Apply eMudhra CA Fix to Older Nexus Repository HA Operator Releases

This guidance applies when all of the following conditions are true:

Operator 3.97.2-1 and later include the eMudhra remediation in the Nexus Repository application image.

This procedure does not apply to Nexus Repository deployments that use Helm or other Kubernetes deployment methods.

Eight eMudhra intermediate certificate authority private keys were compromised. Nexus Repository versions whose bundled Java trust store includes the affected CA roots require updated certificate trust data.

Sonatype has released patched Nexus Repository application images for the affected release lines.

Existing Operator bundles are immutable and continue to reference the application image that was published with the bundle. You can apply the remediation to an older supported Operator release by overriding the Nexus Repository application image in the NexusRepo custom resource.

Sonatype recommends upgrading to Nexus Repository HA Certified Operator 3.97.2-1 or later when possible.

Upgrading to 3.97.2-1 moves Nexus Repository to the 3.97 release line and includes the patched application image.

When you need to remain on your current release line, update only the Nexus Repository application image by following the procedure in this page.

Before you begin, make sure that you have the following:

If your OpenShift cluster uses a disconnected or mirrored image registry, see Disconnected and Mirrored OpenShift Clusters before continuing.

If your deployment uses imagePullSecrets, no change to those secrets is needed for this procedure. Image pull secrets only need updating when you upgrade the Operator itself.

Use the patched Red Hat-certified Nexus Repository application image for your Nexus Repository release line.

Use the image digest rather than a mutable tag so that your deployment uses the exact patched image identified by Sonatype.

The patched image is published at: registry.connect.redhat.com/sonatype/nexus-repository-manager

For information about the eMudhra remediation and fixed Nexus Repository versions, see Compromised eMudhra Intermediate CA Certificates.

If your OpenShift cluster cannot pull images directly from registry.connect.redhat.com , mirror the patched Nexus Repository application image to your internal registry before updating the NexusRepo custom resource.

The existing mirror may not include the patched image. Operator bundles list the images they reference in relatedImages, and older bundles still list the original, unpatched application image digest. The patched image must be mirrored separately.

To mirror the patched image, use oc image mirror:

oc image mirror \
  registry.connect.redhat.com/sonatype/nexus-repository-manager@sha256:<DIGEST> \
  <INTERNAL_REGISTRY>/<PATH>/nexus-repository-manager@sha256:<DIGEST>

Alternatively, add the patched image as an additional entry in your oc-mirror ImageSetConfiguration and re-run your mirror pipeline.

After mirroring, confirm that your image mirror rules cover registry.connect.redhat.com/sonatype/nexus-repository-manager so that the digest can be resolved from your internal registry.

Set spec.statefulset.container.imageName in your NexusRepo custom resource to the patched application image for your Nexus Repository release line.

For example:

spec:
  statefulset:
    container:
      imageName: registry.connect.redhat.com/sonatype/nexus-repository-manager@sha256:<DIGEST>

Replace <DIGEST> with the verified digest for your release line.

The Operator uses the image specified in imageName for the Nexus Repository application deployment. After you save the change, the Operator performs a rolling restart of the Nexus Repository pods. Plan this update in a maintenance window.

After the NexusRepo custom resource has been updated, verify that the Nexus Repository application pods use the patched image digest.

oc get pods -l app=nxrm -o jsonpath='{.items[*].spec.containers[?(@.name=="nxrm-app")].image}'

The image reference reported for each Nexus Repository application pod must match the patched digest you selected in the previous step.

The published Operator bundle for an older release continues to contain its original Nexus Repository application image reference.

Changing spec.statefulset.container.imageName does not change the published Operator bundle. It changes the image used by the Nexus Repository application deployment.

As a result, tools that inspect the immutable Operator bundle may continue to report the original application image reference even after the running Nexus Repository pods have been updated.

The patched Nexus Repository application images remove trust in the affected certificate roots used by the compromised eMudhra certificate chains.

As a result, a remote server whose certificate chain depends only on one of the affected roots may no longer establish a trusted TLS connection with Nexus Repository after you apply the fix.

If an upstream connection fails after applying the remediation, verify the certificate chain used by the remote server. Do not disable certificate validation or restore the affected certificate roots.

Upgrading to Operator 3.97.2-1 or later is the recommended long-term solution.

The newer Operator release includes the patched Nexus Repository application image, so you do not need to use the application-image override described in this page.

After upgrading, review your NexusRepo custom resource and remove the spec.statefulset.container.imageName override if it was added only for this remediation.