Configure Nexus Docker registry

I have deployed Bigbang Release 1.31.0. I am trying to setup a private docker registry on Nexus repository manager. I cant seem to find much information on how to set this up. Below is the screenshot of my configmap for nexus. Here is the error i get when i try running docker login

$ docker login nexus-docker.<domain>.io
Username: admin
Password: 
Error response from daemon: Get "https://nexus-docker.<domain>.io/v2/": x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0

@jasonkrause @micah.nagel I'd appreciate any insight on this. Thank you

I would validate that in the Nexus UI under your docker repo setup HTTP is checked and port is set to 5000. Make sure HTTPS is NOT checked. Also double check that the cert set for your ingressgateway includes nexus-docker.<domain>.io.

Unfortunately we don't have any docs on this currently.

so i dont have ingress enabled on Nexus. how do i check if my ingressgateway includes nexus-docker.<domain>.io?

The ingress gateway is provisioned by Istio and is how VirtualServices "work". So you likely have a public-ingressgateway service and pod in istio-system. The services are the LoadBalancers that provide you with access to all of the Big Bang apps. If you check for a public-cert secret that is the cert I am talking about. It seems like maybe your cert is the issue here based on the error message?

oh ok that makes sense. thank you Micah. However, I just checked my gateway and i have set *.bigbang.<domain>.io. I checked nexus UI and made sure https is unchecked and http is set to 5000 for my docker-hosted repo

So in your error you mentioned nexus-docker.<domain>.io - the way you copied it at least it is missing the "subdomain" for bigbang. In other words it should be set to nexus-docker.bigbang.<domain>.io. That could be issue, unless you just edited that out?

If you leave off the .bigbang the Istio LB would not know what to do with it since it doesn't match the set hosts pattern.

Oh that's my bad for not editing correctly. I did actually edited the subdomain(bigbang) out from that error. i have the docker registry set up as nexus-docker.bigbang.<domain>.io

we are using wildcard certificate

https://jfrog.com/knowledge-base/general-what-should-i-do-if-i-get-an-x509-certificate-relies-on-legacy-common-name-field-error/

It looks like this is the same error you are seeing - basically the cert needs to have subjectAltName set. I don't think this is anything on the Big Bang side, seems more like an issue with the cert you are using?

Yeah probably I will try this out and see if it resolves. Thanks for looking into this

closed