0

Context:
In order to pull custom images I made for AWX execution environment, I deployed a Sonatype Nexus Repository on my K8s cluster using this Helm Chart.

I've simply modify it with my values:

nexus:
  docker:
    enabled: true
    registries:
      - host: awx-private-repo.mydomain.com
        port: 8080
        secretName: nginx-ingress-tls-secret

ingress:
  enabled: true
  ingressClassName: nginx
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
  hostPath: /
  hostRepo: my-nexus.mydomain.com
  tls:
    - secretName: nginx-ingress-tls-secret
      hosts:
        - my-nexus.mydomain.com

My configuration is pretty basic, an ingress-nginx is configured to expose the Nexus UI, this works pretty smoothly and easily.

In a later stage, I created a docker(hosted) private registry from Nexus UI with an HTTP or HTTPS listener on port 8080 (will be detailed into Problem: section below) Naturally, the configuration beyond create a service + an ingress.

From an K8s-UI perspective, my deployment looks like this
enter image description here

From a Nexus-UI perspective, docker private registry is simply configured like this :enter image description here

Problem:

  • if my repo is configured with a 8080 HTTPS listener, it's not accessible and nginx raised a 502 BAD GATEWAY error

  • if I configure a 8080 HTTP listener, repository is accessible and I can perform a docker login command.

Furthermore, I saw on Nexus UI below HTTP/HTTPS listener Create an HTTP connector at specified port. Normally used if the server is behind a secure proxy. and Create an HTTPS connector at specified port. Normally used if the server is configured for https.

My question are :

Does ingress-nginx is considered as a "secure proxy" ?

What should be the best practices with Nexus repository ? create an HTTP repo on port 8080 or an HTTPS one ? in which case HTTP/HTTPS should be used in a repository context ?

1 Answer 1

1

This is most likely due to the ingress not being configured to passthrough SSL.

Add this annotation to the ingress:

nginx.ingress.kubernetes.io/ssl-redirect: "true"

Additionally, make sure that the ingress controller was started with --enable-ssl-passthrough

To answer your questions: Considering ingress-nginx as a "secure proxy" is for your security organization to decide based on specific deployment, and access means. However it is considered secure in many organizations

You can decide on whatever port you want, but the difference between HTTP & HTTPS is where the SSL termination will occur. Using nginx as ingress will by default encrypt traffic from client to Nginx, but from nginx to Nexus will be in the clear. With the annotations given above, traffic will be encrypted end-to-end.

1
  • Hey ! Sorry for my late answer i wasn't notified... After all, I finally realize that the working configuration was to set a HTTP 8080 listener. I will give some try to your solution too, i wasn't aware that encryption wasn't end-to-end by default, you give me a great advice here and i thank you again for that !
    – motorbass
    Nov 30, 2023 at 8:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.