Answers: <p>This is most likely due to the ingress not being configured to passthrough SSL.</p>
  <p>Add this annotation to the ingress:</p>
  <pre><code>nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
  </code></pre>
  <p>Additionally, make sure that the ingress controller was started with <code>--enable-ssl-passthrough</code></p>
  <p>To answer your questions:
  Considering ingress-nginx as a &quot;secure proxy&quot; is for your security organization to decide based on specific deployment, and access means.  However it is considered secure in many organizations</p>
  <p>You can decide on whatever port you want, but the difference between HTTP &amp; HTTPS is where the SSL termination will occur.  Using nginx as ingress will by default encrypt traffic from client to Nginx, but from nginx to Nexus will be in the clear.  With the annotations given above, traffic will be encrypted end-to-end.</p>
  
Answers: CC BY-SA 4.0
Answers: 2023-11-30T08:52:51.100Z
Answers: Hey ! Sorry for my late answer i wasn't notified... After all, I finally realize that the working configuration was to set a HTTP 8080 listener. I will give some try to your solution too, i wasn't aware that encryption wasn't end-to-end by default, you give me a great advice here and i thank you again for that !
Answers: motorbass
Answers: CC BY-SA 4.0
Answers: 2023-11-17T16:24:28.407Z
Answers: 2023-11-17T17:39:55.587Z
Answers: 2023-11-17T17:39:55.587Z
Answers: Chris Chipman
Body: <p><strong>Context:</strong><br />
  In order to pull custom images I made for AWX execution environment, I deployed a Sonatype Nexus Repository on my K8s cluster using this <a href="https://artifacthub.io/packages/helm/sonatype/nexus-repository-manager/28.0.2" rel="nofollow noreferrer">Helm Chart.</a></p>
  <p>I've simply modify it with my values:</p>
  <pre><code>nexus:
    docker:
      enabled: true
      registries:
        - host: awx-private-repo.mydomain.com
          port: 8080
          secretName: nginx-ingress-tls-secret
  
  ingress:
    enabled: true
    ingressClassName: nginx
    annotations:
      nginx.ingress.kubernetes.io/proxy-body-size: &quot;0&quot;
    hostPath: /
    hostRepo: my-nexus.mydomain.com
    tls:
      - secretName: nginx-ingress-tls-secret
        hosts:
          - my-nexus.mydomain.com
  </code></pre>
  <p>My configuration is pretty basic, an ingress-nginx is configured to expose the Nexus UI, this works pretty smoothly and easily.</p>
  <p>In a later stage, I created a docker(hosted) private registry from Nexus UI with an HTTP or HTTPS listener on port 8080 (will be detailed into Problem: section below)
  Naturally, the configuration beyond create a service + an ingress.</p>
  <p>From an K8s-UI perspective, my deployment looks like this<br />
  <a href="https://i.sstatic.net/OK8lXl.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/OK8lXl.png" alt="enter image description here" /></a></p>
  <p>From a Nexus-UI perspective, docker private registry is simply configured like this :<a href="https://i.sstatic.net/XBOHpl.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/XBOHpl.png" alt="enter image description here" /></a></p>
  <p><strong>Problem:</strong></p>
  <ul>
  <li><p>if my repo is configured with a 8080 <strong>HTTPS</strong> listener, it's not accessible and nginx raised a <code>502 BAD GATEWAY</code> error</p>
  </li>
  <li><p>if I configure a 8080 <strong>HTTP</strong> listener, repository is accessible and I can perform a docker login command.</p>
  </li>
  </ul>
  <p>Furthermore, I saw on Nexus UI below HTTP/HTTPS listener <code> Create an HTTP connector at specified port. Normally used if the server is behind a secure proxy.</code> and <code>Create an HTTPS connector at specified port. Normally used if the server is configured for https.</code></p>
  <p><strong>My question are :</strong></p>
  <p>Does ingress-nginx is considered as a &quot;secure proxy&quot; ?</p>
  <p>What should be the best practices with Nexus repository ? create an HTTP repo on port 8080 or an HTTPS one ? in which case HTTP/HTTPS should be used in a repository context ?</p>
  
Tags: <kubernetes><nexus><ingress-nginx>
Title: 502 Bad Gateway when HTTPS listener is configured on Nexus Private Registry
UserDisplayName: motorbass
ThreadText: # 502 Bad Gateway when HTTPS listener is configured on Nexus Private Registry
  
  (Asked by: username_0 on 2023-08-22)
  
  **Context:**  
  In order to pull custom images I made for AWX execution environment, I deployed a Sonatype Nexus Repository on my K8s cluster using this [Helm Chart.](https://artifacthub.io/packages/helm/sonatype/nexus-repository-manager/28.0.2)
  
  I've simply modify it with my values:
  
  ```
  nexus:
    docker:
      enabled: true
      registries:
        - host: awx-private-repo.mydomain.com
          port: 8080
          secretName: nginx-ingress-tls-secret
  
  ingress:
    enabled: true
    ingressClassName: nginx
    annotations:
      nginx.ingress.kubernetes.io/proxy-body-size: "0"
    hostPath: /
    hostRepo: my-nexus.mydomain.com
    tls:
      - secretName: nginx-ingress-tls-secret
        hosts:
          - my-nexus.mydomain.com
  
  ```
  
  My configuration is pretty basic, an ingress-nginx is configured to expose the Nexus UI, this works pretty smoothly and easily.
  
  In a later stage, I created a docker(hosted) private registry from Nexus UI with an HTTP or HTTPS listener on port 8080 (will be detailed into Problem: section below)
  Naturally, the configuration beyond create a service + an ingress.
  
  From an K8s-UI perspective, my deployment looks like this  
  [![enter image description here](https://i.sstatic.net/OK8lXl.png)](https://i.sstatic.net/OK8lXl.png)
  
  From a Nexus-UI perspective, docker private registry is simply configured like this :[![enter image description here](https://i.sstatic.net/XBOHpl.png)](https://i.sstatic.net/XBOHpl.png)
  
  **Problem:**
  
  * if my repo is configured with a 8080 **HTTPS** listener, it's not accessible and nginx raised a `502 BAD GATEWAY` error
  * if I configure a 8080 **HTTP** listener, repository is accessible and I can perform a docker login command.
  
  Furthermore, I saw on Nexus UI below HTTP/HTTPS listener  `Create an HTTP connector at specified port. Normally used if the server is behind a secure proxy.` and `Create an HTTPS connector at specified port. Normally used if the server is configured for https.`
  
  **My question are :**
  
  Does ingress-nginx is considered as a "secure proxy" ?
  
  What should be the best practices with Nexus repository ? create an HTTP repo on port 8080 or an HTTPS one ? in which case HTTP/HTTPS should be used in a repository context ?
  
  **Tags:** kubernetes, nexus, ingress-nginx
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2023-11-17. Score: 1 | Accepted answer
  
  This is most likely due to the ingress not being configured to passthrough SSL.
  
  Add this annotation to the ingress:
  
  ```
  nginx.ingress.kubernetes.io/ssl-redirect: "true"
  
  ```
  
  Additionally, make sure that the ingress controller was started with `--enable-ssl-passthrough`
  
  To answer your questions:
  Considering ingress-nginx as a "secure proxy" is for your security organization to decide based on specific deployment, and access means. However it is considered secure in many organizations
  
  You can decide on whatever port you want, but the difference between HTTP & HTTPS is where the SSL termination will occur. Using nginx as ingress will by default encrypt traffic from client to Nginx, but from nginx to Nexus will be in the clear. With the annotations given above, traffic will be encrypted end-to-end.
  
  > **Comments:**
  > **username_0**: Hey ! Sorry for my late answer i wasn't notified... After all, I finally realize that the working configuration was to set a HTTP 8080 listener. I will give some try to your solution too, i wasn't aware that encryption wasn't end-to-end by default, you give me a great advice here and i thank you again for that !  
  
  ---
  
  