This documentation describes the Installation of individual components. You can also use the CMP Umbrella Chart to install all at once

Prerequisites

• A running Kubernetes cluster, version 1.23 or newer (all charts declare kubeVersion: ">=1.23.0-0"), and a namespace per installation.
• The Helm 3 client on your machine — see Installing Helm. Nothing needs to be installed in the cluster.
• Storage: a StorageClass for ReadWriteOnce volumes (CMS data), plus a shared filesystem (typically NFS) for the ReadWriteMany volumes of Gentics Mesh and the Portals. See our Recommended Deployment.
• A MariaDB database — needed by both Gentics CMS and Gentics Mesh (the default Mesh image is the MariaDB-backed enterprise build gentics/mesh-enterprise-mariadb). Create a database, a user and the grants for each component beforehand; the charts do not create them.

• A pull secret for docker.gentics.com in that namespace, from the credentials your Gentics technical customer consultant provides:

  kubectl -n NAMESPACE create secret docker-registry docker-gentics-com \
    --docker-server=docker.gentics.com \
    --docker-username=USERNAME --docker-password=PASSWORD
  

  Or if you use a Image Proxy Registry, the Authentication can be configured in your Registry.

• The Gentics Helm repository, using the credentials you received with it:

  helm repo add --username USERNAME --password PASSWORD gentics https://repo.gentics.com/repository/helm/
  helm repo update
  

• A CMP license key. Gentics CMS, Mesh and Portal | Java each read it from a Secret with the key licensekey — set it as a value (license.key) or reference a pre-created Secret (license.secret).
• Optional: Elasticsearch (Mesh search) and Keycloak (Portal | Java authentication, Mesh config.publicKeys).

General

All Charts follow the same version structure. For each component Version there is the corresponding Chart Version. E.g. If you want to install Gentics CMS 6.5.4 install the Chart with --version 6.5.4 it will automatically use the 6.5.4 image and ensure comptability between chart definition and application.

Install Gentics Mesh

Check the defaults with helm show values gentics/gentics-mesh and create your own values.yaml. The values that are required or that changed:

Install:

helm -n NAMESPACE upgrade -i --wait -f gentics-mesh/values.yaml \
  gentics-mesh gentics/gentics-mesh

Generate the Mesh API key for the portals

Both Portals authenticate against Mesh with an API key, and the Mesh chart can issue it:

generateApiKey: true

A Job waits for Mesh, logs in as admin and writes the token into the Secret <release>-mesh-secret under the key apikey — for the release gentics-mesh that is gentics-mesh-mesh-secret. An existing key is never regenerated, because issuing a new token invalidates the previous one. To force a new key, delete the Secret and run helm upgrade again.

Alternatively create the key yourself through the Mesh REST API (POST /api/v2/users/{uuid}/token) or the Mesh user interface and store it in a Secret.

Install Gentics CMS

Check the defaults with helm show values gentics/cms and create your own values.yaml. The values that are required or that changed:

Install:

helm -n NAMESPACE upgrade -i -f gentics-cms/values.yaml \
  gentics-cms gentics/cms

Once Gentics CMS is fully started, configure the Gentics Mesh Content Repository in the user interface as described in the documentation, then check and repair the content repository and publish all objects.

Install Gentics Portal | PHP

As the Gentics Portal | PHP deployment is always tailor-made for each project, you will receive detailed installation instructions during the project setup phase.

• Set image.registry, image.repository and image.tag to the portal image built by your project's CI — there is no pre-built Portal image.

• mesh.url is required, and the API key comes from a Secret:

  mesh:
    url: "http://gentics-mesh:80"
    secretName: "gentics-mesh-mesh-secret"   # Secret written by the Mesh chart or manually created
    #apikey: ""                              # or inline, takes precedence
  

  Set mesh.secretName explicitly: without it the chart looks for <release>-mesh-secret under its own release name, which differs from the Mesh release.

• persistence is enabled by default and requests a ReadWriteMany volume; use persistence.shared.existingClaim for a claim you created yourself.
  
  

helm -n NAMESPACE upgrade -i -f gentics-portal/values.yaml \
  gentics-portal gentics/gentics-portal-php

Install Gentics Portal | Java

As the Gentics Portal | Java always needs an implementation, you need a prebuilt Portal Docker image first.

• Set image.registry, image.repository and image.tag to your portal image, and the license through license.key or license.secret.

• mesh.host and mesh.port are required:

  mesh:
    host: "gentics-mesh"
    port: 80
    project: "YOUR_PROJECT"
    apiKeyFromSecret: true
    secretName: "gentics-mesh-mesh-secret"   # Secret written by the Mesh chart or manually created
  

  As with the PHP portal, set secretName explicitly when Mesh is a separate release.

• Set portal.server.url to the externally reachable URL of the portal — link resolving depends on it.
• For authentication, configure keycloak.* (authUrl, realmName, clientName, clientSecret) and auth.*. Authentication is disabled while auth.callbackEndpoint is unset. Pass the client secret as AUTH_CLIENT_SECRET via extraEnv from a Secret rather than putting it in the values file.
  

helm -n NAMESPACE upgrade -i -f gentics-portal/values.yaml \
  gentics-portal gentics/gentics-portal-java

Retrieving generated credentials

Passwords you do not configure are generated on the first install, stored in a Secret and reused on every later upgrade:

# Gentics CMS "node" user (release "gentics-cms")
kubectl -n NAMESPACE get secret gentics-cms \
  -o jsonpath='{.data.node-user-password}' | base64 -d; echo

# Gentics Mesh "admin" user (release "gentics-mesh")
kubectl -n NAMESPACE get secret gentics-mesh-admin \
  -o jsonpath='{.data.password}' | base64 -d; echo

# Gentics Mesh API key for the portals (release "gentics-mesh")
kubectl -n NAMESPACE get secret gentics-mesh-mesh-secret \
  -o jsonpath='{.data.apikey}' | base64 -d; echo