aws-samples/nexus-oss-on-aws

Deploy Sonatype Nexus Repository OSS on AWS with well architecture.

Sonatype Nexus Repository OSS on Amazon EKS

Deploy Sonatype Nexus Repository OSS via Helm on EKS.

• Use EFS via EFS CSI driver, PV and PVC as Nexus3 data storage
• Create a dedicated S3 bucket as Nexus3 blobstore
• Use external DNS to create record in Route53 for ingress domain name
• Use ACM to get certificate of domain name

Architecture diagram

Usage

Prerequisites

• An AWS account
• Nodejs LTS installed, such as 12.x or 14.x
• Install Docker Engine
• A public hosted zone in Route53(optional)
• Has default VPC with public and private subnets cross two available zones at least, NAT gateway also is required
• Install dependencies of app

yarn install --check-files --frozen-lockfile
npx projen

Deployment

Deploy with custom domain

npx cdk deploy --parameters NexusAdminInitPassword=<init admin password of nexus3>  --parameters DomainName=<the hostname of nexus3 deployment>

Deploy with Route53 managed domain name

npx cdk deploy --parameters NexusAdminInitPassword=<init admin password of nexus3> --parameters DomainName=<nexus.mydomain.com> -c r53Domain=<mydomain.com>

or

npx cdk deploy --parameters NexusAdminInitPassword=<init admin password of nexus3> --parameters DomainName=<nexus.mydomain.com> --parameters R53HostedZoneId=<id of route53 hosted zone> -c enableR53HostedZone=true

Deploy to an existing VPC

This solution will create new VPC across two AZs with public, private subnets and NAT gateways by default.

You can deploy the solution to the existing VPC by below options,

npx cdk deploy <other options> -c vpcId=<existing vpc id>

# or deploy to the default vpc
npx cdk deploy <other options> -c vpcId=default

NOTE: the existing VPC must have public and private subnets across two AZs and route the internet traffic of private subnets to NAT gateways.

Deploy with internal load balancer

npx cdk deploy -c internalALB=true

Customize the version of Kubernetes

The solution will create Kubernetes 1.20 by default. You can specify other Kubernetes versions like below,

npx cdk deploy <other options> --parameters KubernetesVersion=1.19

NOTE: 1.20, 1.19 and 1.18 are allowed versions. You can NOT enable auto configuration feat when creating an EKS cluster with version 1.19. See this issue for detail.

Deploy to China regions

Due to AWS load balancer has different policy requirement for partitions, you need speicfy the target region info via context region to pick the corresponding IAM policies.

npx cdk deploy <other options> -c region=cn-north-1

Deploy to existing EKS cluster

The solution could deploy the Nexus Repository OSS to the existing EKS cluster. There are some prerequisites that your EKS cluster must meet,

• the version of EKS cluster is v1.17+,
• the EKS cluster has EC2 based node group which is required by EFS CSI driver,
• the ARN of an IAM role mapped to the system:masters RBAC role. If the cluster you are using was created using the AWS CDK, the CloudFormation stack has an output that includes an IAM role that can be used. Otherwise, you can create an IAM role and map it to system:masters manually. The trust policy of this role should include the the arn:aws::iam::${accountId}:root principal in order to allow the execution role of the kubectl resource to assume it. Then you can follow the eksctl guide to map the IAM role to Kubernetes RBAC,
• the OpenId connect provider ARN of your EKS. You can find the ARN from IAM's console. If your cluster does not have an OpenId connect provider, you can follow the eksctl guide to create one,
• the ARN of the IAM role associated with the nodegroup in your cluster. You can find the ARN of node group from EKS console.

Below is an example to deploy Nexus Repository OSS to an existing EKS cluster with public domain configured,

npx cdk deploy -c vpcId=vpc-12345 -c importedEKS=true -c eksClusterName=the-cluster-name -c eksKubectlRoleArn=arn:aws:iam::123456789012:role/eks-kubectl-role -c eksOpenIdConnectProviderArn=arn:aws:iam::123456789012:oidc-provider/oidc.eks.ap-east-1.amazonaws.com/id/12345678 -c nodeGroupRoleArn=arn:aws:iam::123456789012:role/eksctl-cluster-nodegroup-ng-NodeInstanceRole-123456 --parameters NexusAdminInitPassword=<the strong password> -c enableAutoConfigured=true --parameters DomainName=<the custom domain> --parameters R53HostedZoneId=<id of r53 zone> -c enableR53HostedZone=true

Init admin password

You must specify the default init admin password when deploying this solution. The password must satisfy below requirements,

• at least 8 characters
• must contain at least 1 uppercase letter, 1 lowercase letter, and 1 number
• can contain special characters

Auto configuration

Nexus3 supports using script to configure the Nexus3 service, for example, BlobStores, Repositories and so on. The script feature is disabled by default since Nexus3 3.21.2. You can opt-in auto configuration feature of this solution like below that will enable script feature of Nexus.

npx cdk deploy <other options> -c enableAutoConfigured=true

It would automatically configure the fresh provisioning Nexus3 with below changes,

• Delete all built-in repositories
• Delete default file based blobstore
• Create a new blobstore named s3-blobstore using the dedicated S3 bucket created by this solution with never expiration policy for artifacts

How to clean

Run below command to clean the deployment or delete the SonatypeNexus3OnEKS stack via CloudFormation console.

npx cdk destroy

NOTE: you still need manually delete the EFS file system and S3 bucket created by this solution. Those storage might contain your data, be caution before deleting them.

Quick deployment

It's an official solution of AWS China regions. You can quickly deploy this solution to below regions via CloudFormation,

Deploy Nexus Repository OSS as a public service

Region name	Region code	Launch
Global regions(switch to the region you want to deploy)	us-east-1(default)
AWS China(Beijing) Region	cn-north-1
AWS China(Ningxia) Region	cn-northwest-1

Deploy Nexus Repository OSS as an internal service inside VPC

Region name	Region code	Launch
Global regions(switch to the region you want to deploy)	us-east-1(default)
AWS China(Beijing) Region	cn-north-1
AWS China(Ningxia) Region	cn-northwest-1

Security

See CONTRIBUTING for more information.

License

This library is licensed under the MIT-0 License. See the LICENSE file.

Also this application uses below open source projects,

• Nexus OSS
• travelaudience/kubernetes-nexus
• Nexus3 Helm chart in Oteemo/charts
• AWS Load Balancer Controller
• EKS Charts
• aws-efs-csi-driver
• external-dns
• nexus3-cli

nexus-oss-on-aws's Issues

install ALB ingress controller via Helm chart maintained by EKS

kubernetes-sigs/aws-load-balancer-controller#1271 (comment)

Use Case

Proposed Solution

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

deploy Nexus OSS into existing EKS cluster

deploy Nexus OSS into existing EKS cluster,

the cluster should satisfy below prerequisites,

the cluster running on both public and private subnets if exposing Nexus via public ALB
provide the subnet ids for ingress using ALB ingress controller or tag the subnets with proper tags

Use Case

Proposed Solution

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

Fail on creating EFS mount target if the AZ has more than private subnets

Got below error in cloudformation events,

fsmt-c203f45f already exists in stack xxx

Reproduction Steps

Error Log

1. create a vpc with more than one private subnets in same AZ
2. deploy solution to above vpc

Environment

• CDK CLI Version:
• Framework Version:
• Node.js Version:
• OS :

Other

---

This is 🐛 Bug Report

encrypt the s3 bucket and efs filesytem by default

Encrypt the storage by default for security best practice.

Use Case

Proposed Solution

• encrypt S3 bucket for blobstore
• encrypt EFS filesystem for nexus data

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

provisioning new VPC when deploying

Provide an option provisioning a new VPC for EKS cluster if the user prefers.

Use Case

Proposed Solution

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

Reporting a vulnerability

Hello!

I hope you are doing well!

We are a security research team. Our tool automatically detected a vulnerability in this repository. We want to disclose it responsibly. GitHub has a feature called Private vulnerability reporting, which enables security research to privately disclose a vulnerability. Unfortunately, it is not enabled for this repository.

Can you enable it, so that we can report it?

Thanks in advance!

PS: you can read about how to enable private vulnerability reporting here: https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository

support both custom domain and ALB domain

The solution creates an ALB for proxy the requests. It should works both scenarios,

• use ALB domain directly
• use custom domain with ACM SSL certificate, also register its record to R53 if R53 zone is specified as well

Use Case

Proposed Solution

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

bump cdk to v2

Use Case

Proposed Solution

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

bump aws load balancer controller to 2.4.0+

Use Case

Since 2.4.0 of aws load balancer controller supports network API v1, the beta version will be removed in k8s 1.22.

Proposed Solution

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

upgrade default k8s cluster to 1.20

https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html#kubernetes-1.20

Use Case

Proposed Solution

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

gracefully clean the deployment

We have problem to cleanup this deployment via removing the CloudFormation stack or running cdk destroy.

Because the Helm chart creates an ALB resource out of CloudFormation scope. The ALB must be removed before the ACM certificate is removed.

Create custom resource to remove ALB resource before ACM certificate is going to be cleaned.

Use Case

Proposed Solution

• remove ALB before deleting ACM certificate
• change s3 bucket policy to RETAIN

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

serverless support with aws fargate

Amazon EKS just announced its latest support for EFS on Faragate on Aug 17. Does this project support this now?

New – AWS Fargate for Amazon EKS now supports Amazon EFS
https://aws.amazon.com/tw/blogs/aws/new-aws-fargate-for-amazon-eks-now-supports-amazon-efs/

Use Case

Proposed Solution

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

preconfigure nexus deployment

Provide below out of box configurations of Nexus deployment,

• create a S3 blobstore using the s3 bucket provisioning by this deployment
• create proxy repos using OpenTUNA repo and using s3 blobstore, such as Pypi, CentOS, Debian, Ubuntu

Use Case

Proposed Solution

• use config map support of travelaudience/kubernetes-nexus

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

instance size selector

Provide an option to select the instance size of Nexus deployment

Use Case

Proposed Solution

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

deploy nexus to intranet only

Provide an option to deploy Nexus's ALB as intranet or internet

Use Case

Proposed Solution

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

specify the init password of nexus oss

It’s a best practice to specify the strong init password for Nexus OSS when deploying it.

Use Case

Do not use the default password of Nexus OSS.

Proposed Solution

• require the init admin password of Nexus OSS
• use regex pattern to validate the password to satisfy the password policy

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

remove EOL eks versions

Use Case

remove the EOL EKS versions

https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html#kubernetes-release-calendar

Proposed Solution

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

incorrect verifying the valid init password with number

Deploying the stack with password satisfying the constraint like below,

Abcdefg0

Above valid input is considered as invalid input.

Reproduction Steps

see above

Error Log

Environment

• CDK CLI Version:
• Framework Version:
• Node.js Version:
• OS :

Other

---

This is 🐛 Bug Report

make nexus as a construct and publish to npm/pypi

Use Case

the users can reuse the construct to build custom application

Proposed Solution

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

Support of usage existing external-dns, efs-csi-driver and aws-load-balancer-controller in existing EKS cluster

Use Case

For the moment we already have existing EKS cluster with alb-ingress-controller and external-dns controller with custom configuration managed by separate IaC solution.
To add this nexus solution in our cluster, we need to have ability to use existing controllers instead of deployment from nexus-oss-on-aws repo.

Proposed Solution

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request

support using existing vpc by vpc id

Support deploying nexus oss to existing vpc by given vpc id

Use Case

Proposed Solution

Other

• 👋 I may be able to implement this feature request

---

This is a 🚀 Feature Request