Integrate Nexus Repository with Kubernetes and Docker registry authentication

Install Docker and Kubernetes prerequisites

Install Docker runtime and Kubernetes tools required for managing the cluster and container operations.

sudo apt update && sudo apt upgrade -y
sudo apt install -y docker.io kubectl
sudo systemctl enable --now docker
sudo usermod -aG docker $USER

sudo dnf update -y
sudo dnf install -y docker kubectl
sudo systemctl enable --now docker
sudo usermod -aG docker $USER

Deploy Nexus Repository Manager on Kubernetes

Create a dedicated namespace and deploy Nexus using a Deployment with persistent storage for repository data.

kubectl create namespace nexus-system
kubectl config set-context --current --namespace=nexus-system

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nexus-repository
  namespace: nexus-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nexus-repository
  template:
    metadata:
      labels:
        app: nexus-repository
    spec:
      containers:
      - name: nexus
        image: sonatype/nexus3:3.45.0
        ports:
        - containerPort: 8081
        - containerPort: 8082
        env:
        - name: INSTALL4J_ADD_VM_PARAMS
          value: "-Xms2g -Xmx2g -XX:MaxDirectMemorySize=3g"
        volumeMounts:
        - name: nexus-data
          mountPath: /nexus-data
        resources:
          requests:
            memory: "4Gi"
            cpu: "1000m"
          limits:
            memory: "6Gi"
            cpu: "2000m"
      volumes:
      - name: nexus-data
        persistentVolumeClaim:
          claimName: nexus-pvc
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: nexus-pvc
  namespace: nexus-system
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 100Gi
---
apiVersion: v1
kind: Service
metadata:
  name: nexus-service
  namespace: nexus-system
spec:
  selector:
    app: nexus-repository
  ports:
  - name: web
    port: 8081
    targetPort: 8081
  - name: docker
    port: 8082
    targetPort: 8082
  type: ClusterIP

kubectl apply -f nexus-deployment.yaml

Configure Ingress for Nexus access

Set up an Ingress resource to expose Nexus web interface and Docker registry endpoints with SSL termination.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nexus-ingress
  namespace: nexus-system
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - nexus.example.com
    - docker.example.com
    secretName: nexus-tls
  rules:
  - host: nexus.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nexus-service
            port:
              number: 8081
  - host: docker.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nexus-service
            port:
              number: 8082

kubectl apply -f nexus-ingress.yaml

Wait for Nexus deployment and retrieve admin password

Monitor the deployment status and extract the initial admin password from the Nexus container.

kubectl get pods -n nexus-system -w

kubectl exec -it deployment/nexus-repository -n nexus-system -- cat /nexus-data/admin.password

Configure Docker registry in Nexus

Access the Nexus web interface and create a Docker hosted repository for storing private images.

1. Log in with username admin and the password from the previous step
2. Navigate to Settings → Repositories → Create repository
3. Select docker (hosted) repository type
4. Configure the repository settings:

Name: docker-private
HTTP Port: 8082
Enable Docker V1 API: checked
Allow anonymous docker pull: unchecked
Enable Docker Bearer Token Realm: checked

Configure authentication realm

Enable Docker Bearer Token Realm to support Docker registry authentication with Nexus users.

1. Navigate to Settings → Security → Realms
2. Move Docker Bearer Token Realm from Available to Active
3. Click Save to apply the configuration

Create Nexus service account

Create a dedicated service account in Nexus for Kubernetes to authenticate with the Docker registry.

1. Navigate to Settings → Security → Users → Create user
2. Configure the service account:

ID: k8s-registry
First Name: Kubernetes
Last Name: Registry
Email: k8s-registry@example.com
Status: Active
Roles: nx-repository-view-docker-docker-private-*

Create Kubernetes Docker registry secret

Generate a Kubernetes secret containing Docker registry credentials for authenticating with the Nexus repository.

kubectl create secret docker-registry nexus-registry-secret \
  --docker-server=docker.example.com \
  --docker-username=k8s-registry \
  --docker-password=your-service-account-password \
  --docker-email=k8s-registry@example.com \
  -n default

Configure RBAC for service accounts

Create a dedicated service account and configure Role-Based Access Control for secure container operations.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: nexus-puller
  namespace: default
imagePullSecrets:
name: nexus-registry-secret
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: image-puller
  namespace: default
rules:
apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
apiGroups: ["apps"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: nexus-puller-binding
  namespace: default
subjects:
kind: ServiceAccount
  name: nexus-puller
  namespace: default
roleRef:
  kind: Role
  name: image-puller
  apiGroup: rbac.authorization.k8s.io

kubectl apply -f rbac-config.yaml

Test Docker registry authentication

Verify that Docker can authenticate with the Nexus registry and push/pull images successfully.

echo "your-service-account-password" | docker login docker.example.com -u k8s-registry --password-stdin

docker pull nginx:alpine
docker tag nginx:alpine docker.example.com/nginx:alpine
docker push docker.example.com/nginx:alpine

Deploy test application using private registry

Create a test deployment that pulls images from the Nexus private registry using the configured authentication.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-from-nexus
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-from-nexus
  template:
    metadata:
      labels:
        app: nginx-from-nexus
    spec:
      serviceAccountName: nexus-puller
      containers:
      - name: nginx
        image: docker.example.com/nginx:alpine
        ports:
        - containerPort: 80
        resources:
          requests:
            memory: "64Mi"
            cpu: "50m"
          limits:
            memory: "128Mi"
            cpu: "100m"
      imagePullSecrets:
      - name: nexus-registry-secret
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-from-nexus
  namespace: default
spec:
  selector:
    app: nginx-from-nexus
  ports:
  - port: 80
    targetPort: 80
  type: ClusterIP

kubectl apply -f test-deployment.yaml

Configure automatic secret propagation

Set up automatic propagation of Docker registry secrets across namespaces for streamlined deployment workflows.

apiVersion: v1
kind: ConfigMap
metadata:
  name: registry-config
  namespace: kube-system
data:
  config.yaml: |
    registries:
      "docker.example.com":
        username: k8s-registry
        password: your-service-account-password
---
apiVersion: batch/v1
kind: Job
metadata:
  name: propagate-registry-secret
  namespace: kube-system
spec:
  template:
    spec:
      serviceAccountName: secret-propagator
      containers:
      - name: kubectl
        image: bitnami/kubectl:latest
        command:
        - /bin/sh
        - -c
        - |
          for ns in $(kubectl get namespaces -o jsonpath='{.items[*].metadata.name}'); do
            if [ "$ns" != "kube-system" ] && [ "$ns" != "kube-public" ]; then
              kubectl create secret docker-registry nexus-registry-secret \
                --docker-server=docker.example.com \
                --docker-username=k8s-registry \
                --docker-password=your-service-account-password \
                --docker-email=k8s-registry@example.com \
                -n "$ns" --dry-run=client -o yaml | kubectl apply -f -
            fi
          done
      restartPolicy: OnFailure
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: secret-propagator
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-propagator
rules:
apiGroups: [""]
  resources: ["secrets", "namespaces"]
  verbs: ["get", "list", "create", "update", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: secret-propagator
subjects:
kind: ServiceAccount
  name: secret-propagator
  namespace: kube-system
roleRef:
  kind: ClusterRole
  name: secret-propagator
  apiGroup: rbac.authorization.k8s.io

kubectl apply -f secret-propagation.yaml