<p>I ran the following command:</p>

<pre><code>kubectl create secret tls nexus-tls --cert cert.crt --key privateKey.pem
</code></pre>

<p>where <code>cert.crt</code> contains my certificate and <code>privateKey.pem</code> contains my private key (provisioned using CloudFlare).</p>

<p>I then installed the <code>stable/sonatype-nexus</code> Helm chart with the following configuration:</p>

<pre><code>nexusProxy:
  env:
    nexusDockerHost: containers.&lt;&lt;NEXUS_HOST&gt;&gt;
    nexusHttpHost: nexus.&lt;&lt;NEXUS_HOST&gt;&gt;

nexusBackup:
  enabled: true
  nexusAdminPassword: &lt;&lt;PASSWORD&gt;&gt;
  env:
    targetBucket: gs://&lt;&lt;BACKUP_BUCKET_NAME&gt;&gt;
  persistence:
    storageClass: standard

ingress:
  enabled: true
  path: /*
  annotations:
    kubernetes.io/ingress.allow-http: true
    kubernetes.io/tls-acme: true
    kubernetes.io/ingress.class: gce
    kubernetes.io/ingress.global-static-ip-name: &lt;&lt;STATIC_IP_ADDRESS_NAME&gt;&gt;
  tls:
    enabled: true
    secretName: nexus-tls

persistence:
  storageClass: standard
  storageSize: 1024Gi

resources:
  requests:
    cpu: 250m
    memory: 4800Mi
</code></pre>

<p>by running the command:</p>

<pre><code>helm install -f values.yaml stable/sonatype-nexus
</code></pre>

<p>The possible configuration values for this chart are documented <a href="https://github.com/helm/charts/tree/master/stable/sonatype-nexus#configuration" rel="nofollow noreferrer">here</a>.</p>

<p>When I visit <code>http://nexus.&lt;&lt;NEXUS_HOST&gt;&gt;</code>, I am able to access the Nexus Repository. However, when I access <code>https://nexus.&lt;&lt;NEXUS_HOST&gt;&gt;</code>, I receive mixed content warnings, because HTTP resources are being served.</p>

<p>If I set the <code>nexusProxy.env.enforceHttps</code> environment variable to true, when I visit <code>https://nexus.&lt;&lt;NEXUS_HOST&gt;&gt;</code>, I get a response back which looks like:</p>

<pre><code>HTTP access is disabled. Click here to browse Nexus securely: https://nexus.&lt;&lt;NEXUS_HOST&gt;&gt;.
</code></pre>

<p>How can I ensure that Nexus is served securely? Have I made a configuration error, or does the issue lie elsewhere?</p>

Charles Salmon
<p>For legacy reasons I must stand up nexus on GKE. While this question doesn't directly state it is on Google Cloud, the <code>gs://</code> and <code>ingress.class: gce</code> suggest it was; despite the older answer from Xuan Huy being about AWS.</p>
<p>I had a heck of a time getting Nexus TLS to work on GKE, but I finally managed. Google Ingress resources are not the most stable. If you're iterating, they can wedge up and you might find finalizers unable to complete due to getting stuck on L4 ILB cleanup. Things got so screwed up in GCP with just innocent deploy and delete cycles that I had to trash projects and start new ones to test and finally get to a working combination.</p>
<p>My Helm <code>values.yaml</code> has the following. Note I am using Terraform also, so my <code>${variables}</code> are replaced by Terraform with my particular environment settings before running Helm.</p>
<pre><code>service:
  type: ClusterIP
  annotations:
    cloud.google.com/neg: '{&quot;ingress&quot;: true}'
    cloud.google.com/backend-config: '{&quot;ports&quot;: {&quot;8081&quot;:&quot;sonatype-backendcfg&quot;}}' 

ingress:
  ingressClassName: null      # on GCP, null this, and use annotations instead
  enabled: true
  hostPath: /                 # don't use /* that is suggested multiple places
  hostRepo: ${sonatype_dns_name}  # public facing FQDN
  annotations:
    ingress.gcp.kubernetes.io/pre-shared-cert: &quot;${gce_ssl_cert_name}&quot;
    kubernetes.io/ingress.class: &quot;gce-internal&quot;
    kubernetes.io/ingress.allow-http: &quot;false&quot;

    # unrelated hint - I use external-dns for DNS registration
    external-dns.alpha.kubernetes.io/hostname: &quot;${sonatype_dns_name}.&quot;

  tls:
    - secretName: &quot;${tls_secret_name}&quot;
      hosts:
        - &quot;${sonatype_cluster_dns_name}&quot;  # the svc.cluster.local FQDN
</code></pre>
<p>Before running Helm, my installer places the TLS certs in the GCE cert store for the ILB to use.</p>
<p>Also before Helm, <code>${tls_secret_name}</code> kubesecret is prepared with the cert in key names <code>tls.crt</code> and <code>tls.key</code> (many other apps use this pattern).</p>
<p>I also have a <code>backendconfig</code> resource:</p>
<pre><code>apiVersion: cloud.google.com/v1                                                                                                                                 
kind: BackendConfig                                                                                                                                             
metadata:                                                                                                                                                       
  name: sonatype-backendcfg                                                                                                                                     
  namespace: sonatype                                                                                                                                           
spec:                                                                                                                                                           
  healthCheck:                                                                                                                                                  
    checkIntervalSec: 30                                                                                                                                        
    healthyThreshold: 1                                                                                                                                         
    port: 8081                                                                                                                                                  
    requestPath: /service/rest/v1/status                                                                                                                        
    timeoutSec: 15                                                                                                                                              
    type: HTTP                                                                                                                                                  
    unhealthyThreshold: 10   
</code></pre>
<p>The folks at Nexus are not supporting this scenario much longer, so we're working on moving to Harbor so we can cancel our Nexus license.</p>
