Skip to content

Big Bang 4.0 bb-common subchart migration

Move package chart overrides for istio, networkPolicies, and routes under bb-common. For example, an umbrella override becomes:

packages:
  mattermost:
    values:
      bb-common:
        networkPolicies:
          enabled: true
        istio:
          enabled: true

Direct Helm installations use the same bb-common block without the packages.mattermost.values nesting. The subchart renders networking resources directly and validates its own values schema.

The umbrella no longer translates networkPolicies.controlPlaneCidr and networkPolicies.vpcCidr for this package. Configure networkPolicies.egress.definitions.kubeAPI explicitly, or use the package values.bb-common.networkPolicies.egress.definitions.kubeAPI override.

Replace istio.hardened configuration with supported bb-common.istio settings; the package no longer runs the legacy hardened-key migration.

Do not merge this migration until the final Big Bang 3.x release has shipped.

Replace legacy values.istio.chat.enabled, hosts, and gateways with values.bb-common.routes.inbound.chat.enabled, hosts, and gateways.

For standalone installs, set global.domain instead of domain for the default chat hostname. Route host templates now run in bb-common’s context; use .Values.global.domain or explicit hosts. The environment Secret uses that same context so its site URL agrees with the rendered chat route.

Standalone SSO installs must set bb-common.routes.outbound.sso.hosts to their provider hostname when it differs from login.dso.mil; the child chart cannot read the parent chart’s sso.auth_endpoint. The umbrella supplies the SSO host.

Remove the retired istio.injection setting. With bb-common.istio.enabled: true, bb-common.istio.ambient.enabled: false selects sidecar mode; set ambient to true for ambient mode. The gossip Service is rendered only for sidecar mode.

The ServiceMonitor defaults to HTTPS with the existing /etc/prom-certs Istio certificate paths for sidecar mode with strict mTLS. Ambient mode, a disabled mesh, and permissive mTLS default to HTTP without that TLS configuration. monitoring.serviceMonitor.scheme and tlsConfig remain available for explicit overrides; the scheme’s empty default selects the mode-appropriate behavior.