{"id":79854,"date":"2026-11-12T10:01:32","date_gmt":"2026-11-12T10:01:32","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=79854"},"modified":"2026-11-12T10:01:36","modified_gmt":"2026-11-12T10:01:36","slug":"deploying-nexus-certificate-manager-cm-and-protocol-gateway-pgwy-on-kubernetes","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/deploying-nexus-certificate-manager-cm-and-protocol-gateway-pgwy-on-kubernetes\/","title":{"rendered":"Deploying Nexus Certificate Manager (CM) and Protocol Gateway (PGWY) on Kubernetes"},"content":{"rendered":"\n

Step-by-step tutorial, written from an actual deployment of Certificate Manager 8.15.1-1<\/strong> (CF server image 8.15.1-1<\/code>, PGW image 8.15.1-1<\/code>) on a 2-node kubeadm cluster.<\/p>\n\n\n\n

\n

Status of this document (2026-11-12)<\/strong> Steps 1-8 were executed and verified. Step 9 (license) is pending<\/strong>: CF will not start without a Nexus-issued *.license<\/code> file, and none was available. Step 9 now contains the full procedure to obtain and apply it. Steps 10-12 (verification, bootstrap, protocol enablement) cannot be completed until then and are written from the chart contents and vendor guidance, not from a tested run. They are marked (untested)<\/strong>. See the Completion checklist<\/em> near the end for what is done and what remains.<\/p>\n<\/blockquote>\n\n\n\n

\n\n\n\n

0. Environment used<\/h2>\n\n\n\n
Item<\/th>Value<\/th><\/tr><\/thead>
Kubernetes<\/td>v1.35.10 (kubeadm), containerd 2.2.1, Calico v3.31<\/td><\/tr>
Nodes<\/td>1 control-plane (16.4.37.44<\/code>), 1 worker (13.204.63.105<\/code>), Ubuntu 24.04, 2 vCPU \/ 8 GB each<\/td><\/tr>
Access<\/td>SSH as ubuntu<\/code> with sudo; kubeconfig at \/etc\/kubernetes\/admin.conf<\/code> (root only)<\/td><\/tr>
Namespace<\/td>nexus<\/code> (CM, PGWY and the database share it)<\/td><\/tr>
Package<\/td>certificate-manager-8.15.1-1.zip<\/code> from the Nexus Support Portal<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Package contents that matter:<\/p>\n\n\n

certificate-manager-8.15<\/span>.1<\/span>-1<\/span>\/\n  images\/cf-server-image-8.15<\/span>.1<\/span>-1.<\/span>tar      # Certificate Factory (CM server) image<\/span>\n  images\/pgw-image-8.15<\/span>.1<\/span>-1.<\/span>tar            # Protocol Gateway image<\/span>\n  deployment\/helm\/cf-8.15<\/span>.1<\/span>-SNAPSHOT-1.<\/span>tgz           # base chart<\/span>\n  deployment\/helm\/cf-example-8.15<\/span>.1<\/span>-SNAPSHOT-1.<\/span>tgz   # configurable parent chart (use this for CM)<\/span>\n  deployment\/helm\/pgw-8.15<\/span>.1<\/span>-SNAPSHOT-1.<\/span>tgz          # base chart<\/span>\n  deployment\/helm\/pgw-example-8.15<\/span>.1<\/span>-SNAPSHOT-1.<\/span>tgz  # configurable parent chart (use this for PGWY)<\/span>\n  install\/PostgreSQL\/{create_db_and_role.sql,create_cmdb.sql,add_bootca.sql}\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n
Run kubectl\/helm on the control-plane node as root (sudo -i<\/code>) or prefix with sudo<\/code>, and export KUBECONFIG=\/etc\/kubernetes\/admin.conf<\/code>.<\/p>\n<\/blockquote>\n\n\n\n
\n\n\n\n
1. Prerequisites checklist<\/h2>\n\n\n\n
    \n
  1. A working cluster:\u00a0kubectl get nodes<\/code>\u00a0shows all nodes\u00a0Ready<\/code>.<\/li>\n\n\n\n
  2. A ReadWriteMany (RWX) StorageClass.<\/strong>\u00a0CF’s shared volumes are RWX. A cluster with only\u00a0local-path<\/code>\u00a0is not enough (see step 3).<\/li>\n\n\n\n
  3. A PostgreSQL database<\/strong>\u00a0reachable from the cluster (step 4).<\/li>\n\n\n\n
  4. Container images available to every node<\/strong>\u00a0(step 5). The images are not public.<\/li>\n\n\n\n
  5. A CM license file<\/strong>\u00a0(*.license<\/code>) from Nexus (step 9).<\/li>\n\n\n\n
  6. Helm 3.6.2+ (step 2).<\/li>\n\n\n\n
  7. Working pod-to-pod networking between nodes<\/strong>\u00a0(see Troubleshooting #1). Check it now:# from the control-plane: ping a pod that runs on the worker<\/em> kubectl get pods -A -o wide | grep <worker-node-name> # pick any pod IP<\/em> ping -c2 <that-pod-ip><\/code><\/li>\n<\/ol>\n\n\n\n
    \n\n\n\n
    2. Install Helm (if missing)<\/h2>\n\n\n
    curl -sSL https:\/\/get.helm.sh\/helm-v3.17.3-linux-amd64.tar.gz | tar xz -C \/tmp<\/span>\nsudo install \/tmp\/linux-amd64\/helm \/usr\/local\/bin\/helm\nhelm version --short\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n\n
    3. RWX storage (NFS) – lab setup<\/h2>\n\n\n\n
    Skip this if you already have an RWX CSI class (EFS, Azure Files, CephFS…). For a lab, an NFS export on the control-plane node plus the NFS subdir provisioner is enough.<\/p>\n\n\n\n
    On the control-plane node:<\/strong><\/p>\n\n\n
    sudo apt-get install -y nfs-kernel-server\nsudo mkdir -p \/srv\/nfs\/k8s && sudo chmod 777<\/span> \/srv\/nfs\/k8s\necho<\/span> \"\/srv\/nfs\/k8s 172.31.0.0\/16(rw,sync,no_subtree_check,no_root_squash)\"<\/span> | sudo tee -a \/etc\/exports\nsudo exportfs -ra && sudo systemctl enable --now nfs-kernel-server\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
    Adjust 172.31.0.0\/16<\/code> to your node subnet.<\/p>\n\n\n\n
    On every other node:<\/strong><\/p>\n\n\n
    sudo apt-get<\/span> install -y nfs-common\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    Install the provisioner<\/strong> (use the control-plane node’s private IP for nfs.server<\/code>):<\/p>\n\n\n
    helm repo add nfs-subdir https:\/\/kubernetes-sigs.github.io\/nfs-subdir-external-provisioner\/<\/span>\nhelm repo update\nhelm install nfs-provisioner nfs-subdir\/nfs-subdir-external-provisioner \\\n  -n nfs-provisioner --create-namespace \\\n  --set<\/span> nfs.server=172.31.10.122 \\\n  --set<\/span> nfs.path=\/srv\/nfs\/k8s \\\n  --set<\/span> storageClass.name=nfs-rwx \\\n  --set<\/span> storageClass.defaultClass=false \\\n  --set<\/span> storageClass.reclaimPolicy=Retain \\\n  --wait\nkubectl get<\/span> sc nfs-rwx\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n
    NFS on a cluster node is for labs only. Use a managed RWX service in production.<\/p>\n<\/blockquote>\n\n\n\n
    Create the namespace:<\/p>\n\n\n
    kubectl create namespace<\/span> nexus<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n\n
    4. PostgreSQL<\/h2>\n\n\n\n
    CM needs a database cmdb<\/code> and a user lcmreq<\/code>. For a lab, run PostgreSQL in the cluster. For production use a managed\/HA database and skip the StatefulSet below (run only the SQL).<\/p>\n\n\n\n
    4.1 Prepare the SQL<\/h3>\n\n\n\n
    Copy the three scripts from install\/PostgreSQL\/<\/code> to the control-plane node. Change the default password<\/strong> in create_db_and_role.sql<\/code> (REQreq01#<\/code>):<\/p>\n\n\n
    LCM_PW=$(openssl rand -hex 10<\/span>)          <em># keep this; it goes into the CM Helm values later<\/em><\/span>\nsed -i \"s\/REQreq01#\/$LCM_PW\/\"<\/span> create_db_and_role.sql\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
    4.2 Deploy PostgreSQL<\/h3>\n\n\n\n
    postgres.yaml<\/code> (the Service is named cmdb<\/code>, matching the chart’s default JDBC host):<\/p>\n\n\n
    apiVersion: v1\nkind<\/span>: Secret\nmetadata<\/span>: {name<\/span>: postgres-auth, namespace<\/span>: nexus}\nstringData<\/span>:\n  POSTGRES_PASSWORD: \"<superuser-password>\"<\/span>\n---\napiVersion: apps\/v1\nkind<\/span>: StatefulSet\nmetadata<\/span>: {name<\/span>: cmdb, namespace<\/span>: nexus}\nspec<\/span>:\n  serviceName: cmdb\n  replicas<\/span>: 1<\/span>\n  selector<\/span>: {matchLabels<\/span>: {app<\/span>: cmdb}}\n  template<\/span>:\n    metadata: {labels<\/span>: {app<\/span>: cmdb}}\n    spec<\/span>:\n      containers:\n      - name: postgres\n        image<\/span>: postgres:16<\/span>\n        envFrom<\/span>: [{secretRef<\/span>: {name<\/span>: postgres-auth}}]\n        env<\/span>: [{name<\/span>: PGDATA, value<\/span>: \/var\/<\/span>lib\/postgresql\/data\/pgdata}]\n        ports<\/span>: [{containerPort<\/span>: 5432<\/span>}]\n        readinessProbe<\/span>: {exec<\/span>: {command<\/span>: [\"pg_isready\"<\/span>,\"-U\"<\/span>,\"postgres\"<\/span>]}, periodSeconds<\/span>: 5<\/span>}\n        volumeMounts<\/span>: [{name<\/span>: data, mountPath<\/span>: \/var\/<\/span>lib\/postgresql\/data}]\n        resources<\/span>: {requests<\/span>: {cpu<\/span>: 100<\/span>m, memory<\/span>: 256<\/span>Mi}}\n  volumeClaimTemplates<\/span>:\n  - metadata: {name<\/span>: data}\n    spec<\/span>:\n      accessModes: [ReadWriteOnce]\n      storageClassName<\/span>: local-path\n      resources<\/span>: {requests<\/span>: {storage<\/span>: 5<\/span>Gi}}\n---\napiVersion: v1\nkind<\/span>: Service\nmetadata<\/span>: {name<\/span>: cmdb, namespace<\/span>: nexus}\nspec<\/span>:\n  selector: {app<\/span>: cmdb}\n  ports<\/span>: [{port<\/span>: 5432<\/span>, targetPort<\/span>: 5432<\/span>}]\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n
    kubectl apply -f postgres.yaml\nkubectl -n nexus rollout status statefulset\/cmdb\n<\/code><\/span><\/pre>\n\n\n
    4.3 Load the schema<\/h3>\n\n\n
    K=\"kubectl -n nexus\"<\/span>\n$K exec -i cmdb-0<\/span> -- psql -X -v ON_ERROR_STOP=1<\/span> -U postgres -d postgres < create_db_and_role.sql\n$K exec -i cmdb-0<\/span> -- psql -X -v ON_ERROR_STOP=1<\/span> -q -U postgres -d cmdb < create_cmdb.sql\n$K exec -i cmdb-0<\/span> -- psql -X -v ON_ERROR_STOP=1<\/span> -q -U postgres -d cmdb < add_bootca.sql\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n