Cannot pull Docker images, and updating Nexus whitelist is not enough to change firewall rules

[TonyWildish-BH]

docker run hello-world on any VM fails, unable to pull the image.

The reason is that Docker changed their distribution to use cloudfront about a year or so ago, and the Nexus whitelist is out of date. Adding *.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com to the whitelist is enough to fix this...

BUT!

...adding that domain to the whitelist in locals.tf in Nexus, rebuilding and updating the service does not update the firewall, you have to delete/re-deploy Nexus. I would expect that it would be sufficient to simply update it.

So there are two bugs:

• Nexus needs the dockerhub cloudflare r2 domain whitelisted
• the whitelist is not propagated to the firewall in a service update.

Azure TRE release version (e.g. v0.14.0 or main):
v0.21.0, but the issue persists in the HEAD by inspection of the code.

Deployed Azure TRE components - click the (i) in the UI:

[JC-wk]

Hi,
The underlying issue here is that the nexus vm is a one time creation and there is no method to update it.
Maybe it can be containerised or improved so it can be updated in-place however it would need to be more configurable as each org will have their own requirements for repos etc.

[TonyWildish-BH]

I don't see that the VM is an issue, I'm quite happy for that to sit unchanged through an update but I would naively expect that the firewall rules would be updated by this action if they've changed in the template.

If applying the update action to Nexus does nothing, regardless of what's changed in the template, that's a breach of reasonable expectation for the user. I'd prefer it to fail with an error saying "I can't do that, destroy and re-create if you really want a newer version".

Either way, the bigger issue for me is that Nexus fails to pull Docker images if the whitelist is not updated with the cloudflarestorage entry.

[JC-wk]

Ok, I see what you are saying, yes the firewall should get updated, did the property "nexus_allowed_fqdns_list" get updated in the Details page after the upgrade?
I will give it a test myself and see what happens

[TonyWildish-BH]

that I didn't check, I just deleted/re-deployed.

[JC-wk]

Hi, I've added the URL and I had a different error relating to terraform template, once I got past that I was able to get it to upgrade to work, and also added the URLs in #4896, I will create a PR for this.