<p>This is most likely due to the ingress not being configured to passthrough SSL.</p>
<p>Add this annotation to the ingress:</p>
<pre><code>nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
</code></pre>
<p>Additionally, make sure that the ingress controller was started with <code>--enable-ssl-passthrough</code></p>
<p>To answer your questions:
Considering ingress-nginx as a &quot;secure proxy&quot; is for your security organization to decide based on specific deployment, and access means.  However it is considered secure in many organizations</p>
<p>You can decide on whatever port you want, but the difference between HTTP &amp; HTTPS is where the SSL termination will occur.  Using nginx as ingress will by default encrypt traffic from client to Nginx, but from nginx to Nexus will be in the clear.  With the annotations given above, traffic will be encrypted end-to-end.</p>

CC BY-SA 4.0
2023-11-30T08:52:51.100Z
Hey ! Sorry for my late answer i wasn't notified... After all, I finally realize that the working configuration was to set a HTTP 8080 listener. I will give some try to your solution too, i wasn't aware that encryption wasn't end-to-end by default, you give me a great advice here and i thank you again for that !
motorbass
CC BY-SA 4.0
2023-11-17T16:24:28.407Z
2023-11-17T17:39:55.587Z
2023-11-17T17:39:55.587Z
Chris Chipman
<p><strong>Context:</strong><br />
In order to pull custom images I made for AWX execution environment, I deployed a Sonatype Nexus Repository on my K8s cluster using this <a href="https://artifacthub.io/packages/helm/sonatype/nexus-repository-manager/28.0.2" rel="nofollow noreferrer">Helm Chart.</a></p>
<p>I've simply modify it with my values:</p>
<pre><code>nexus:
  docker:
    enabled: true
    registries:
      - host: awx-private-repo.mydomain.com
        port: 8080
        secretName: nginx-ingress-tls-secret

ingress:
  enabled: true
  ingressClassName: nginx
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: &quot;0&quot;
  hostPath: /
  hostRepo: my-nexus.mydomain.com
  tls:
    - secretName: nginx-ingress-tls-secret
      hosts:
        - my-nexus.mydomain.com
</code></pre>
<p>My configuration is pretty basic, an ingress-nginx is configured to expose the Nexus UI, this works pretty smoothly and easily.</p>
<p>In a later stage, I created a docker(hosted) private registry from Nexus UI with an HTTP or HTTPS listener on port 8080 (will be detailed into Problem: section below)
Naturally, the configuration beyond create a service + an ingress.</p>
<p>From an K8s-UI perspective, my deployment looks like this<br />
<a href="https://i.sstatic.net/OK8lXl.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/OK8lXl.png" alt="enter image description here" /></a></p>
<p>From a Nexus-UI perspective, docker private registry is simply configured like this :<a href="https://i.sstatic.net/XBOHpl.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/XBOHpl.png" alt="enter image description here" /></a></p>
<p><strong>Problem:</strong></p>
<ul>
<li><p>if my repo is configured with a 8080 <strong>HTTPS</strong> listener, it's not accessible and nginx raised a <code>502 BAD GATEWAY</code> error</p>
</li>
<li><p>if I configure a 8080 <strong>HTTP</strong> listener, repository is accessible and I can perform a docker login command.</p>
</li>
</ul>
<p>Furthermore, I saw on Nexus UI below HTTP/HTTPS listener <code> Create an HTTP connector at specified port. Normally used if the server is behind a secure proxy.</code> and <code>Create an HTTPS connector at specified port. Normally used if the server is configured for https.</code></p>
<p><strong>My question are :</strong></p>
<p>Does ingress-nginx is considered as a &quot;secure proxy&quot; ?</p>
<p>What should be the best practices with Nexus repository ? create an HTTP repo on port 8080 or an HTTPS one ? in which case HTTP/HTTPS should be used in a repository context ?</p>

<kubernetes><nexus><ingress-nginx>
502 Bad Gateway when HTTPS listener is configured on Nexus Private Registry
motorbass
# 502 Bad Gateway when HTTPS listener is configured on Nexus Private Registry

(Asked by: username_0 on 2023-08-22)

Context:
In order to pull custom images I made for AWX execution environment, I deployed a Sonatype Nexus Repository on my K8s cluster using this Helm Chart.
I've simply modify it with my values:
nexus:
  docker:
    enabled: true
    registries:
      - host: awx-private-repo.mydomain.com
        port: 8080
        secretName: nginx-ingress-tls-secret

ingress:
  enabled: true
  ingressClassName: nginx
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
  hostPath: /
  hostRepo: my-nexus.mydomain.com
  tls:
    - secretName: nginx-ingress-tls-secret
      hosts:
        - my-nexus.mydomain.com

My configuration is pretty basic, an ingress-nginx is configured to expose the Nexus UI, this works pretty smoothly and easily.
In a later stage, I created a docker(hosted) private registry from Nexus UI with an HTTP or HTTPS listener on port 8080 (will be detailed into Problem: section below)
Naturally, the configuration beyond create a service + an ingress.
From an K8s-UI perspective, my deployment looks like this

From a Nexus-UI perspective, docker private registry is simply configured like this :
Problem:

if my repo is configured with a 8080 HTTPS listener, it's not accessible and nginx raised a 502 BAD GATEWAY error

if I configure a 8080 HTTP listener, repository is accessible and I can perform a docker login command.


Furthermore, I saw on Nexus UI below HTTP/HTTPS listener  Create an HTTP connector at specified port. Normally used if the server is behind a secure proxy. and Create an HTTPS connector at specified port. Normally used if the server is configured for https.
My question are :
Does ingress-nginx is considered as a "secure proxy" ?
What should be the best practices with Nexus repository ? create an HTTP repo on port 8080 or an HTTPS one ? in which case HTTP/HTTPS should be used in a repository context ?

**Tags:** kubernetes, nexus, ingress-nginx


---

## 1 answers

### Answer by username_1 on 2023-11-17. Score: 1 | Accepted answer

This is most likely due to the ingress not being configured to passthrough SSL.
Add this annotation to the ingress:
nginx.ingress.kubernetes.io/ssl-redirect: "true"

Additionally, make sure that the ingress controller was started with --enable-ssl-passthrough
To answer your questions:
Considering ingress-nginx as a "secure proxy" is for your security organization to decide based on specific deployment, and access means.  However it is considered secure in many organizations
You can decide on whatever port you want, but the difference between HTTP & HTTPS is where the SSL termination will occur.  Using nginx as ingress will by default encrypt traffic from client to Nginx, but from nginx to Nexus will be in the clear.  With the annotations given above, traffic will be encrypted end-to-end.

> **Comments:**
> **username_0**: Hey ! Sorry for my late answer i wasn't notified... After all, I finally realize that the working configuration was to set a HTTP 8080 listener. I will give some try to your solution too, i wasn't aware that encryption wasn't end-to-end by default, you give me a great advice here and i thank you again for that !  

---

