions for nexus-data.
  78.   # # Add your own init container or uncomment and modify the given example.
  79.   initContainers:
  80.   # - name: fmp-volume-permission
  81.     # image: busybox
  82.     # imagePullPolicy: IfNotPresent
  83.     # command: ['chown','-R', '200', '/nexus-data']
  84.     # volumeMounts:
  85.       # - name: nexus-data
  86.         # mountPath: /nexus-data
  87.   # # Uncomment and modify this to run a command after starting the nexus container.
  88.   postStart:
  89.     command:    # '["/bin/sh", "-c", "ls"]'
  90.   preStart:
  91.     command:    # '["/bin/rm", "-f", "/path/to/lockfile"]'
  92.   terminationGracePeriodSeconds: 120
  93.   additionalContainers:
  94.   additionalVolumes:
  95.   additionalVolumeMounts:
  98. ingress:
  99.   enabled: true
  100.   annotations: {kubernetes.io/ingress.class: nginx}
  101.     # kubernetes.io/ingress.class: nginx
  102.     # kubernetes.io/tls-acme: "true"
  103.   hostPath: /
  104.   hostRepo: nexus.123.top
  105.   tls:
  106.     - secretName: nexus-123-tls
  107.       hosts:
  108.         - nexus.123.top
  112. service:
  113.   name: nexus3
  114.   enabled: true
  115.   labels: {}
  116.   annotations: {}
  117.   serviceType: ClusterIP
  120. route:
  121.   enabled: false
  122.   name: docker
  123.   portName: docker
  124.   labels:
  125.   annotations:
  126.   # path: /docker
  128. nexusProxyRoute:
  129.   enabled: false
  130.   labels:
  131.   annotations:
  132.   # path: /nexus
  134. persistence:
  135.   enabled: true
  136.   accessMode: ReadWriteOnce
  137.   ## If defined, storageClass: <storageClass>
  138.   ## If set to "-", storageClass: "", which disables dynamic provisioning
  139.   ## If undefined (the default) or set to null, no storageClass spec is
  140.   ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
  141.   ##   GKE, AWS & OpenStack)
  142.   ##
  143.   # existingClaim:
  144.   # annotations:
  145.   #  "helm.sh/resource-policy": keep
  146.   storageClass: "alicloud-disk-essd"
  147.   storageSize: 100Gi
  148.   # If PersistentDisk already exists you can create a PV for it by including the 2 following keypairs.
  149.   # pdName: nexus-data-disk
  150.   # fsType: ext4
  152. tolerations: []
  154. # # Enable configmap and add data in configmap
  155. config:
  156.   enabled: false
  157.   mountPath: /sonatype-nexus-conf
  158.   data: []
  160. # # To use an additional secret, set enable to true and add data
  161. secret:
  162.   enabled: false
  163.   mountPath: /etc/secret-volume
  164.   readOnly: true
  165.   data: []
  167. serviceAccount:
  168.   # Specifies whether a service account should be created
  169.   create: true
  170.   # Annotations to add to the service account
  171.   annotations: {}
  172.   # The name of the service account to use.
  173.   # If not set and create is true, a name is generated using the fullname template
  174.   name: ""
  176. psp:
  177.   create: false

3、安装

  1. #Install chart
  3. helm install nexus -f values.yaml sonatype/nexus-repository-manager --version 33.1.0 -n infra

3.1、登陆kubernetes控制台查看服务安装结果

image.png
从控制台中我们可以看到服务在运行中，而且我们设置的ingress访问域名也成功设置，接下来我们就可以去拿着端点IP解析这个域名了。

3.2、获取集群中nexus服务登陆密码

根据提示我们知道默认用户名为admin, 而密码存放于pod中/nexus-data/admin.password文件中。

  1. $ kubectl get pod -n infra
  2. NAME                                              READY   STATUS    RESTARTS   AGE
  3. ......
  4. nexus-nexus-repository-manager-679b5fcdc9-bjffh   1/1     Running   0          11m
  6. $ kubectl exec -it nexus-nexus-repository-manager-679b5fcdc9-bjffh -n infra /bin/bash
  7. kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
  9. bash-4.4$ cat /nexus-data/admin.password
  10. fd1f7941e1adca25b166 bash-4.4$

image.png

3.3、重新设置密码

image.png
成功获取原始密码后，接下来系统会提示我们重新设置新的密码。

3.4、禁用匿名用户访问

image.png
根据提示直接下一步，即可完成初始化过程。

4、更新配置

  1. helm upgrade --namespace infra -f values.yaml nexus sonatype/nexus-repository-manager --version 33.1.0

ref: https://artifacthub.io/packages/helm/sonatype/nexus-repository-manager/33.1.0
https://github.com/qinxi89/helm3-charts