Release Notes - 3.32.0¶
Please see our documentation page for more information on how to consume and deploy Big Bang. This release was primarily tested on Kubernetes 1.36 (EKS).
Upgrade Notices¶
BigBang - MR¶
Breaking. bbctl.* is gone from values.yaml and values.schema.json. The root schema sets additionalProperties: false, so any override file that still sets a bbctl: block will fail schema validation. Delete that block before upgrading.
BigBang - MR¶
Mimir now accepts UTF-8 metric and label names, and Monitoring no longer drops names containing dots before remote write. Environments receiving OTEL metrics may observe increased ingested series, cardinality, and storage usage. Review Mimir capacity and retention settings if necessary; no action is otherwise required.
BigBang - MR¶
Cert manager is now an integrated package and is enabled by default. You can disable it with the following:
certManager:
enabled: false
BigBang - MR¶
Package level falsey flux values are now respected.
BigBang - MR¶
Big Bang 3.x now supports the unified package configuration planned for Big Bang 4.x. Built-in and custom packages can be configured consistently under packages.<name> by selecting Configuration Version 1:
packageConfiguration:
version: v1
Existing top-level and addons.<name> configuration remains supported throughout Big Bang 3.x, so no immediate migration is required. When Configuration Version 1 is selected and both legacy and canonical paths configure the same package, packages.<name> takes precedence.
packageConfiguration:
version: v1
packages:
monitoring:
enabled: true
gitlab:
enabled: true
Users are encouraged to migrate and validate their configuration while still running Big Bang 3.x. An automated migration utility is provided:
scripts/migrate-values-3-to-4.sh values.yaml > values-4.x.yaml
Review and deploy the migrated values with Big Bang 3.x before upgrading to 4.x. The migration utility adds packageConfiguration.version: v1; retain this setting when upgrading. Configuration Version 1 is the durable unified-package contract discriminator and becomes the default package contract in Big Bang 4.x.
Big Bang 4.x will remove the legacy top-level package paths, the addons package mapping, and the associated 3.x compatibility layer.
Existing unversioned custom packages whose names conflict with built-in packages require manual resolution before migration. The migration utility detects these collisions and stops rather than reinterpreting the package.
For complete instructions, examples, limitations, and collision-handling guidance, see the Big Bang 4.0 package values migration guide.
Authservice - MR¶
Authservice now automatically enables ServiceAccount token mounting when a chain uses client_secret_ref, fixing startup failures when token automounting was disabled. Deployments without client_secret_ref retain the existing hardened behavior. No user action is required unless you rely on the previous explicit automountServiceAccountToken: false behavior.
Gitlab Runner - MR¶
GitLab Runner 19 is a major-version upgrade from 18.11.3 to 19.2.2; it does not upgrade the GitLab application.
- Consumers using
FF_HASH_CACHE_KEYS=truewith distributed cache should expect existing cache objects to become unreachable because Runner 19 adds a shard prefix to object paths. Keep the flag consistent across runners sharing a cache and expect cache misses and cache rebuilds after upgrading. See the upstream cache key handling guidance. - GitLab Runner manager and helper images move from Iron Bank to Verified Publisher UBI/FIPS images under
registry1.dso.mil/gitlab/gitlab-org/gitlab-runnerandregistry1.dso.mil/gitlab/gitlab-org/gitlab-runner/gitlab-runner-helper. No separate Runner configuration or data migration is required for this image-source change, but Registry1 credentials, mirrors, policies, and allowlists must permit the new paths. Update custom image overrides and keep the manager and helper versions aligned per the upstream helper-image guidance. - Review the upstream GitLab Runner 19.2.2 release and Runner changelog for site-specific impacts.
Monitoring - MR¶
Monitoring now uses cert-manager to issue and inject Prometheus Operator admission-webhook certificates by default. Big Bang now enables its integrated cert-manager package by default; ensure it is deployed and healthy before upgrading monitoring.
If you already deploy cert-manager outside of Big Bang, do not deploy a second cert-manager instance. Set certManager.enabled: false for the Big Bang cert-manager package, keep the external cert-manager deployment enabled and healthy, and ensure its CRDs and controllers are ready before upgrading monitoring. Running two cert-manager installations can cause ownership conflicts over cluster-scoped resources and competing controllers/webhooks. The monitoring package must still have access to the external cert-manager installation to issue the admission-webhook certificate.
Deployments previously using kube-webhook-certgen must either migrate to cert-manager or explicitly retain the supported patch method by setting upstream.prometheusOperator.admissionWebhooks.certManager.enabled: false, upstream.prometheusOperator.admissionWebhooks.patch.enabled: true, and providing an approved patch image. Do not disable both cert-manager modes. The webhook uses Ignore only during initial installation and switches to Fail on upgrades once the webhook should be available. For more details see the monitoring migration doc.
Sonarqube - MR¶
PostgreSQL 14 is no longer supported
SonarQube Community Build 26.8 supports PostgreSQL versions 15 through 18. Deployments currently using PostgreSQL 14 must migrate their database to a supported PostgreSQL version before upgrading SonarQube. Take and verify a database backup before performing the PostgreSQL major-version migration.
This package does not deploy or migrate PostgreSQL. Follow the PostgreSQL major-version migration documentation for the selected target version. Deployments already using PostgreSQL 15 through 18 do not require a PostgreSQL migration solely for this SonarQube upgrade.
SonarQube Community Build includes Elasticsearch 9.x
SonarQube Community Build 26.8 and later includes Elasticsearch 9 (9.4.3). Upgrading to Elasticsearch 9 triggers a full re-index. Because Lucene 10 cannot read the previous on-disk format, the index is rebuilt from scratch into a fresh es9 subdirectory. Your configured index location is preserved, but its contents are regenerated.
Twistlock - MR¶
Breaking: K8s container defender daemon set deployment tolerates all taints by default to ensure 100% coverage by default.
This change generally should not negatively impact any existing users. However, users may notice additional runtime events for containers or nodes that were not previously defended, which may require additional policy tuning to limit false positives.
To enforce a new/desired toleration, customize the defender.tolerations value.
Known Issues¶
- bbctl Dashboards
- CRON job output longer than 16kb will be split into multiple log entries when using the dockerd CRI causing invalid JSON structures to be imported into Loki. Use containerd as the CRI to ensure long log lines are parsed correctly
- bbctl-violations-dashboard / bbctl-all-logs-dashboard(Violations Logs)
- These items will not populate if you have too large of a kubernetes cluster with too many violations. There is a limit to the amount of data that can be processed. If you hit this limit and need the information, you can still use the
bbctl violationscommand to obtain the data.
- These items will not populate if you have too large of a kubernetes cluster with too many violations. There is a limit to the amount of data that can be processed. If you hit this limit and need the information, you can still use the
- Headlamp
- Attempting to login using OIDC will create a login ‘loop’. (Upstream Issue)
- Prometheus
- Target scraping for Fluentbit may encounter errors even though the pods are functioning as expected. This is expected to resolve in a future release
- Target scraping for Kube Operator may encounter errors. (Issue)
Upgrades from previous releases¶
If coming from a version pre-3.31.1, note the additional upgrade notices in any release in between. The BB team doesn’t test/guarantee upgrades from anything pre-3.31.1.
Packages¶
Click to show Packages Version Updates
| Package | Type | Package Version | BB Version |
|---|---|---|---|
| Alloy | Core | 4.3.2 |
4.3.2-bb.0 |
 Anchore Enterprise |
Addon | 5.27.1 |
3.25.1-bb.3 🔗 |
| Argocd | Addon | v3.4.5 |
10.2.1-bb.0 |
| Authservice |
Addon | 1.1.8 |
1.1.8-bb.1 🔗 |
| Cert Manager |
Core | v1.20.3 |
v1.20.3-bb.2 🔗 |
| Eck Operator | Core | 3.4.1 |
3.4.1-bb.1 |
| Elasticsearch Kibana | Core | 9.5.1 |
1.41.0-bb.0 |
| External Secrets Operator |
Addon | v2.9.0 |
2.9.0-bb.0 🔗 |
| Fluentbit |
Core | v5.0.9 |
0.57.9-bb.1 🔗 |
| Fortify | Addon | 26.2.2.0004 |
26.2.0-bb.2 |
| Gatekeeper | Core | v3.23.0 |
3.23.0-bb.0 |
| Gateway Api | Core | 1.6.1 |
1.6.1-bb.0 |
| Gitlab | Addon | 19.2.4 |
10.2.4-bb.0 |
| Gitlab Runner |
Addon | v19.2.2 |
0.91.2-bb.1 🔗 |
| Grafana | Core | 13.0.1 |
10.5.15-bb.6 |
| Harbor | Addon | 2.15.2 |
1.19.2-bb.0 |
| Headlamp | Addon | 0.44.0 |
0.44.0-bb.0 |
| Istio Cni | Core | 1.30.3 |
1.30.3-bb.0 |
| Istio Crds | Core | 1.30.3 |
1.30.3-bb.0 |
| Istio Gateway | Core | 1.30.3 |
1.30.3-bb.0 |
| Istiod | Core | 1.30.3 |
1.30.3-bb.0 |
| Keycloak | Addon | 26.7.2 |
7.3.0-bb.0 |
| Kiali |
Core | 2.30.0 |
2.30.0-bb.1 🔗 |
| Kyverno |
Core | v1.19.0 |
3.9.0-bb.0 🔗 |
| Kyverno Policies | Core | v1.13.2 |
3.3.4-bb.87 |
| Kyverno Reporter |
Core | 3.10.0 |
3.10.0-bb.0 🔗 |
| Loki |
Core | 3.7.4 |
6.55.0-bb.5 🔗 |
| Mattermost | Addon | 11.10.0 |
11.10.0-bb.0 |
| Mattermost Operator | Addon | 1.25.7 |
1.25.7-bb.3 |
| Metrics Server | Addon | 0.8.1 |
3.13.1-bb.1 |
| Mimir | Addon | 3.1.2 |
6.1.0-bb.1 |
| Minio | Addon | v7.1.1 |
7.1.1-bb.23 |
| Minio Operator | Addon | v7.1.1 |
7.1.1-bb.9 |
| Monitoring |
Core | v0.93.1 |
88.3.0-bb.1 🔗 |
| Neuvector | Core | 5.6.0 |
2.11.0-bb.2 |
| Prometheus Operator Crds | Core | v0.93.1 |
31.0.1-bb.0 |
Renovate  |
Core | 44.14.3 |
46.251.0-bb.0 |
| Sonarqube |
Addon | 2026.4.1 |
2026.4.1-bb.0 🔗 |
| Tempo | Core | 2.10.5 |
2.1.0-bb.2 |
| Thanos |
Addon | v0.42.2 |
17.6.0-bb.0 🔗 |
| Twistlock |
Core | 34.05.157 |
0.30.0-bb.0 🔗 |
| Vault |
Addon | 1.21.4 |
0.34.1-bb.0 🔗 |
| Velero | Addon | 1.18.2 |
12.1.0-bb.3 |
| Wrapper | Core | N/A |
0.4.15 |
| Ztunnel | Core | 1.30.3 |
1.30.3-bb.0 |
Changes in 3.32.0¶
Big Bang MRs¶
- !8152 updated package values to allow for sso integration testing
- !8142 Resolve “bug: Job Failed #62149361”
- !8139 Fix broken NeuVector documentation link
- !8138 reverts the decision and changes to associate package metadata with…
- !8136 Remove the retired BBCTL package from the umbrella chart
- !8128 establish one canonical package documentation model
- !8127 add gitlab deps and disable twistlock in extended values
- !8124 Added new to pull in bb-common specific values and updated a few templates to use the new approach
- !8123 remove ambient mission apps redirect page, fix links in sonarqube and testing-repo1-ci
- !8120 reorganize-configuration-guides to improve user journey through docs
- !8119 replace references to bigbang.dev with dev.bigbang.mil
- !8118 Resolve “Bug: Ambient Gateway API Dependency Follow-Up”
- !8113 fix: Resolve “External-Secrets fails without some values being defined”
- !8111 rework configuration overview into a task oriented workflow, make…
- !8108 merge duplicate fluentbit automount block
- !8106 consolidate getting started and other changes to improve user journey
- !8105 Fix Mimir OTEL metric ingestion
- !8104 Updated test-values for gitlab to include redis within same ns
- !8103 Docs correctness
- !8102 oscal control mapping summary doc
- !8100 Resolve “bug: Job Failed #61819195”
- !8098 Update file aws-k3d-script.md
- !8088 Fix/Add standard pod annotations
- !8080 update thanos authservice functionality to use bb-common
- !8075 feat: cert-manager initial promotion to integrated
- !7941 Resolve “Bug: Package-level Flux settings cannot override global settings with falsey values”
- !7937 add unified package configuration for 3.x
Anchore Enterprise¶
- !8115: anchoreEnterprise update to 3.25.1-bb.3
Click to show Changelog
# Changelog Updates
## [3.25.1-bb.3] (2026-08-03)
### Changed
- Removed duplicate and unused values from package values file
## [3.25.1-bb.2] (2026-07-22)
### Changed
- bb-common 1.1.0 -> 1.2.0
- gluon 1.1.2 -> 1.1.3
- postgresql 18.7.13 -> 18.8.0
Authservice¶
Click to show Changelog
# Changelog Updates
## [1.1.8-bb.1] (2026-08-20)
### Fixed
- Enable pod-level ServiceAccount token mounting when a chain uses `client_secret_ref`, allowing authservice to authenticate to Kubernetes while retaining ServiceAccount hardening for other deployments.
## [1.1.8-bb.0] (2026-08-10)
### Changed
- bb-common 0.14.0 -> 1.3.0
- gluon 0.9.8 -> 1.1.3
- redis 24.0.0 -> 27.0.14
- registry1.dso.mil/ironbank/istio-ecosystem/authservice 1.1.5 -> 1.1.8
- registry1.dso.mil/ironbank/opensource/redis/redis8-slim 8.4.0 -> 8.8.1
### Removed
- Removed the `authservice-waypoint` Gateway creation and the `waypoint.enabled` value. Per-application waypoints are now managed downstream by bb-common for authservice in ambient mode.
Cert Manager¶
Click to show Changelog
# Changelog Updates
## [1.20.3-bb.2] - 2026-08-13
### Changed
- Promoted cert-manager to the Big Bang integrated package track.
- Updated package documentation and umbrella integration references for the `product/packages/cert-manager` project location.
External Secrets Operator¶
- !8137: externalSecrets update to 2.9.0-bb.0
Click to show Changelog
# Changelog Updates
## [2.9.0-bb.0] (2026-08-25)
### Changed
- bb-common updated from 1.3.1 to 1.5.0
- external-secrets updated from 2.8.0 to 2.9.0
- gluon updated from 1.1.3 to 1.1.6
- registry1.dso.mil/ironbank/opensource/external-secrets/external-secrets updated from v2.8.0 to v2.9.0
### Removed
- Removed the waitJob, which functioned more as a test; the package tests already exercise that functionality.
Fluentbit¶
- !8126: fluentbit update to 0.57.9-bb.1
Click to show Changelog
# Changelog Updates
## [0.57.9-bb.1] (2026-08-24)
### Changed
- Reimplemented the Kyverno ClusterPolicies as GeneratingPolicies
Gitlab Runner¶
Click to show Changelog
# Changelog Updates
## [0.91.2-bb.1] (2026-08-24)
### Changed
- Rewrote the Kyverno secret-sync policies (`sync-gitlab-runner-secret`, `sync-gitlab-root-password`) as `GeneratingPolicy` resources.
## [0.91.2-bb.0] (2026-08-20)
### Changed
- Updated [gitlab-runner](https://gitlab.com/gitlab-org/charts/gitlab-runner) `0.88.3` -> `0.91.2`
- Updated bb-common `1.0.2` -> `1.4.0`
- Updated gluon `1.1.1` -> `1.1.6`
- Migrated GitLab Runner from `registry1.dso.mil/ironbank/gitlab/gitlab-runner/gitlab-runner:v18.11.3` to the Verified Publisher image `registry1.dso.mil/gitlab/gitlab-org/gitlab-runner:ubi-fips-v19.2.2`
- Migrated GitLab Runner Helper from `registry1.dso.mil/ironbank/gitlab/gitlab-runner/gitlab-runner-helper:v18.11.3` to the coupled Verified Publisher image `registry1.dso.mil/gitlab/gitlab-org/gitlab-runner/gitlab-runner-helper:ubi-fips-x86_64-v19.2.2`
- Removed the legacy `useTini` override so the Verified Publisher runner uses its packaged `dumb-init` executable
- Added a writable build-home volume for the non-root Verified Publisher helper image
- Added standard application name and version labels to ephemeral Runner job pods so they satisfy Big Bang admission policies
- Enabled GitLab 19's external PostgreSQL, Redis, and object-storage dependencies in the package CI profile
- Added the Repo1 service entry required by the CI-only Cypress harness
- Updated the Runner Cypress test for GitLab 19 project lifecycle flows and security-patch alerts
- Removed the deprecated `bigbang.dev/applicationVersions` annotation and legacy `tests/images.txt` inventory
- Removed obsolete Renovate managers for the retired application-version annotation and image inventory
Keycloak¶
- !8130: keycloak update to 7.3.0-bb.0
Kiali¶
- !8143: kiali update to 2.30.0-bb.1
Click to show Changelog
# Changelog Updates
## [2.30.0-bb.1] (2026-08-27)
### Changed
- updated Cypress test to pass the Keycloak URL to performKeycloakLogin
Kyverno¶
- !8112: kyverno update to 3.9.0-bb.0
Click to show Changelog
# Changelog Updates
## [3.9.0-bb.0] (2026-08-21)
### Changed
- gluon 1.1.5 -> 1.1.6
- kyverno 3.8.2 -> 3.9.0
- registry1.dso.mil/ironbank/opensource/kyverno v1.18.2 -> v1.19.0
- registry1.dso.mil/ironbank/opensource/kyverno/kyverno/background-controller v1.18.2 -> v1.19.0
- registry1.dso.mil/ironbank/opensource/kyverno/kyverno/cleanup-controller v1.18.2 -> v1.19.0
- registry1.dso.mil/ironbank/opensource/kyverno/kyverno/readiness-checker v1.18.2 -> v1.19.0
- registry1.dso.mil/ironbank/opensource/kyverno/kyverno/reports-controller v1.18.2 -> v1.19.0
- registry1.dso.mil/ironbank/opensource/kyverno/kyvernocli v1.18.2 -> v1.19.0
- registry1.dso.mil/ironbank/opensource/kyverno/kyvernopre v1.18.2 -> v1.19.0
- removed values from values.yaml that are no longer used
Kyverno Reporter¶
Click to show Changelog
# Changelog Updates
## [3.10.0-bb.0] (2026-08-28)
### Changed
- policy-reporter 3.9.1 -> 3.10.0
- registry1.dso.mil/ironbank/nirmata/policy-reporter/policy-reporter-ui 2.7.3 -> 2.8.1
- registry1.dso.mil/ironbank/opensource/kyverno/policy-reporter 3.9.0 -> 3.10.0
## [3.9.0-bb.2] (2026-08-25)
### Changed
- bb-common 1.4.0 -> 1.5.0
- gluon 1.1.3 -> 1.1.6
- registry1.dso.mil/ironbank/nirmata/policy-reporter/policy-reporter-ui 2.7.1 -> 2.7.3
Loki¶
- !8132: loki update to 6.55.0-bb.5
- !8114: loki update to 6.55.0-bb.4
- !8089: loki update to 6.55.0-bb.3
Click to show Changelog
# Changelog Updates
## [6.55.0-bb.5] (2026-08-25)
### Fixed
- Removed unused values from package values file
## [6.55.0-bb.4] (2026-08-17)
### Fixed
- Removed a duplicate `memcached.containerSecurityContext` key in `chart/values.yaml` that made the file invalid YAML and caused Renovate's `helm-values` manager to extract 0 dependencies
- Removed `fsGroup` from `memcached.containerSecurityContext` and `memcachedExporter.containerSecurityContext`; `fsGroup` is a pod-level field only and was discarded by the API server. Volume ownership continues to come from `memcached.podSecurityContext.fsGroup`
## [6.55.0-bb.3] (2026-07-28)
### Changed
- bb-common 0.14.1 -> 1.4.0
- gluon 0.9.8 -> 1.1.5
- registry1.dso.mil/ironbank/bigbang/grafana/loki-canary 3.7.1 -> 3.7.4
- registry1.dso.mil/ironbank/grafana/grafana-enterprise-logs v3.6.5 -> v3.6.11
- registry1.dso.mil/ironbank/ironbank/opensource/grafana/enterprise-logs-provisioner 3.6.5 -> 3.6.11
- registry1.dso.mil/ironbank/kiwigrid/k8s-sidecar 2.5.0 -> 2.10.0
- registry1.dso.mil/ironbank/opensource/grafana/loki 3.7.1 -> 3.7.4
- registry1.dso.mil/ironbank/opensource/kubernetes/kubectl v1.34.6 -> v1.35.7
- registry1.dso.mil/ironbank/opensource/memcached/memcached 1.6.41 -> 1.6.45
- registry1.dso.mil/ironbank/opensource/nginx/nginx 1.30.0 -> 1.30.4
- registry1.dso.mil/ironbank/opensource/prometheus/memcached-exporter v0.15.3 -> v0.16.0
- rollout-operator 0.46.0 -> 0.50.1
### Fixed
- The monolith-test-values.yaml needed to be udpated to correctly deploy monolith strategy for loki
- Disabled the alloy bbtests for both monolith and test-values.yaml
- Added a `.markdown-link-check.json` and `.markdownlint.json` to pass the markdown linting
Monitoring¶
- !8121: monitoring update to 88.3.0-bb.1
Click to show Changelog
# Changelog Updates
## [88.3.0-bb.1] (2026-08-21)
### Changed
- Switched Prometheus Operator admission webhook certificate management to cert-manager by default, disabled the upstream patch job by default, nulled default admission webhook patch images that are not available from Iron Bank, and relaxed admission webhook failures only during first install to avoid bootstrap deadlock before the operator webhook service has endpoints.
Sonarqube¶
- !8140: sonarqube update to 2026.4.1-bb.0
Click to show Changelog
# Changelog Updates
## [2026.4.1-bb.0] (2026-08-27)
### Changed
- bb-common updated from 1.3.1 to 1.5.0
- gluon updated from 1.1.3 to 1.1.6
- registry1.dso.mil/ironbank/sonarsource/sonarqube/sonarqube-community-build updated from 26.7.0.124771 to 26.8.0.126808
- sonarqube updated from 2026.4.0 to 2026.4.1
Thanos¶
- !8093: thanos update to 17.6.0-bb.0
Click to show Changelog
# Changelog Updates
## [17.6.0-bb.0] - 2026-07-29
### Changed
- Updated thanos 17.4.0 -> 17.6.0
- bb-common 0.14.1 -> 1.4.0
- common 2.36.0 -> 2.41.0
- gluon 0.9.8 -> 1.1.5
- registry1.dso.mil/ironbank/opensource/thanos/thanos v0.41.0 -> v0.42.2
- Updated instructions in DEVELOPMENT_MAINTENANCE that were incorrect
- Updated new vendor-helm-deps.sh to automate steps in DEVELOPMENT_MAINTENANCE guide
- Removed applicationVersions from Chart.yaml
Twistlock¶
- !8086: twistlock update to 0.30.0-bb.0
Click to show Changelog
# Changelog Updates
## [0.30.0-bb.0] (2026-08-17)
### Changed
- bb-common 1.3.1 -> 1.4.0
- gluon 1.1.3 -> 1.1.5
- registry1.dso.mil/ironbank/twistlock/console/console 34.04.160 -> 34.05.157
- registry1.dso.mil/ironbank/twistlock/defender/defender 34.04.160 -> 34.05.157
## [0.29.0-bb.0] (2026-08-17)
### Changed
- **Breaking:** K8s container defender ds deployment tolerates all taints by default to ensure 100% coverage by default
- Defender-only deployment now allows specified tolerations instead of hardcoded values
- Added defender-only mode documentation at `docs/DEFENDER_ONLY.md`
## [0.28.0-bb.4] (2026-07-31)
### Changed
- `chart/scripts/contrib/scripts/get-all-vuln-reports.sh` fixes min file size checks and host report filtering on collection
Vault¶
- !8101: vault update to 0.34.1-bb.0
Click to show Changelog
# Changelog Updates
## [0.34.1-bb.0] (2026-08-19)
### Changed
- gluon 1.1.5 -> 1.1.6
- registry1.dso.mil/ironbank/hashicorp/vault/vault-k8s v1.7.5 -> v1.7.6
- vault 0.34.0 -> 0.34.1
Helpful Links¶
As always, we welcome and appreciate feedback from our community of users. Please feel free to:
- Open issues here
- Join our Mattermost channel
- Join our Slack
- Check out the documentation for guidance on how to get started
Future¶
Don’t see your feature and/or bug fix? Check out our epics for estimates on when you can expect things to drop, and as always, feel free to comment or create issues if you have questions, comments, or concerns.