Sonatype Nexus IQ Server is everything you need to know to trust your software supply chain. It powers Nexus Firewall, Nexus Lifecycle, and Nexus Auditor.

• Kubernetes 1.19+
• PV provisioner support in the underlying infrastructure
• Helm 3

These charts are designed to work out of the box with minikube using both ingess and ingress-dns addons.

The current releases have been tested on minikube v1.25.1 running Kubernetes v1.23.1.

To Add as a Helm Repo helm repo add sonatype https://sonatype.github.io/helm3-charts/

To test the chart:

$ helm install --dry-run --debug --generate-name ./

To test the chart with your own values:

$ helm install --dry-run --debug --generate-name -f myvalues.yaml ./ 

To install the chart:

$ helm install nexus-iq sonatype/nexus-iq-server [ --version v90.0.0 ]

The above command deploys IQ on the Kubernetes cluster in the default configuration. Note the optional version flag.

You can pass custom configuration values as:

$ helm install -f myvalues.yaml ./ --name nexus-iq

The default login for the IQ Server is admin/admin123

$ helm upgrade nexus-iq sonatype/nexus-iq-server [--version v91.0.0]

Note:

• optional version flag shown.
• When upgrading from IQ versions 1.117 or 1.100, set fixOwner.enabled to true for changing the file ownership.

To uninstall/delete the deployment:

$ helm list
NAME                    NAMESPACE       REVISION        UPDATED                                 STATUS          CHART                   APP VERSION
plinking-gopher	        default         1               2021-03-10 15:13:04.614125 -0800 PST    deployed        nexus-iq-server-106.0.0 1.106.0    
$ helm delete plinking-gopher

The command removes all the Kubernetes components associated with the chart and deletes the release.

You can define the config.yml for IQ Server in your myvalues.yml file on startup. It is the configYaml property. For more details, see the Configuring IQ Server help page. Additionally the server can be started with JAVA_OPTS exported to the environment. This will be added to the server process invocation and can be used for purposes such as changing the server memory settings. See the defaults set in the values.yaml file.

The license file can be installed via the UI when IQ server is running, or it can be done as a part of the deploy. If you leave the licenseFile field empty/commented, IQ Server will start and prompt you to manually install the license when you first enter the GUI.

There is an example of how to implement this in the values.yaml file using secrets to store both the Java keystores and their associated passwords. In order to utilize the provided example directly secrets can be created from a directory containing the keystore and truststore files like so:

kubectl create secret generic secret-jks 
	--from-file=truststore.jks=./truststore.jks 
	--from-file=keystore.jks=./keystore.jks 
	--from-literal='keystorePassword=password' 
	--from-literal='truststorePassword=password'

To use the IQ image available from Red Hat's registry, you'll need to:

• Load the credentials for the registry as a secret in your cluster

  kubectl create secret docker-registry redhat-pull-secret \
    --docker-server=registry.connect.redhat.com \
    --docker-username=<user_name> \
    --docker-password=<password> \
    --docker-email=<email>

  See Red Hat's Registry Authentication documentation for further details.
• Provide the name of the secret in imagePullSecrets in this chart's values.yaml

  imagePullSecrets:
    - name: redhat-pull-secret

• Set image.name and image.tag in values.yaml

  image:
    repository: registry.connect.redhat.com/sonatype/nexus-iq-server
    tag: 1.132.0-ubi-1