Skip to content

Big Bang Docs

Istio Hardening

Initializing search

big-bang/bigbang

Docs
Values
Packages
Library Charts
Release Notes
Training
Contributing
Blog

Big Bang Docs

big-bang/bigbang

Docs
Docs
- Overview
- Getting Started
  Getting Started
- FAQ
- Concepts
  Concepts
- Installation
  Installation
  - Overview
  - Environments
    Environments
    
    Overview
    
    Airgap Hauler
    
    Airgap Registry Migration
    
    Airgap
    
    Resource-constrained Example
    
    Extra Package Deployment
    
    SSO Quickstart
- Configuration
  Configuration
  - Overview
  - Ambient Mode
  - Ambient Egress Gateway
  - Values Reference (generated)
  - Default Credentials
  - Gateways
  - Network Policies
  - Postrenderers
  - Trust-manager Bundles
  - Production Considerations
    Production Considerations
    
    Overview
    
    GitLab
    
    Vault
    
    Keycloak
- Migration
  Migration
- Operations
  Operations
  - Overview
  - Maintenance
    Maintenance
    
    Overview
    
    Renovate
    
    Renovate Maintenance
  - Troubleshooting
    Troubleshooting
    
    Overview
    
    Performance
  - Backup and Restore
  - Monitoring
  - Upgrades
- Packages
  Packages
  - Overview
  - Addons
    Addons
    
    Overview
    
    Anchore
    
    Argo CD
    
    Authservice
    
    External Secrets Operator
    
    Fortify
    
    GitLab
    
    Harbor
    
    Headlamp
    
    Keycloak
    
    Mattermost
    
    Metrics Server
    
    Mimir
    
    MinIO
    
    SonarQube
    
    Thanos
    
    Vault
    
    Velero
  - Community
    Community
    
    Overview
  - Core
    Core
    
    Overview
    
    cert-manager
    
    Elasticsearch-Kibana
    
    Fluent Bit
    
    Gateway API
    
    Grafana Alloy
    
    Istio
    
    Istio Egress Gateway
    
    Kiali
    
    Kyverno
    
    Loki
    
    Monitoring
    
    NeuVector
    
    OPA Gatekeeper
    
    Renovate
    
    Tempo
    
    Twistlock
    
    Ztunnel
  - Package Development
    Package Development
    
    Overview
  - Categorization
  - Reference Package
- Tutorials
  Tutorials
  - Overview
  - Mission Applications with Istio Ambient Mode
    Mission Applications with Istio Ambient Mode
    
    Overview and Path Selection
    
    1. Prepare an Application
    
    2A. Deploy with the packages Key
    
    2B. Deploy with Argo CD
  - BigBang Deployment Uninstall Cleanup
  - Pod Usage In Grafana
  - Signed Helm Repositories
- Community
  Community
  - Overview
  - ADRs
    ADRs
    
    Overview
    
    0001 Public ADRs
    
    0002 Package Standardization
    
    0003 Single Package Mapping
    
    0004 Alloy Replacing Promtail
    
    0005 Passthrough Chart
    
    0006 Drift Detection
    
    0007 Dev Defaults
    
    0008 Generate Images Metadata from Explicit Container Image References
    
    0009 Confidential
    
    0010 Upstream Values README Documentation
    
    0011 Unified Package Configuration and Metadata
    
    0012 Standard Big Bang Package Architecture
    
    0013 Retain Istio Sidecar Support in Big Bang 4.0
    
    0014 Consume bb-common as a Helm Subchart
  - Development
    Development
    
    Overview
    
    Package Lifecycle
    Package Lifecycle
    
    Overview
    
    Onboarding
    
    Integration
    
    Offboarding
    
    Package Integration
    Package Integration
    
    Overview
    
    Big Bang Merge Request
    
    bb-common Subchart Integration
    
    Database
    
    Documentation
    
    Flux
    
    Helm Standards
    
    Monitoring
    
    Ownership
    
    Pipeline
    
    Policy Enforcement
    
    SSO
    
    Object Storage
    
    Supported
    
    Testing
    
    Upstream
    
    AWS K3d Script
    
    Repository Agent Instructions
    
    CI Workflow
    
    Dev OCI Workflow
    
    Develop Package
    
    Development Environment
    
    K3d Keys for Testing
    
    Big Bang Storage Options
    
    MDO Partybus Pipelines
    
    OSCAL Contributing
    
    Postrenderers
    
    Release Process
    
    Testing a Package Against Big Bang
    
    Testing Repo1 CI
    
    Testing
    
    Testing Shell Scripts
    
    Helm Unit Tests
    
    Template Self-testing
    
    Vendor Distribution Integration
Values
Packages
Packages
- Overview
- Package References
  Package References
  - alloy
    alloy
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
    
    Istio Integration
    
    Development and Maintenance
  - anchore-enterprise
    anchore-enterprise
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Anchore
    
    Node Affinity & Anti-Affinity with Anchore
    
    Changes needed for Big Bang and Ironbank Images
    
    Big Bang Anchore 4.1 Release Notes
    
    Anchore Engine Helm Chart
    
    To upgrade the Anchore Package
    
    IstioHardened
    
    Anchore Keycloak Integration
    
    Anchore Metrics
    
    Anchore Enterprise
    
    Security
    
    Troubleshooting Guide
  - argocd
    argocd
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    ArgoCD
    
    Setting Affinity, nodeSelector, and tolerations within ArgoCD Chart
    
    Development and Maintenance Guide
    
    Kibana / ECK log notes
    
    Istio Hardening
    
    ArgoCD Keycloak Configuration
    
    Prometheus & ArgoCD
    
    Disaster Recovery
    
    Argo CD
    
    Security
    
    Testing your Package Branch against Bigbang before Package Merge
    
    Troubleshooting Guide
  - authservice
    authservice
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
    
    Ambient Mode
    
    Additional Issuers
    
    Chains with Domains
    
    Network Policies
    
    Metrics
    
    Backup
    
    Troubleshooting
  - cert-manager
    cert-manager
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
    
    Installation and Issuers
    
    Development and Maintenance
    
    Let's Encrypt Testing
  - eck-operator
    eck-operator
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
    
    Operator scheduling
    
    Istio integration
    
    Network policies
    
    Development and maintenance
  - elasticsearch-kibana
    elasticsearch-kibana
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Documentation
    
    Big Bang integration
    
    Log access
    
    SSO and OIDC
    
    Keycloak
    
    Network policies
    
    Mesh security
    
    Scheduling
    
    Node prerequisites
    
    Snapshots
    
    Metrics
    
    Troubleshooting
    
    Maintenance
  - external-secrets
    external-secrets
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
    
    Deployment
    
    AWS Integration
    
    Vault Integration
  - fluentbit
    fluentbit
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Integration Overview
    
    Troubleshooting
    
    Scheduling
    
    Elasticsearch Indexes
    
    Istio
    
    Development and Maintenance
  - fortify
    fortify
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Development & Maintenance
    
    IstioHardened
    
    Fortify App
    
    Fortify Software Security Center
    
    Testing your Package Branch against Bigbang before Package Merge
  - gateway-api
    gateway-api
    
    README
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
    
    Maintenance
  - gitlab
    gitlab
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
    
    Big Bang changes
    
    Operational production settings
    
    GitLab 19 upgrade
    
    PostgreSQL setup
    
    Keycloak SSO
    
    Kubernetes resources
    
    Node affinity
  - gitlab-runner
    gitlab-runner
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Files that require bigbang integration testing
    
    Gitlab CI Piplines grafana dashboard migration
    
    Dev overrides
    
    Gitlab Runner
    
    Configuration for rootless podman and buildah
    
    Testing your Package Branch against Bigbang before Package Merge
  - grafana
    grafana
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Development and Maintenance Guide for the Grafana Package
    
    Grafana Enterprise
    
    Istio and Network Hardening
    
    Overview
  - harbor
    harbor
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Files that require bigbang integration testing
    
    Istio Hardening
    
    Network Policies
    
    Harbor
    
    Deploying Harbor in Production
    
    Testing your Package Branch against Bigbang before Package Merge
  - headlamp
    headlamp
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Notices
    
    Headlamp RBAC
    
    Headlamp OIDC integration
    
    Headlamp
  - istio-cni
    istio-cni
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Developer Maintenance
    
    Istio CNI
  - istio-crds
    istio-crds
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
  - istio-egress-gateway
    istio-egress-gateway
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Development and Maintenance
    
    Istio Egress Gateway
  - istio-gateway
    istio-gateway
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
    
    Security
    
    Traffic management
    
    Troubleshooting
  - istiod
    istiod
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    How to upgrade the Istiod Package chart
    
    Istiod
  - keycloak
    keycloak
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Keycloak Configuration
    
    Keycloak Package Chart Maintenance
    
    ISTIO HARDENED
    
    Keycloak Big Bang integration
  - kiali
    kiali
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Affinity
    
    Kiali Development Maintenance Guide
    
    IstioHardened
    
    Default Token Login
    
    Kiali
  - kyverno
    kyverno
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    How to update the Kyverno Package chart
    
    Migration from Gatekeeper to Kyverno
    
    Policy management
    
    Kyverno
  - kyverno-policies
    kyverno-policies
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    How to update Kyverno Policies
    
    Mutating Policies
    
    ServiceAccountTokenHardening
    
    Kyverno Policy Exception Guide
    
    Kyverno Policies vs. Gatekeeper Policies in Big Bang
    
    Kyverno Policy Integration Tests
    
    Policy Naming Convention
    
    Kyverno Policies
    
    Kyverno Policy Overview
    
    Testing Kyverno Policies
  - kyverno-reporter
    kyverno-reporter
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    How to upgrade the Kyverno Policy Reporter Package chart
    
    Kyverno Monitoring
    
    Introduction to Kyverno Reporting
  - loki
    loki
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
    
    Production
    
    Grafana Enterprise Logs
    
    Migrations
    
    Log Entry Deletion
    
    Istio Hardening
  - mattermost
    mattermost
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
    
    Keycloak SSO
    
    Scheduling
  - mattermost-operator
    mattermost-operator
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Node Affinity & Anti-Affinity with Mattermost Operator
    
    How to Upgrade this Package
    
    Istio configuration after the bb-common migration
    
    Big Bang 4.0 bb-common subchart migration
    
    Developer guide
    
    Mattermost Operator
  - metrics-server
    metrics-server
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    BBCHANGES
    
    Metrics Service Development and Maintenance Guide
    
    Metrics Server
  - mimir
    mimir
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Mimir 6.x Upgrade Guide
    
    Mimir Development and Maintenance Guide
    
    Grafana Mimir
  - minio
    minio
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    MinIO tenant
    
    Affinity
    
    Backups and Disaster Recovery
    
    Metrics
    
    Troubleshooting
    
    Logging
    
    Keycloak
  - minio-operator
    minio-operator
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    How to Upgrade Minio Operator Package
    
    Affinity
    
    Backups and Disaster Recovery
    
    Logging
    
    Keycloak
    
    MinIO Operator
    
    Metrics
    
    Troubleshooting
  - monitoring
    monitoring
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
    
    Alertmanager
    
    Prometheus Operator
    
    Prometheus Security
    
    Prometheus Best Practices
    
    Backup and Recovery
    
    Istio mTLS Metrics
    
    SNMP Exporter
    
    Development and Maintenance
  - neuvector
    neuvector
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
    
    OIDC configuration
    
    Prometheus metrics
  - policy
    policy
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    To upgrade Gatekeeper package
    
    Affinity
    
    Constraint Annotations
    
    OPA Constraint Framework
    
    Constraint Templates
    
    OPA Gatekeeper Violation Exceptions
    
    Gatekeeper in Big Bang
    
    Policy Library
    
    Rego
    
    Security with OPA Gatekeeper
    
    OPA Gatekeeper Testing
  - prometheus-operator-crds
    prometheus-operator-crds
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    How to upgrade to Prometheus-Operator-CRDs chart
    
    Prometheus Operator CRDs
  - renovate
    renovate
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Changes for Big Bang
    
    Upgrading the Renovate Package
    
    Istio Hardening
    
    Network Policies
    
    Renovate
  - sonarqube
    sonarqube
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
    
    SAML SSO
    
    Prometheus
    
    Network Policies
    
    Affinity
    
    ECK
    
    Istio Hardening
    
    Party Bus
    
    Test package against Big Bang
  - tempo
    tempo
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
    
    Production
    
    Istio Hardening
  - thanos
    thanos
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Overview
  - twistlock
    twistlock
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    Twistlock / Prisma Cloud Compute
    Twistlock / Prisma Cloud Compute
    
    Overview
    
    Initialization
    
    Defender-only mode
    
    OIDC SSO
    
    SAML and Keycloak
    
    Monitoring
    
    Troubleshooting
    
    Istio hardening
    
    Backup
    
    Container models
    
    Elastic integration
    
    Workload App and API Security
    
    k3d
  - vault
    vault
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    How to upgrade the Vault Package chart
    
    IstioHardened
    
    Vault With Prometheus
    
    Vault
    
    BigBang KMS Auto Unseal
    
    Injecting Secrets into Kubernetes Pods via Vault Agent Containers
    
    Vault Keycloak integration.
    
    Monitoring in Vault
    
    networkPolicies
    
    Vault
    
    Vault configuration for production high availability
  - velero
    velero
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Node Affinity & Anti-Affinity with Velero
    
    Changes needed for Iron Bank Images and Big Bang
    
    Big Bang Velero Package Maintenance Guide
    
    Velero
    
    Custom rbac
    Custom rbac
    
    Background
    
    clusterRole
    
    clusterRoleBinding
    
    Role
    
    roleBinding
    
    Backup
    Backup
    
    Background
    
    Full cluster backup and restore
    
    Label Based backup and restore
    
    Namespace Backup and restore
    
    Scheduled Backup
    
    Troubleshooting and additional links
  - wrapper
    wrapper
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    How to upgrade the Wrapper Package chart
    
    IstioHardened
    
    Custom Helm Chart Deployment and the “Package Wrapper”
    
    Overview
  - ztunnel
    ztunnel
    
    README
    
    Values
    
    Contributing
    
    Changelog
    
    More Info
    More Info
    
    Files that require bigbang integration testing
    
    IstioHardened
    
    Keycloak dev
    
    Ztunnel
Library Charts
Library Charts
- Overview
- bb-common
  bb-common
  - README
  - Contributing
  - Changelog
  - More Info
    More Info
    
    Overview
    
    Network Policies
    
    Self Testing
    
    Routes
    
    Authorization Policies
    
    Extra Objects
    
    Resource Graph
    
    Migration Guide
    
    Integration Guide
    
    Istio Resources
- gluon
  gluon
  - README
  - Contributing
  - Changelog
  - More Info
    More Info
    
    BigBang Package README Template
    
    BB Test Templates
    
    Running Cypress Testing
    
    Wait Job Templates
Release Notes
Training
Training
- Docs
  Docs
  - Home
  - Big Bang 101
    Big Bang 101
    
    Overview
    
    What is Platform One?
    
    Security in Platform One
    
    Layered Architecture
    
    Security Tools
    
    Summary
  - Pre-Install Prep
    Pre-Install Prep
    
    Overview
    
    New Platform One User Guide
    
    Verify you can pull from Repo1 and IronBank
    
    How to Set up AWS to use with Big Bang
    
    Summary
  - Installation
    Installation
    
    Overview
    
    Software Installation and Verification
    
    Big Bang Customer Deployment
    
    Summary
  - Packages
    Packages
    
    Overview
    
    Package Development
    
    Pipeline Overview
    
    OCI Artifacts
    OCI Artifacts
    
    OCI Artifacts Overview
    
    Dev Workflow with OCI
    
    Summary
  - Labs
    Labs
    
    Overview
    
    Bad Pods Lab
    
    Encryption
    
    Flux Lab: Install Flux to a Cluster
    
    Helm Lab
    
    Expose a mock mission app using istio ingress gateway Lab
    
    Kubernetes Lab
    
    Kustomize Lab
    
    VI Basics
    
    Summary
  - k8s
    k8s
    
    Overview
    
    The Basics
    
    Package Managers
    
    Operators
    
    GitOps w/ Flux
    
    Service Mesh w/ Istio
    
    Metrics w/ Prometheus
    
    Secrets w/ SOPS
    
    Consolidated Logging
    
    Summary
  - Istio
    Istio
    
    Index
    
    Docs
    Docs
    
    Welcome!
    
    Getting Started
    
    Environment validation
    
    Istio Architecture
    
    The application Lab
    
    Ingress
    
    Ingress Lab
    
    Observability
    
    Observability Lab
    
    Security
    
    09 2 security
    
    09 3 security
    
    Security Lab
    
    Traffic Shifting
    
    Traffic Shifting Lab
    
    Sidecar resource
    
    Enforcing egress traffic using Istio’s authorization policies
    
    Install Istio
    
    Deeper into sidecar injection
    
    Congratulations
    
    Labs
    Labs
    
    Observability - Telemetry and Logs
    
    Creating a deployment and using a Gateway to expose it
    
    Enable TLS
    
    Envoy Demo
    
    Envoy Filters
    
    Access control
    
    Advanced traffic shifting
    
    Failure injection
    
    Simple traffic shifting
  - User Guides and Further Reading
    User Guides and Further Reading
    
    Further Reading
    
    User Guides
  - Training Feedback
Contributing
Blog
Blog
- Overview
- Archive
  Archive
  - 2026
  - 2025
  - 2024
  - 2023

package sonarqube 2026.5.1003-bb.0

Istio Hardening¶

Refer to the bb-common documentation for details.

2026-02-19 by Christopher Nowicki

Made with Material for MkDocs

About Contact Privacy