Release Notes - 3.35.1¶

Please see our documentation page for more information on how to consume and deploy Big Bang. This release was primarily tested on Kubernetes 1.36 (EKS).

Upgrade Notices¶

BigBang - MR ¶

Cortex Tenant is now an available Big Bang package. Cortex Tenant is not included in the umbrella but follow the example values file linked to setup a working integration with Alloy and Mimir.

Cortex Tenant is not installed or configured automatically by Big Bang. To use Alloy → Cortex Tenant → Mimir, apply the example values, choose the tenant label, and adjust the transport for ambient or non-Istio deployments. For a monitoring installation without Prometheus, set monitoring.prometheusMetrics.enabled: false and monitoring.values.upstream.prometheus.enabled: false (or the corresponding packages.monitoring values with packageConfiguration.version: v1).

BigBang - MR ¶

Vault can now use either a TLS-terminated gateway or a passthrough gateway. We recommend migrating to TLS termination at Big Bang’s public gateway because this will become the default behavior in Big Bang 4.0. If the public and passthrough gateways use different addresses, update the DNS record for vault.<domain> to point to the public gateway.

To use Big Bang’s public gateway, clear any explicit gateway selection and remove the Vault certificate and key:

addons:
  vault:
    ingress:
      gateway: ""
      cert: ""
      key: ""

When both cert and key are empty, TLS terminates at the public gateway and traffic is forwarded to Vault over HTTP. Supplying both values continues to configure Vault for TLS passthrough.

The raft.config key will need to be updated accordingly in order to successfully migrate and the vault pods will need to be manually restarted for the change to take full effect.

As an example, this is being used with Vault using the passthrough gateway:

    raft:
      enabled: true
      setNodeId: true

      config: |
        ui = true

        listener "tcp" {
          tls_disable = false
          address = "[::]:8200"
          cluster_address = "[::]:8201"
          tls_cert_file = "/vault/tls/tls.crt"
          tls_key_file  = "/vault/tls/tls.key"
          telemetry {
            unauthenticated_metrics_access = true
          }
        }

        storage "raft" {
          path = "/vault/data"

          retry_join {
            leader_api_addr = "https://vault-vault-0.vault-vault-internal:8200"
            leader_client_cert_file = "/vault/tls/tls.crt"
            leader_client_key_file = "/vault/tls/tls.key"
            leader_tls_servername = "vault.dev.bigbang.mil"
          }

          retry_join {
            leader_api_addr = "https://vault-vault-1.vault-vault-internal:8200"
            leader_client_cert_file = "/vault/tls/tls.crt"
            leader_client_key_file = "/vault/tls/tls.key"
            leader_tls_servername = "vault.dev.bigbang.mil"
          }

          retry_join {
            leader_api_addr = "https://vault-vault-2.vault-vault-internal:8200"
            leader_client_cert_file = "/vault/tls/tls.crt"
            leader_client_key_file = "/vault/tls/tls.key"
            leader_tls_servername = "vault.dev.bigbang.mil"
          }
        }
...

While the following would be used when using the TLS terminated gateway:

    raft:
      enabled: true
      setNodeId: true

      config: |
        ui = true

        listener "tcp" {
          tls_disable = true
          address = "[::]:8200"
          cluster_address = "[::]:8201"
          telemetry {
            unauthenticated_metrics_access = true
          }
        }

        storage "raft" {
          path = "/vault/data"

          retry_join {
            leader_api_addr = "http://vault-vault-0.vault-vault-internal:8200"
            leader_tls_servername = "vault.dev.bigbang.mil"
          }

          retry_join {
            leader_api_addr = "http://vault-vault-1.vault-vault-internal:8200"
            leader_tls_servername = "vault.dev.bigbang.mil"
          }

          retry_join {
            leader_api_addr = "http://vault-vault-2.vault-vault-internal:8200"
            leader_tls_servername = "vault.dev.bigbang.mil"
          }
        }
...

BigBang - MR ¶

Big Bang 3.x to 4.x migration script now includes the functionality to migrate decrypted values in a K8s Secret

BigBang - MR ¶

N/A - no breaking changes. The dependsOn key retains its original additive behavior. The new dependsOnOverride key is an opt-in replacement path.

Alloy - MR ¶

For a standalone Alloy deployment writing through Cortex Tenant, enable networkPolicies.egress.from.alloy-metrics.to.k8s.cortex-tenant/cortex-tenant:8080. The Big Bang umbrella enables this connection when its Cortex Tenant destination is selected.

Alloy - MR ¶

When alloy-singleton is enabled, this release now applies non-root, PSS Restricted-compatible security contexts to the Alloy and config-reloader containers by default. No configuration changes are required. The singleton remains disabled by default. Consumers with explicit security-context overrides should verify that those overrides remain compatible with their cluster policy.

Keycloak - MR ¶

If utilizing the keycloak plugin, you will need to also update to the following keycloak plugin image registry1.dso.mil/ironbank/big-bang/p1-keycloak-plugin:3.7.32 to facilitate this keycloak version.
If updating to the latest plugin and utilizing the p1 loginTheme there may be some additional modifications that need to take place. Review the MR here

One such modifications is modifying the following in the realm.json

  "loginTheme": "p1-sso",
  "accountTheme": "p1-sso",
  "adminTheme": "p1-sso",

would need to be modified to the following

  "loginTheme": "p1-sso-v2",
  "accountTheme": "p1-sso-v2",
  "adminTheme": "p1-sso-v2",

Mimir - MR ¶

For a standalone Mimir deployment receiving writes from Cortex Tenant, enable networkPolicies.ingress.to.mimir-distributor:8080.from.k8s.cortex-tenant/cortex-tenant. The Big Bang umbrella enables this connection when Alloy is configured to write through Cortex Tenant.

Mimir - MR ¶

MinIO deprecation: Big Bang MinIO support in Mimir will be removed in Mimir 6.2.0-bb.0. If you are currently using minioObjectStorage.enabled: true, plan migration to an alternative S3-compatible backend before upgrading to Mimir 6.2.0-bb.0.

For in-cluster dev/test environments, Big Bang Garage is the supported replacement. See the Garage Package Integration document for guidance.

No action required for deployments already using an external S3 backend (s3ObjectStorage.enabled: true).

Twistlock - MR ¶

The SAML init volume changes from secret to projected; mounted path and file names are unchanged.
No action needed at default values.

Known Issues¶

Headlamp
Attempting to login using OIDC will create a login ‘loop’. (Upstream Issue)
Kyverno may block ztunnel when enabling Istio ambient mode
When deploying or enabling Istio ambient mode, the ztunnel HelmRelease may fail with:
```
restrict-host-path-write:
  autogen-require-readonly-hostpath:
    validation failure: hostPath volumes must be mounted as readOnly.
```
The built-in ztunnel policy exception exempts the Pod validation rule but omits the automatically generated DaemonSet rule. This affects configurations where Kyverno generates controller rules for restrict-host-path-write. Existing name-based policy exclusions can mask the issue, so some deployments and CI configurations may succeed.

This issue is confirmed in all Big Bang 3.x versions past 3.24. This issue is fixed in 4.0

Workaround

Add the following to your existing Big Bang values. This creates a supplementary exception scoped to ztunnel and preserves the built-in exceptions:
```
kyvernoPolicies:
  values:
    additionalPolicyExceptions:
      ztunnel-hostpath-write:
        enabled: true
        kind: PolicyException
        namespace: kyverno
        spec:
          exceptions:
            - policyName: restrict-host-path-write
              ruleNames:
                - require-readonly-hostpath
                - autogen-require-readonly-hostpath
          match:
            any:
              - resources:
                  kinds:
                    - Pod
                    - DaemonSet
                  namespaces:
                    - istio-system
                  names:
                    - ztunnel
                    - "ztunnel-*"
```
Apply the values through your normal GitOps workflow. After the Kyverno Policies release creates the exception, retry or reconcile the ztunnel HelmRelease. The workaround does not require a new Big Bang release.

Upgrades from previous releases¶

If coming from a version pre-3.34.0, note the additional upgrade notices in any release in between. The BB team doesn’t test/guarantee upgrades from anything pre-3.34.0.

Packages¶

Click to show Packages Version Updates

Package	Type	Package Version	BB Version
Alloy	Core	`4.3.2`	`4.3.2-bb.2` :link:
Anchore Enterprise	Addon	`6.1.1`	`4.1.2-bb.2`
Argocd	Addon	`v3.4.5`	`10.2.1-bb.2`
Authservice	Addon	`1.1.8`	`1.1.8-bb.3`
Cert Manager	Core	`v1.20.3`	`v1.20.3-bb.2`
Eck Operator	Core	`3.5.0`	`3.5.0-bb.2` :link:
Elasticsearch Kibana	Core	`9.5.5`	`1.44.0-bb.1` :link:
External Secrets Operator	Addon	`v2.12.0`	`2.12.0-bb.0` :link:
Fluentbit	Core	`v5.1.3`	`0.58.3-bb.0` :link:
Fortify	Addon	`26.2.2.0004`	`26.2.0-bb.6`
Gatekeeper	Core	`v3.23.1`	`3.23.1-bb.1` :link:
Gateway Api	Core	`1.6.2`	`1.6.2-bb.0`
Gitlab	Addon	`19.4.2`	`10.4.2-bb.0` :link:
Gitlab Runner	Addon	`v19.2.2`	`0.91.2-bb.3` :link:
Grafana	Core	`13.2.1`	`13.2.4-bb.0`
Harbor	Addon	`2.15.2`	`1.19.2-bb.3` :link:
Headlamp	Addon	`0.45.0`	`0.45.0-bb.1` :link:
Istio Cni	Core	`1.31.1`	`1.31.1-bb.0` :link:
Istio Crds	Core	`1.31.1`	`1.31.1-bb.0` :link:
Istio Egress Gateway	Core	`N/A`	`0.1.5-bb.0` :link:
Istio Gateway	Core	`1.31.1`	`1.31.1-bb.0` :link:
Istiod	Core	`1.31.1`	`1.31.1-bb.0` :link:
Keycloak	Addon	`26.8.0`	`7.3.2-bb.1` :link:
Kiali	Core	`2.32.0`	`2.32.0-bb.0`
Kyverno	Core	`v1.19.1`	`3.9.1-bb.1` :link:
Kyverno Policies	Core	`v1.13.2`	`3.3.4-bb.87`
Kyverno Reporter	Core	`3.10.0`	`3.10.0-bb.2`
Loki	Core	`3.7.8`	`6.55.0-bb.9` :link:
Mattermost	Addon	`11.11.0`	`11.11.0-bb.0`
Mattermost Operator	Addon	`1.25.9`	`1.25.9-bb.1`
Metrics Server	Addon	`0.9.0`	`3.14.0-bb.1` :link:
Mimir	Addon	`3.2.1`	`6.2.1-bb.1` :link:
Minio	Addon	`v7.1.1`	`7.1.1-bb.25` :link:
Minio Operator	Addon	`v7.1.1`	`7.1.1-bb.11`
Monitoring	Core	`v0.94.0`	`91.4.1-bb.1`
Neuvector	Core	`5.6.2`	`2.11.2-bb.0`
Prometheus Operator Crds	Core	`v0.93.1`	`31.0.1-bb.0`
Renovate	Core	`44.97.2`	`46.316.0-bb.0`
Sonarqube	Addon	`26.9.0.129388`	`2026.4.1-bb.4`
Tempo	Core	`2.10.5`	`2.1.0-bb.3`
Thanos	Addon	`v0.42.4`	`17.6.0-bb.3`
Twistlock	Core	`34.05.157`	`0.31.0-bb.0` :link:
Vault	Addon	`1.21.4`	`0.34.1-bb.2`
Velero	Addon	`1.18.4`	`12.2.1-bb.0` :link:
Wrapper	Core	`N/A`	`0.4.15`
Ztunnel	Core	`1.31.1`	`1.31.1-bb.0` :link:

Changes in 3.35.1¶

Big Bang MRs¶

!8365 (merged) Update Keycloak test realm SHA
!8348 (merged) Adding check to loop in append_package_order function in migrate-values script
!8346 (merged) Document Alloy to Cortex Tenant to Mimir integration
!8343 (merged) Add istio-egress-gateway entry to package-mapping.yaml
!8339 (merged) updates to migration scripts and docs
!8336 (merged) Add appProtocol: tcp to Keycloak JGroups ports so the HA test passes on Istio 1.31.1
!8334 (merged) Docs/trust manager bundle guide
!8331 (merged) Bumped the test-values.yaml keycloak plugin to 3.7.32
!8308 (merged) Updated Vault template to allow either passthrough or public gateway
!8307 (merged) Edit ingress-certs.yaml
!8287 (merged) Update Troubleshooting/Installation Page
!8285 (merged) Add additional use cases to 3.x to 4.x migration script
!8269 (merged) Add SSO CA support for Kyverno Reporter
!8233 (merged) Add custom dependencies to built-in HelmReleases

Alloy¶

!8355 (merged): alloy update to 4.3.2-bb.2
!8329 (merged): alloy update to 4.3.2-bb.1

Click to show Changelog

# Changelog Updates

## [4.3.2-bb.2] (2026-10-09)
### Added
- Define opt-in `alloy-metrics` egress to Cortex Tenant for tenant-scoped remote writes, disabled by default.
- Verify the enabled egress policy's source and destination selectors in Helm unit tests.

## [4.3.2-bb.1] (2026-10-05)
### Fixed
- Set non-root security contexts for the `alloy-singleton` collector and its config-reloader so the cluster-events workload satisfies Kyverno enforcement without consumer overrides.
- Mount a writable `emptyDir` at the Alloy storage path so the singleton remains compatible with a read-only root filesystem.

Eck Operator¶

!8328 (merged): eckOperator update to 3.5.0-bb.2

Click to show Changelog

# Changelog Updates

## [3.5.0-bb.2] (2026-10-06)
### Changed
- bb-common updated from 1.5.0 to 1.6.1

Elasticsearch Kibana¶

!8356 (merged): elasticsearchKibana update to 1.44.0-bb.1

Click to show Changelog

# Changelog Updates

## [1.44.0-bb.1] (2026-10-06)
### Changed
- bb-common 1.6.0 -> 1.6.1
- gluon 1.1.8 -> 1.1.9
- registry1.dso.mil/ironbank/elastic/elasticsearch/elasticsearch 9.5.4 -> 9.5.5
- registry1.dso.mil/ironbank/elastic/kibana/kibana 9.5.4 -> 9.5.5
- Added `istio.serviceEntries.custom` keycloak-tls (Protocol: TLS) in `tests/test-sso-values.yaml` to fix SSO cypress connectivity to Keycloak under REGISTRY_ONLY Istio sidecar; Protocol: TLS enables SNI-based passthrough required by the Cypress browser proxy OIDC redirect flow
- Updated SSO Cypress selectors from `input[id="kc-login"]` and `input[id="kc-accept"]` to `#kc-login` and `#kc-accept` - p1-keycloak-plugin 3.7.x changed these from input[type="submit"] to button elements
- Removed redundant "should derive the version from the image tag by default" helm unit tests from `elasticsearch_test.yaml` and `kibana_test.yaml`; "should follow a customized image tag" already covers the version-derivation logic without hardcoding the current release version

External Secrets Operator¶

!8344 (merged): externalSecrets update to 2.12.0-bb.0

Click to show Changelog

# Changelog Updates

## [2.12.0-bb.0] (2026-10-06)
### Changed
- bb-common 1.6.0 -> 1.6.1
- external-secrets 2.11.0 -> 2.12.0
- gluon 1.1.8 -> 1.1.9
- registry1.dso.mil/ironbank/opensource/external-secrets/external-secrets v2.11.0 -> v2.12.0

Fluentbit¶

!8311 (merged): fluentbit update to 0.58.3-bb.0

Click to show Changelog

# Changelog Updates

## [0.58.3-bb.0] (2026-10-01)
### Changed
- bb-common 1.5.0 -> 1.6.0
- fluent-bit 0.58.2 -> 0.58.3
- gluon 1.1.7 -> 1.1.8
- registry1.dso.mil/ironbank/opensource/fluent/fluent-bit v5.1.2 -> v5.1.3

Gatekeeper¶

!8313 (merged): gatekeeper update to 3.23.1-bb.1

Click to show Changelog

# Changelog Updates

## [3.23.1-bb.1] (2026-10-02)
### Changed
- bb-common 1.5.0 -> 1.6.0
- gluon 1.1.6 -> 1.1.9
- registry1.dso.mil/ironbank/opensource/kubernetes/kubectl v1.35 -> v1.37

Gitlab¶

!8357 (merged): gitlab update to 10.4.2-bb.0

Click to show Changelog

# Changelog Updates

## [10.4.2-bb.0] (2026-10-14)
### Changed
- bb-common 1.6.0 -> 1.6.1
- gitlab 10.4.1 -> 10.4.2
- gitlab-app-version 19.4.1 -> 19.4.2
- gluon 1.1.8 -> 1.1.10
- registry1.dso.mil/gitlab/gitlab-org/build/cng/certificates v19.4.1 -> v19.4.2
- registry1.dso.mil/gitlab/gitlab-org/build/cng/cfssl-self-sign v19.4.1 -> v19.4.2
- registry1.dso.mil/gitlab/gitlab-org/build/cng/gitaly v19.4.1 -> v19.4.2
- registry1.dso.mil/gitlab/gitlab-org/build/cng/gitaly-init-cgroups v19.4.1 -> v19.4.2
- registry1.dso.mil/gitlab/gitlab-org/build/cng/gitlab-base v19.4.1 -> v19.4.2
- registry1.dso.mil/gitlab/gitlab-org/build/cng/gitlab-geo-logcursor v19.4.1 -> v19.4.2
- registry1.dso.mil/gitlab/gitlab-org/build/cng/gitlab-kas v19.4.1 -> v19.4.2
- registry1.dso.mil/gitlab/gitlab-org/build/cng/gitlab-mailroom v19.4.1 -> v19.4.2
- registry1.dso.mil/gitlab/gitlab-org/build/cng/gitlab-pages v19.4.1 -> v19.4.2
- registry1.dso.mil/gitlab/gitlab-org/build/cng/gitlab-sidekiq-ee v19.4.1 -> v19.4.2
- registry1.dso.mil/gitlab/gitlab-org/build/cng/gitlab-toolbox-ee v19.4.1 -> v19.4.2
- registry1.dso.mil/gitlab/gitlab-org/build/cng/gitlab-webservice-ee v19.4.1 -> v19.4.2
- registry1.dso.mil/gitlab/gitlab-org/build/cng/gitlab-workhorse-ee v19.4.1 -> v19.4.2
- registry1.dso.mil/gitlab/gitlab-org/build/cng/kubectl v19.4.1 -> v19.4.2
- registry1.dso.mil/ironbank/afdco/docker/busybox 1.37.0 -> 1.38.0
- registry1.dso.mil/ironbank/big-bang/cypress 16.1.0 -> 16.1.1
- registry1.dso.mil/ironbank/big-bang/devops-tester 1.3 -> 1.4
- Migrated Cypress tests from removed `Cypress.env()` access to Cypress 16 `cy.env()` access.

## [10.4.1-bb.1] (2026-09-29)
### Changed
- Added test coverage for: version check, git clone, registry image pull and delete, generic package upload/download, toolbox backup, and prometheus scrape targets.

Gitlab Runner¶

!8332 (merged): gitlabRunner update to 0.91.2-bb.3

Click to show Changelog

# Changelog Updates

## [0.91.2-bb.3] (2026-10-06)
### Changed
- Make the Grafana dashboard ConfigMap name release-specific so multiple GitLab Runner releases can coexist in one cluster.

Harbor¶

!8349 (merged): harbor update to 1.19.2-bb.3

Click to show Changelog

# Changelog Updates

## [1.19.2-bb.3] (2026-10-02)
### Changed
- gluon 1.1.7 -> 1.1.9
- goharbor/harbor-db v2.14.1 -> v2.15.2
- goharbor/redis-photon v2.14.1 -> v2.15.1
- postgresql 18.11.1 -> 18.12.4
- Migrate Cypress test from removed `Cypress.env()` to `cy.env()` for compatibility with Cypress 16
- Updated the package.json for cypress dependency to > `15.10.0`
- redis 28.0.10 -> 28.2.3
- registry1.dso.mil/ironbank/big-bang/devops-tester 1.0 -> 1.3
- registry1.dso.mil/ironbank/opensource/nginx/nginx 1.31.5 -> 1.31.6
- registry1.dso.mil/ironbank/opensource/redis/redis8-slim 8.10.1 -> 8.10.2

Headlamp¶

!8317 (merged): headlamp update to 0.45.0-bb.1

Click to show Changelog

# Changelog Updates

## [0.45.0-bb.1] (2026-10-02)
### Changed
- bb-common 1.5.0 -> 1.6.0
- cypress 16.0.0 -> 16.1.1
- gluon 1.1.7 -> 1.1.9
- registry1.dso.mil/ironbank/opensource/kubernetes/kubectl v1.36 -> v1.37

Istio Cni¶

!8322 (merged): istioCNI update to 1.31.1-bb.0

Click to show Changelog

# Changelog Updates

## [1.31.1-bb.0] (2026-10-01)
### Changed
- cni 1.30.4 -> 1.31.1
- registry1.dso.mil/ironbank/opensource/istio/install-cni 1.30.4 -> 1.31.1

Istio Crds¶

!8320 (merged): istioCRDs update to 1.31.1-bb.0

Click to show Changelog

# Changelog Updates

## [1.31.1-bb.0] (2026-09-26)
### Changed
- base 1.30.4 -> 1.31.1

Istio Egress Gateway¶

!8347 (merged): istioEgressGateway update to 0.1.5-bb.0

Click to show Changelog

# Changelog Updates

## [0.1.5-bb.0] - 2026-09-30
### Added
- Shared egress routes via bb-common's `routes.outbound`: one ServiceEntry per host bound to the waypoint plus the route's ALLOW AuthorizationPolicy (sources from the route's `from`). Centralizes egress ServiceEntries in the egress-gateway namespace so duplicate-host declarations across packages no longer collide at the shared waypoint. `egressGateway` defaults to this package's waypoint.
### Changed
- Added bb-common `1.6.1` as a subchart dependency (from `oci://registry1.dso.mil/bigbang`); egress routes are configured under the `bb-common.routes.outbound` values key and rendered by bb-common itself (no package-level route template).

## [0.1.4-bb.0] - 2026-09-24
### Changed
- Adopted `-bb.N` chart versioning

Istio Gateway¶

!8318 (merged): istioGateway update to 1.31.1-bb.0

Click to show Changelog

# Changelog Updates

## [1.31.1-bb.0] (2026-10-06)
### Changed
- bb-common 1.5.0 -> 1.6.1
- gateway 1.30.4 -> 1.31.1
- gluon 1.1.6 -> 1.1.9
- registry1.dso.mil/ironbank/opensource/istio/proxyv2 1.30.4 -> 1.31.1
- registry1.dso.mil/ironbank/opensource/kubernetes/kubectl v1.35 -> v1.37

Istiod¶

!8319 (merged): istiod update to 1.31.1-bb.0

Click to show Changelog

# Changelog Updates

## [1.31.1-bb.0] (2026-10-06)
### Changed
- bb-common 1.5.0 -> 1.6.1
- istiod 1.30.4 -> 1.31.1
- registry1.dso.mil/ironbank/opensource/istio/pilot 1.30.4 -> 1.31.1
- registry1.dso.mil/ironbank/opensource/istio/proxyv2 1.30.4 -> 1.31.1

Keycloak¶

!8351 (merged): keycloak update to 7.3.2-bb.1
!8316 (merged): keycloak update to 7.3.2-bb.0

Click to show Changelog

# Changelog Updates

## [7.3.2-bb.1] (2026-10-06)
### Changed
- bb-common 1.6.0 -> 1.6.1

## [7.3.2-bb.0] (2026-10-02)
### Changed
- gluon 1.1.8 -> 1.1.9
- keycloakx 7.3.0 -> 7.3.2
- postgresql 18.8.13 -> 18.12.4
- registry1.dso.mil/ironbank/opensource/keycloak/keycloak 26.7.2 -> 26.8.0
- registry1.dso.mil/ironbank/opensource/postgres/postgresql 18.4 -> 18.6

Kyverno¶

!8314 (merged): kyverno update to 3.9.1-bb.1

Click to show Changelog

# Changelog Updates

## [3.9.1-bb.1] (2026-10-02)
### Changed
- gluon 1.1.7 -> 1.1.9

Loki¶

!8326 (merged): loki update to 6.55.0-bb.9

Click to show Changelog

# Changelog Updates

## [6.55.0-bb.9] (2026-09-23)
### Changed
- bb-common 1.5.0 -> 1.6.0
- gluon 1.1.7 -> 1.1.8
- minio-instance 7.1.1-bb.15 -> 7.1.1-bb.24
- registry1.dso.mil/ironbank/bigbang/grafana/loki-canary 3.7.7 -> 3.7.8
- registry1.dso.mil/ironbank/grafana/grafana-enterprise-logs v3.6.13 -> v3.6.14
- registry1.dso.mil/ironbank/ironbank/opensource/grafana/enterprise-logs-provisioner 3.6.13 -> 3.6.14
- registry1.dso.mil/ironbank/kiwigrid/k8s-sidecar 2.11.1 -> 2.11.2
- registry1.dso.mil/ironbank/opensource/grafana/loki 3.7.7 -> 3.7.8
- registry1.dso.mil/ironbank/opensource/grafana/rollout-operator v0.39.0 -> v0.40.0
- registry1.dso.mil/ironbank/opensource/kubernetes/kubectl v1.36 -> v1.37
- registry1.dso.mil/ironbank/opensource/nginx/nginx 1.31.4 -> 1.31.6
- rollout-operator 0.51.1 -> 0.52.0
- Use the tracked kubectl image for Gluon's network-wait test container.

Metrics Server¶

!8315 (merged): metricsServer update to 3.14.0-bb.1

Click to show Changelog

# Changelog Updates

## [3.14.0-bb.1] (2026-10-02)
### Changed
- gluon 1.1.7 -> 1.1.9
- registry1.dso.mil/ironbank/opensource/kubernetes/kubectl v1.36 -> v1.37

Mimir¶

!8354 (merged): mimir update to 6.2.1-bb.1
!8350 (merged): mimir update to 6.2.1-bb.0
!8327 (merged): mimir update to 6.2.0-bb.1
!8294 (merged): mimir update to 6.2.0-bb.0

Click to show Changelog

# Changelog Updates

## [6.2.1-bb.1] (2026-10-13)
### Added
- Define opt-in Cortex Tenant ingress to the Mimir distributor on TCP 8080, disabled by default.
- Verify the enabled rule's distributor and Cortex Tenant selectors in Helm unit tests.

## [6.2.1-bb.0] (2026-10-06)
### Changed
- mimir-distributed 6.2.0 -> 6.2.1
- Removed `image: registry1.dso.mil/ironbank/big-bang/base:2.1.0` from `bbtests.script`

## [6.2.0-bb.1] (2026-10-06)
### Changed
- bb-common 1.5.0 -> 1.6.1
- gluon 1.1.7 -> 1.1.9
- registry1.dso.mil/ironbank/opensource/grafana/enterprise-metrics v2.17.18 -> v2.17.19
- registry1.dso.mil/ironbank/opensource/grafana/mimir 3.2.0 -> 3.2.1
- registry1.dso.mil/ironbank/opensource/grafana/rollout-operator v0.39.0 -> v0.40.0
- registry1.dso.mil/ironbank/opensource/nginx/nginx 1.31.4 -> 1.31.6

## [6.2.0-bb.0] (2026-09-02)
### Changed
- bb-common 1.0.2 -> 1.5.0
- gluon 1.1.2 -> 1.1.7
- mimir-distributed 6.1.0 -> 6.2.0
- registry1.dso.mil/ironbank/opensource/grafana/enterprise-metrics v2.17.15 -> v2.17.18
- registry1.dso.mil/ironbank/opensource/grafana/mimir 3.1.2 -> 3.2.0
- registry1.dso.mil/ironbank/opensource/grafana/rollout-operator v0.38.0 -> v0.39.0
- registry1.dso.mil/ironbank/opensource/memcached/memcached 1.6.43 -> 1.6.45
- registry1.dso.mil/ironbank/opensource/nginx/nginx 1.30.3 -> 1.31.4
- Updated `tests/test-values.yaml` to use filesystem backend (formerly `test-values-classic.yaml`)
- Updated `upstream.minio.enabled` comment to recommend Big Bang Garage for in-cluster storage
### Added
- Added `chart/values.schema.json` enforcing `upstream.minio.enabled: false` and rejecting `minio-tenant` key
- Smoke test for Garage object storage via CI dependency stack
- CONTRIBUTING.md
### Removed
- Removed `minio-instance` sub-chart dependency; Big Bang MinIO is no longer bundled with Mimir
### Upgrade Notices
- The `minio-instance` sub-chart has been removed. If you were using `addons.mimir.minioObjectStorage.enabled: true` in your Big Bang values, that path is no longer functional. For in-cluster S3-compatible storage, use [Big Bang Garage](https://repo1.dso.mil/big-bang/product/maintained/garage/-/blob/main/docs/package-integration.md) instead For production, configure an external S3-compatible object store via `addons.mimir.s3ObjectStorage`.

Minio¶

!8330 (merged): minio update to 7.1.1-bb.25

Click to show Changelog

# Changelog Updates

## [7.1.1-bb.25] (2026-10-06)
### Changed
- bb-common 1.6.0 -> 1.6.1
- gluon 1.1.7 -> 1.1.9
- registry1.dso.mil/ironbank/opensource/kubernetes/kubectl v1.36 -> v1.37

Twistlock¶

!8324 (merged): twistlock update to 0.31.0-bb.0
!8312 (merged): twistlock update to 0.30.0-bb.4

Click to show Changelog

# Changelog Updates

## [0.31.0-bb.0] (2026-10-02)
### Added
- OIDC SSO configuration via the `oidc` values block; the init Job posts it to `settings/oidc`
- `sso.existingSecret` and `oidc.existingSecret` supply the SAML cert or OIDC client secret from a pre-created Secret
- `console.backendTLS` routes the gateway-to-Console leg over HTTPS on 8083 so Console emits `https://` in the OIDC `redirect_uri`
- `console.groups[].authTypes` list for group records that must match more than one SSO provider
### Changed
- SAML init Job volume is `projected` instead of `secret` so `sso.existingSecret` layers onto the chart-managed Secret
- `console.groups` fails at render on an invalid auth type or when both `authType` and `authTypes` are set

## [0.30.0-bb.4] (2026-09-26)
### Added
- `defender.existingSecret` mounts a pre-created Secret for the defender-only certificates so no secret material passes through Helm values

Velero¶

!8345 (merged): velero update to 12.2.1-bb.0
!8305 (merged): velero update to 12.2.0-bb.0

Click to show Changelog

# Changelog Updates

## [12.2.1-bb.0] (2026-10-09)
### Changed
- bb-common 1.6.0 -> 1.6.1
- gluon 1.1.8 -> 1.1.9
- registry1.dso.mil/ironbank/opensource/velero/velero v1.18.3 -> v1.18.4
- registry1.dso.mil/ironbank/opensource/velero/velero-plugin-for-aws v1.14.3 -> v1.14.4
- registry1.dso.mil/ironbank/opensource/velero/velero-plugin-for-microsoft-azure v1.14.3 -> v1.14.4
- velero 12.2.0 -> 12.2.1

## [12.2.0-bb.0] (2026-09-25)
### Changed
- bb-common 1.5.0 -> 1.6.0
- gluon 1.1.6 -> 1.1.8
- registry1.dso.mil/ironbank/big-bang/devops-tester 1.2 -> 1.3
- registry1.dso.mil/ironbank/opensource/nginx/nginx 1.31.4 -> 1.31.6
- registry1.dso.mil/ironbank/opensource/velero/velero v1.18.2 -> v1.18.3
- registry1.dso.mil/ironbank/opensource/velero/velero-plugin-for-aws v1.14.2 -> v1.14.3
- registry1.dso.mil/ironbank/opensource/velero/velero-plugin-for-microsoft-azure v1.14.2 -> v1.14.3
- velero 12.1.0 -> 12.2.0

Ztunnel¶

!8321 (merged): ztunnel update to 1.31.1-bb.0

Click to show Changelog

# Changelog Updates

## [1.31.1-bb.0] (2026-10-01)
### Changed
- registry1.dso.mil/ironbank/opensource/istio/ztunnel 1.30.4 -> 1.31.1
- ztunnel 1.30.4 -> 1.31.1

Helpful Links¶

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

Open issues here
Join our Mattermost channel
Join our Slack
Check out the documentation for guidance on how to get started

Future¶

Don’t see your feature and/or bug fix? Check out our epics for estimates on when you can expect things to drop, and as always, feel free to comment or create issues if you have questions, comments, or concerns.

Release Notes - 3.35.1¶

Upgrade Notices¶

BigBang - MR¶

BigBang - MR¶

BigBang - MR¶

BigBang - MR¶

Alloy - MR¶

Alloy - MR¶

Keycloak - MR¶

Mimir - MR¶

Mimir - MR¶

Twistlock - MR¶

Known Issues¶

Upgrades from previous releases¶

Packages¶

Changes in 3.35.1¶

Big Bang MRs¶

Alloy¶

Eck Operator¶

Elasticsearch Kibana¶

External Secrets Operator¶

Fluentbit¶

Gatekeeper¶

Gitlab¶

Gitlab Runner¶

Harbor¶

Headlamp¶

Istio Cni¶

Istio Crds¶

Istio Egress Gateway¶

Istio Gateway¶

Istiod¶

Keycloak¶

Kyverno¶

Loki¶

Metrics Server¶

Mimir¶

Minio¶

Twistlock¶

Velero¶

Ztunnel¶

Helpful Links¶

Future¶

BigBang - MR ¶

BigBang - MR ¶

BigBang - MR ¶

BigBang - MR ¶

Alloy - MR ¶

Alloy - MR ¶

Keycloak - MR ¶

Mimir - MR ¶

Mimir - MR ¶

Twistlock - MR ¶