502 Bad Gateway when HTTPS listener is configured on Nexus Private Registry

Question

Context:
In order to pull custom images I made for AWX execution environment, I deployed a Sonatype Nexus Repository on my K8s cluster using this Helm Chart.

I've simply modify it with my values:

nexus:
  docker:
    enabled: true
    registries:
      - host: awx-private-repo.mydomain.com
        port: 8080
        secretName: nginx-ingress-tls-secret

ingress:
  enabled: true
  ingressClassName: nginx
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
  hostPath: /
  hostRepo: my-nexus.mydomain.com
  tls:
    - secretName: nginx-ingress-tls-secret
      hosts:
        - my-nexus.mydomain.com

My configuration is pretty basic, an ingress-nginx is configured to expose the Nexus UI, this works pretty smoothly and easily.

In a later stage, I created a docker(hosted) private registry from Nexus UI with an HTTP or HTTPS listener on port 8080 (will be detailed into Problem: section below) Naturally, the configuration beyond create a service + an ingress.

From an K8s-UI perspective, my deployment looks like this

From a Nexus-UI perspective, docker private registry is simply configured like this :

Problem:

• if my repo is configured with a 8080 HTTPS listener, it's not accessible and nginx raised a 502 BAD GATEWAY error

• if I configure a 8080 HTTP listener, repository is accessible and I can perform a docker login command.

Furthermore, I saw on Nexus UI below HTTP/HTTPS listener Create an HTTP connector at specified port. Normally used if the server is behind a secure proxy. and Create an HTTPS connector at specified port. Normally used if the server is configured for https.

My question are :

Does ingress-nginx is considered as a "secure proxy" ?

What should be the best practices with Nexus repository ? create an HTTP repo on port 8080 or an HTTPS one ? in which case HTTP/HTTPS should be used in a repository context ?

Answer 1

This is most likely due to the ingress not being configured to passthrough SSL.

Add this annotation to the ingress:

nginx.ingress.kubernetes.io/ssl-redirect: "true"

Additionally, make sure that the ingress controller was started with --enable-ssl-passthrough

To answer your questions: Considering ingress-nginx as a "secure proxy" is for your security organization to decide based on specific deployment, and access means. However it is considered secure in many organizations

You can decide on whatever port you want, but the difference between HTTP & HTTPS is where the SSL termination will occur. Using nginx as ingress will by default encrypt traffic from client to Nginx, but from nginx to Nexus will be in the clear. With the annotations given above, traffic will be encrypted end-to-end.