Release Notes - 3.31.1¶

Please see our documentation page for more information on how to consume and deploy Big Bang. This release was primarily tested on Kubernetes 1.35 (EKS).

Upgrade Notices¶

BigBang - MR ¶

Update your Flux CLI to the latest version possible based on available IB images. Note, if installing with homebrew on mac, use command brew upgrade fluxcd/tap/flux. This specific tap is needed to grab the latest version.

Package	Update	Change
registry1.dso.mil/ironbank/fluxcd/notification-controller (source)	patch	`v1.9.2` → `v1.9.3`
registry1.dso.mil/ironbank/fluxcd/source-controller (source)	patch	`v1.9.3` → `v1.9.4`

BigBang - MR ¶

In an effort to ensure pods update gracefully during the migration to ambient where configurable, a new annotation has been added (which indicates a pod is running in ambient mode):

bigbang.dev/istioDataplane: ambient

This annotation parallels the previous bigbang.dev/istioVersion annotation which has historically been used to ensure pods and their sidecars are restarted when updating between Istio versions. In ambient mode, the bigbang.dev/istioVersion annotation is unnecessary and will be replaced by bigbang.dev/istioDataplane: ambient.

BigBang - MR ¶

Garage receives releaseName: garage before its initial integrated release. Together with the companion package change, the latest published package upgrade retains existing StatefulSet and PVC names instead of forcing a migration.

BigBang - MR ¶

istiod now sets ISTIO_META_ENABLE_HBONE=true on the Istio proxy via meshConfig.defaultConfig.proxyMetadata by default. This enables HBONE on sidecar proxies so sidecar workloads can communicate with ambient (ztunnel) workloads which is recommended during a migration to ambient.

Because ISTIO_META_ENABLE_HBONE is set as an environment variable, existing sidecar-injected pods (and Istio gateways) will have to be restarted to receive the updated ISTIO_META_ENABLE_HBONE setting.

[!NOTE] A pod restart is only recommended if you are preparing to upgrade to ambient and do not anticipate the pod would otherwise be restarted due to other more natural circumstances (e.g. updates to packages).

If for some reason you do not wish to enable this functionality you can explicitly disable the feature by adding these values:

istiod:
  values:
    upstream:
      meshConfig:
        defaultConfig:
          proxyMetadata:
            ISTIO_META_ENABLE_HBONE: "false"

Gateway Api - MR ¶

The unstableAPI value has been removed; the chart now always installs the Gateway API standard channel CRDs.

If you were setting unstableAPI.enabled=true, upgrading removes the experimental-only CRDs along with any existing resources of those kinds.

Gitlab - MR ¶

GitLab 19 / chart 10 removes the bundled PostgreSQL, Redis, and MinIO charts. Helm does not migrate their data.

Consumers using any bundled service must remain on the latest GitLab 18.11 / chart 9.11 patch while following GitLab’s bundled-chart migration procedure. Verify GitLab and a fresh backup against the replacement services before upgrading to chart 10. Retain the old PVCs, Secrets, and recovery artifacts until GitLab 19 and a new backup are verified.
Consumers already using GitLab 19-compatible external PostgreSQL 17, Redis 7.0 or later (7.2 recommended) or Valkey 7.2 or later, and GitLab-supported external object storage do not need a service-data migration solely because the bundled charts were removed. They must still complete the normal GitLab 19 pre-upgrade checks, verify every external connection and bucket, finish pending migrations, and take a fresh verified backup.
This package does not deploy or support replacement PostgreSQL, Redis/Valkey, object-storage, or CloudNativePG resources for consumers. Configure GitLab-supported external services before upgrading. If CloudNativePG is selected, install and manage the Big Bang maintained CloudNativePG operator before creating the PostgreSQL Cluster; its lifecycle remains outside this GitLab package. For production, follow GitLab’s Cloud Native Hybrid guidance.
Build clean chart 10 values instead of reusing chart 9 values. Remove obsolete global.minio, upstream.minio, upstream.postgresql, and upstream.redis keys while retaining every supported override. In particular, preserve the existing Gitaly persistence size because the StatefulSet volume-claim template is immutable. Render and diff the chart 10 StatefulSets before reconciling.
Follow the Big Bang-specific GitLab 19 upgrade notes. Inventory all optional databases and object-storage buckets because the default GitLab backup does not cover every site-specific data store. Once GitLab 19 database migrations run, do not start GitLab 18 against that database; rollback requires matching GitLab, database, and object-storage recovery points.
GitLab 19 removes the OAuth Resource Owner Password Credentials grant. Replace integrations using that grant before upgrading. If bundled Spamcheck is enabled, deploy Spamcheck separately. GitLab 19.1 also drops Elasticsearch 7.x support for Advanced Search; move to a supported Elasticsearch or OpenSearch release first.
Consumers using a service account to pull GitLab application images from Iron Bank may need to verify access with Iron Bank, as GitLab 19 moves these images to the Verified Publisher CNG repository under registry1.dso.mil/gitlab/gitlab-org/build/cng/*. No separate application or data migration is required, but Registry1 credentials, mirrors, policies, and allowlists must permit access to the new image path.
Review the GitLab 19 breaking changes, deprecations and removals, chart 10 upgrade notes, and GitLab 19 upgrade changes for site-specific impacts.
This version has been superseded by gitlab update to 10.2.4-bb.0

Known Issues¶

bbctl Dashboards
CRON job output longer than 16kb will be split into multiple log entries when using the dockerd CRI causing invalid JSON structures to be imported into Loki. Use containerd as the CRI to ensure long log lines are parsed correctly
bbctl-violations-dashboard / bbctl-all-logs-dashboard(Violations Logs)
- These items will not populate if you have too large of a kubernetes cluster with too many violations. There is a limit to the amount of data that can be processed. If you hit this limit and need the information, you can still use the bbctl violations command to obtain the data.
Headlamp
Attempting to login using OIDC will create a login ‘loop’. (Upstream Issue)
Prometheus
Target scraping for Fluentbit may encounter errors even though the pods are functioning as expected. This is expected to resolve in a future release
Target scraping for Kube Operator may encounter errors. (Issue)

Upgrades from previous releases¶

If coming from a version pre-3.30.0, note the additional upgrade notices in any release in between. The BB team doesn’t test/guarantee upgrades from anything pre-3.30.0.

Packages¶

Click to show Packages Version Updates

| Package | Type | Package Version | BB Version | | ------- | ---- | --------------- | ---------- | |

[Authservice](https://repo1.dso.mil/big-bang/product/packages/authservice) | Addon | `1.1.5` | `1.1.5-bb.7` [🔗](#authservice) | | [Bbctl](https://repo1.dso.mil/big-bang/product/packages/bbctl) | Core | `2.3.1` | `3.0.1-bb.3`| | [Eck Operator](https://repo1.dso.mil/big-bang/product/packages/eck-operator) | Core | `3.4.1` | `3.4.1-bb.1`| |

[Gitlab](https://repo1.dso.mil/big-bang/product/packages/gitlab) | Addon | `19.2.4` | `10.2.4-bb.0` [🔗](#gitlab) | | [Gitlab Runner](https://repo1.dso.mil/big-bang/product/packages/gitlab-runner) | Addon | `v18.11.3` | `0.88.3-bb.2`| | [Grafana](https://repo1.dso.mil/big-bang/product/packages/grafana) | Core | `13.0.1` | `10.5.15-bb.6`| |

[Headlamp](https://repo1.dso.mil/big-bang/product/packages/headlamp) | Addon | `0.44.0` | `0.44.0-bb.0` [🔗](#headlamp) | | [Istio Cni](https://repo1.dso.mil/big-bang/product/packages/istio-cni) | Core | `1.30.3` | `1.30.3-bb.0`| | [Istio Crds](https://repo1.dso.mil/big-bang/product/packages/istio-crds) | Core | `1.30.3` | `1.30.3-bb.0`| | [Istio Gateway](https://repo1.dso.mil/big-bang/product/packages/istio-gateway) | Core | `1.30.3` | `1.30.3-bb.0`| | [Istiod](https://repo1.dso.mil/big-bang/product/packages/istiod) | Core | `1.30.3` | `1.30.3-bb.0`| |

[Mattermost Operator](https://repo1.dso.mil/big-bang/product/packages/mattermost-operator) | Addon | `1.25.7` | `1.25.7-bb.3` [🔗](#mattermost-operator) | | [Metrics Server](https://repo1.dso.mil/big-bang/product/packages/metrics-server) | Addon | `0.8.1` | `3.13.1-bb.1`| | [Mimir](https://repo1.dso.mil/big-bang/product/packages/mimir) | Addon | `3.1.2` | `6.1.0-bb.1`| |

[Renovate](https://repo1.dso.mil/big-bang/product/packages/renovate)

[Sonarqube](https://repo1.dso.mil/big-bang/product/packages/sonarqube) | Addon | `2026.4.0` | `2026.4.0-bb.0` [🔗](#sonarqube) | | [Tempo](https://repo1.dso.mil/big-bang/product/packages/tempo) | Core | `2.10.5` | `2.1.0-bb.2`| | [Thanos](https://repo1.dso.mil/big-bang/product/packages/thanos) | Addon | `v0.41.0` | `17.4.0-bb.3`| |

[Velero](https://repo1.dso.mil/big-bang/product/packages/velero) | Addon | `1.18.2` | `12.1.0-bb.3` [🔗](#velero) | | [Wrapper](https://repo1.dso.mil/big-bang/product/packages/wrapper) | Core | `N/A` | `0.4.15`| | [Ztunnel](https://repo1.dso.mil/big-bang/product/packages/ztunnel) | Core | `1.30.3` | `1.30.3-bb.0`|

Changes in 3.31.1¶

Big Bang MRs¶

!8117 3.31.0 cherrypick
!8077 fix the eck namespace yaml render
!8071 Remove stale values
!8064 fix: updating the sso cert
!8058 Docs: Update relevant DoD terminology to DoW
!8051 Fix Keycloak Service Monitor in ambient
!8049 fix gateway values object mutation
!8048 Updated istio namespace to follow standard labels when in ambient mode
!8047 Update Flux
!8043 Update dependency https://repo1.dso.mil/big-bang/product/maintained/podinfo.git to v6.14.1-bb.0
!8041 Add Istio ambient annotation
!8037 Fix istiod dep packages key
!8035 Forward ambient mode to wrapper
!8032 Ensure authservice has required ServiceEntry for cypress tests
!8030 fix ambient regressions with credential secret names, gitrepository…
!8029 Fix Garage umbrella integration blockers
!8028 enable ISTIO_META_ENABLE_HBONE by default
!8027 fix Kiali Istio enabled string truthiness
!8026 Shared helper for package namespaces
!8025 Shared helper for imagepullsecret
!8018 refactor test values - num replicas deployed per package, remove old test…
!7965 Postrenderer Adding enableHttp2=false Fluentbit postrenderer for ServiceMonitor
!7926 fix: allow istioGateway common values in schema

Alloy¶

!8046: alloy update to 4.3.2-bb.0

Click to show Changelog

# Changelog Updates

## [4.3.2-bb.0] (2026-08-04)
### Changed
- bb-common 1.3.1 -> 1.4.0
- registry1.dso.mil/ironbank/opensource/prometheus-operator/prometheus-config-reloader v0.92.1 -> v0.93.0
- Updated k8s-monitoring and aligned Alloy subcharts
- k8s-monitoring updated from 4.3.1 to 4.3.2

Argocd¶

!8020: argocd update to 10.2.1-bb.0

Click to show Changelog

# Changelog Updates

## [10.2.1-bb.0] (2026-07-30)
### Changed
- argo-cd 10.1.4 -> 10.2.1
- bb-common 1.2.0 -> 1.3.1
- gluon 1.1.2 -> 1.1.3
- registry1.dso.mil/ironbank/big-bang/cypress 15.17.0 -> 15.18.1
- registry1.dso.mil/ironbank/bitnami/analytics/redis-exporter v1.87.0 -> v1.88.0
- registry1.dso.mil/ironbank/opensource/redis/redis8-slim 8.8.0 -> 8.10.0
- Excluded Cypress 15.19.0 because the Iron Bank image omits `@babel/preset-typescript`, causing Cypress test compilation to fail.
- Fixed stale documentation links detected by package validation.
- Reduced Cypress test CPU and memory defaults.

Authservice¶

!8045: authservice update to 1.1.5-bb.7
!8042: authservice update to 1.1.5-bb.6

Click to show Changelog

# Changelog Updates

## [1.1.5-bb.7] (2026-08-06)
### Added
- Added optional `configuration_uri` value on `global`/`default_oidc_config` and per-chain `oidc_override` to point authservice at an OIDC provider's `.well-known/openid-configuration` endpoint for runtime discovery, instead of setting `authorization_uri`, `token_uri`, and `jwks_uri` manually. Explicit `authorization_uri` and `token_uri` take precedence.

## [1.1.5-bb.6] (2026-08-06)
### Fixed
- Added an authorization policy allowing the public ingress gateway to reach the Prometheus metrics endpoint in the ambient gateway enforcement test.

Elasticsearch Kibana¶

!8083: elasticsearchKibana update to 1.41.0-bb.0

Click to show Changelog

# Changelog Updates

## [1.41.0-bb.0] (2026-08-14)
### Changed
- bb-common 1.3.1 -> 1.4.0
- gluon 1.1.3 -> 1.1.5
- registry1.dso.mil/ironbank/big-bang/cypress 15.18.1 -> 15.20.1
- registry1.dso.mil/ironbank/elastic/elasticsearch/elasticsearch 9.4.3 -> 9.5.1
- registry1.dso.mil/ironbank/elastic/kibana/kibana 9.4.4 -> 9.5.1

## [1.40.0-bb.3] (2026-08-14)
### Upgrade Notice
- `elasticsearch.version` and `kibana.version` have been removed. Configure versions using `elasticsearch.image.tag` and `kibana.image.tag`; these values now control both the container image and ECK resource version. Update any overlays using the removed keys.
### Fixed
- Renovate configuration and version synchronization for Elasticsearch and Kibana image updates

External Secrets Operator¶

!8031: externalSecrets update to 2.8.0-bb.0

Click to show Changelog

# Changelog Updates

## [2.8.0-bb.0] - 2026-07-30
### Updated
- Updated external-secrets chart 2.7.0 -> 2.8.0
- Updated registry1.dso.mil/ironbank/opensource/external-secrets/external-secrets v2.7.0 -> v2.8.0
- Updated bb-common 1.0.2 -> 1.3.1
- Updated gluon 1.1.2 -> 1.1.3
- Updated registry1.dso.mil/ironbank/redhat/ubi/ubi9-minimal 9.5 -> 9.8
- Updated External Secrets CRDs to helm-chart-2.8.0
### Added
- Added the Big Bang test images to helm.sh/images release metadata and Renovate coverage

Fortify¶

!8065: fortify update to 26.2.0-bb.2

Click to show Changelog

# Changelog Updates

## [26.2.0-bb.2] (2026-07-30)
### Changed
- bb-common updated from 1.0.1 to 1.4.0
- gluon updated from 1.1.1 to 1.1.3
- registry1.dso.mil/ironbank/microfocus/fortify/ssc updated from 26.2.1.0001 to 26.2.2.0004
- registry1.dso.mil/ironbank/opensource/kubernetes/kubectl updated from v1.35.6 to v1.35.7

Gatekeeper¶

!8050: gatekeeper update to 3.23.0-bb.0

Click to show Changelog

# Changelog Updates

## [3.23.0-bb.0] (2026-08-05)
### Changed
- bb-common 0.14.2 -> 1.4.0
- gatekeeper 3.22.2 -> 3.23.0
- gluon 1.0.1 -> 1.1.4
- registry1.dso.mil/ironbank/opensource/kubernetes/kubectl v1.34 -> v1.35
- registry1.dso.mil/ironbank/opensource/openpolicyagent/gatekeeper v3.22.2 -> v3.23.0

### Changed
- Removed values that were orphaned from the values.yaml

Gateway Api¶

!8054: gatewayAPI update to 1.6.1-bb.0

Click to show Changelog

# Changelog Updates

## [1.6.1-bb.0] (2026-07-29)
### Changed
- kubernetes-sigs/gateway-api updated from 1.5.1 to 1.6.1
### Removed
- Removed the `unstableAPI` values and the experimental channel CRDs; the chart
  now always installs the standard channel. Shipping both CRD bundles pushed the
  Helm release Secret past the Kubernetes 1 MiB limit, which failed the install.

Gitlab¶

!8109: gitlab update to 10.2.4-bb.0
!8092: gitlab update to 10.1.3-bb.0

Click to show Changelog

# Changelog Updates

## [10.2.4-bb.0] (2026-08-19)
### Changed
- gitlab updated from 10.1.3 to 10.2.4
- gitlab-app-version updated from 19.1.3 to 19.2.4
- gluon updated from 1.1.3 to 1.1.6
- https://repo1.dso.mil/big-bang/product/maintained/redis.git updated from 27.0.14-bb.0 to 28.0.6-bb.0
- registry1.dso.mil/ironbank/big-bang/cypress updated from 15.18.1 to 15.20.1
- registry1.dso.mil/ironbank/opensource/postgres/postgresql updated from 17.10 to 17.11
- gitlab/gitlab-org/build/cng/certificates updated from v19.1.3 to v19.2.4
- gitlab/gitlab-org/build/cng/cfssl-self-sign updated from v19.1.3 to v19.2.4
- gitlab/gitlab-org/build/cng/gitaly updated from v19.1.3 to v19.2.4
- gitlab/gitlab-org/build/cng/gitaly-init-cgroups updated from v19.1.3 to v19.2.4
- gitlab/gitlab-org/build/cng/gitlab-base updated from v19.1.3 to v19.2.4
- gitlab/gitlab-org/build/cng/gitlab-container-registry updated from v4.40.1 to v4.40.2
- gitlab/gitlab-org/build/cng/gitlab-exporter updated from 16.8.0 to 16.9.0
- gitlab/gitlab-org/build/cng/gitlab-geo-logcursor updated from v19.1.3 to v19.2.4
- gitlab/gitlab-org/build/cng/gitlab-kas updated from v19.1.3 to v19.2.4
- gitlab/gitlab-org/build/cng/gitlab-mailroom updated from v19.1.3 to v19.2.4
- gitlab/gitlab-org/build/cng/gitlab-openbao updated from v19.1.3 to v2.5.5-gitlab2
- gitlab/gitlab-org/build/cng/gitlab-pages updated from v19.1.3 to v19.2.4
- gitlab/gitlab-org/build/cng/gitlab-shell updated from v14.54.0 to v14.56.1
- gitlab/gitlab-org/build/cng/gitlab-sidekiq-ee updated from v19.1.3 to v19.2.4
- gitlab/gitlab-org/build/cng/gitlab-toolbox-ee updated from v19.1.3 to v19.2.4
- gitlab/gitlab-org/build/cng/gitlab-webservice-ee updated from v19.1.3 to v19.2.4
- gitlab/gitlab-org/build/cng/gitlab-workhorse-ee updated from v19.1.3 to v19.2.4
- gitlab/gitlab-org/build/cng/gitlab-zoekt updated from v19.1.3 to v1.14.2
- gitlab/gitlab-org/build/cng/kubectl updated from v19.1.3 to v19.2.4
- gitlab/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/model-gateway updated from self-hosted-v19.1.3-ee to self-hosted-v19.1.5-ee

## [10.1.3-bb.0] (2026-08-03)
### Changed
- Updated GitLab chart `9.11.8` -> `10.1.3` and GitLab `18.11.7` -> `19.1.3`.
- Updated `bb-common` `1.1.0` -> `1.4.0` and Gluon `1.1.2` -> `1.1.3`.
- Updated Cypress `15.17.0` -> `15.18.1`.
- Updated the Cypress authentication check for GitLab 19's first-project onboarding page.
- Routed disabled-by-default Gitaly cgroups, Geo log cursor, OpenBao, and Zoekt
  workload images, including the Zoekt gateway, through Registry1.
- Routed the optional GitLab AI Gateway through the Verified Publisher
  `self-hosted-v19.1.3-ee` image and its disabled Helm test and optional gRPC
  TLS proxy through Iron Bank; added the missing certificate-init resources and
  hardened workload defaults.
- Moved the internal CI dependency environment to independent CloudNativePG,
  PostgreSQL, Redis, and Garage generic-package HelmReleases outside the GitLab
  namespace and release lifecycle.
- Updated the internal Garage dependency to `0.9.3-bb.2` and its per-consumer
  `garage-gitlab-credentials` Secret model.
- Removed CI service connections from public defaults. Redis and CloudNativePG
  now generate their own credentials, and a CI-only Kyverno policy synchronizes
  the required Redis, PostgreSQL, and Garage Secret formats into GitLab.
- Migrated GitLab component images from Iron Bank to Verified Publisher CNG UBI
  images under `registry1.dso.mil/gitlab/gitlab-org/build/cng/`.
  Release-tied `certificates`, `cfssl-self-sign`, `gitaly`, `gitlab-base`,
  `gitlab-kas`, `gitlab-mailroom`, `gitlab-pages`, `gitlab-sidekiq-ee`,
  `gitlab-toolbox-ee`, `gitlab-webservice-ee`, `gitlab-workhorse-ee`, and
  `kubectl` components use `v19.1.3-ubi`; Registry uses
  `v4.40.1-gitlab-ubi`, Shell uses `v14.54.0-ubi`, and Exporter uses
  `16.8.0-ubi`.
- Disabled upstream's new Gateway API and Envoy Gateway defaults because Big Bang routes GitLab through Istio.
- Disabled Service Ping and event-level product usage collection by default,
  including runtime enforcement for existing GitLab installations.
### Added
- Added concise [Big Bang-specific GitLab 19 migration notes](docs/gitlab-19-upgrade.md)
  that defer the general procedure to GitLab's upstream documentation.
### Removed
- Removed the PostgreSQL, Redis, and MinIO charts bundled by upstream. This
  package adds no replacement service resources; GitLab now consumes externally
  managed PostgreSQL, Redis or Valkey, and GitLab-supported external object
  storage.
### Upgrade
- Existing users of bundled PostgreSQL, Redis, or MinIO must provision and
  repoint to external services while still on GitLab 18.11. PostgreSQL and
  object data require backup/restore; drain Sidekiq before Redis cutover and
  expect active sessions to be lost.
- This package provides no supported consumer replacements and does not migrate
  removed services. Configure external PostgreSQL 17, a supported Redis/Valkey
  release, and GitLab-supported external object storage with the upstream GitLab
  values and Secrets before upgrading.
- Inventory every separate PostgreSQL data set. Migrate durable application
  databases such as OpenBao and Registry metadata, rebuild Praefect through the
  repository restore, and recreate/reset Geo tracking when enabled. Coordinate
  the separately managed GitLab Runner upgrade and validate its compatibility
  before the GitLab 19 cutover.

## [9.11.8-bb.1] (2026-07-22)
### Changed
- Removed duplicate and unused values

Harbor¶

!8052: harbor update to 1.19.2-bb.0

Click to show Changelog

# Changelog Updates

## [1.19.2-bb.0] (2026-08-04)
### Changed
- bb-common 1.3.0 -> 1.4.0
- harbor 1.19.1 -> 1.19.2
- postgresql 18.8.1 -> 18.8.6
- registry1.dso.mil/ironbank/opensource/redis/redis8-slim 8.8.1 -> 8.10.0
- Added a default Trivy ServiceEntry and egress NetworkPolicy to allow vulnerability database downloads in hardened Istio deployments

Headlamp¶

!8044: headlamp update to 0.44.0-bb.0

Click to show Changelog

# Changelog Updates

## [0.44.0-bb.0] (2026-08-06)
### Changed
- bb-common updated from 0.14.0 to 1.4.0
- gluon updated from 0.9.8 to 1.1.4
- headlamp updated from 0.40.0 to 0.44.0
- registry1.dso.mil/ironbank/opensource/headlamp-k8s/headlamp updated from v0.40.0 to v0.44.0
- registry1.dso.mil/ironbank/opensource/kubernetes/kubectl updated from v1.34 to v1.35
- removed deprecated bigbang.dev/applicationVersions annotation from Chart.yaml

Keycloak¶

!8130: keycloak update to 7.3.0-bb.0

Click to show Changelog

# Changelog Updates

## [7.3.0-bb.0] (2026-08-25)
### Changed
- bb-common 1.3.0 -> 1.5.0
- gluon 1.1.3 -> 1.1.6
- keycloakx 7.2.2 -> 7.3.0
- postgresql 18.8.1 -> 18.8.13
- registry1.dso.mil/ironbank/opensource/keycloak/keycloak 26.7.0 -> 26.7.2
- Removed deprecated bigbang.dev/applicationVersions annotation

Kiali¶

!8078: kiali update to 2.30.0-bb.0
!8040: kiali update to 2.29.0-bb.0

Click to show Changelog

# Changelog Updates

## [2.30.0-bb.0] (2026-08-08)
### Changed
- gluon 1.1.3 -> 1.1.5
- kiali-operator 2.29.0 -> 2.30.0
- registry1.dso.mil/ironbank/opensource/kiali/kiali v2.29.0 -> v2.30.0
- registry1.dso.mil/ironbank/opensource/kiali/kiali-operator v2.29.0 -> v2.30.0

## [2.29.0-bb.0] (2026-07-30)
### Changed
- bb-common 1.0.2 -> 1.4.0
- gluon 1.1.1 -> 1.1.3
- kiali-operator 2.28.0 -> 2.29.0
- registry1.dso.mil/ironbank/opensource/kiali/kiali v2.28.0 -> v2.29.0
- registry1.dso.mil/ironbank/opensource/kiali/kiali-operator v2.28.0 -> v2.29.0
- registry1.dso.mil/ironbank/opensource/kubernetes/kubectl v1.35.6 -> v1.35.7

Kyverno¶

!8068: kyverno update to 3.8.2-bb.2
!8057: kyverno update to 3.8.2-bb.1

Click to show Changelog

# Changelog Updates

## [3.8.2-bb.2] (2026-08-12)
### Changed
- bb-common 1.2.0 -> 1.4.0
- gluon 1.1.3 -> 1.1.5

## [3.8.2-bb.1] (2026-07-31)
### Fixed
- Fixed the nesting under global key in values.yaml

Kyverno Reporter¶

!8039: kyvernoReporter update to 3.9.0-bb.1

Click to show Changelog

# Changelog Updates

## [3.9.0-bb.1] (2026-08-05)
### Changed
- bb-common 1.3.1 -> 1.4.0
- registry1.dso.mil/ironbank/nirmata/policy-reporter/policy-reporter-ui 2.7.0 -> 2.7.1

Mattermost¶

!8091: mattermost update to 11.10.0-bb.0
!8073: mattermost update to 11.9.0-bb.6

Click to show Changelog

# Changelog Updates

## [11.10.0-bb.0] (2026-08-18)
### Changed
- Updated postgresql 18.8.8 -> 18.8.11
- Updated registry1.dso.mil/ironbank/opensource/mattermost/mattermost 11.9.0 -> 11.10.0

## [11.9.0-bb.6] (2026-08-12)
### Changed
- bb-common updated from 1.2.0 to 1.4.0
- gluon updated from 1.1.3 to 1.1.5
- postgresql updated from 13.2.27 to 18.8.8

Mattermost Operator¶

!8074: mattermostOperator update to 1.25.7-bb.3

Click to show Changelog

# Changelog Updates

## [1.25.7-bb.3] (2026-07-30)
### Changed
- bb-common 1.1.0 -> 1.4.0

Minio¶

!8069: minio update to 7.1.1-bb.23
!8053: minio update to 7.1.1-bb.22

Click to show Changelog

# Changelog Updates

## [7.1.1-bb.23] (2026-08-11)
### Changed
- gluon updated from 1.1.3 to 1.1.5
- Updated registry1.dso.mil/ironbank/big-bang/devops-tester 1.0 → 1.2

## [7.1.1-bb.22] (2026-07-30)
### Changed
- bb-common updated from 1.1.0 to 1.4.0
- gluon updated from 1.1.2 to 1.1.3

Minio Operator¶

!8055: minioOperator update to 7.1.1-bb.9

Click to show Changelog

# Changelog Updates

## [7.1.1-bb.9] (2026-08-05)
### Changed
- bb-common updated from 1.1.0 to 1.4.0
- gluon updated from 1.1.2 to 1.1.3
- registry1.dso.mil/ironbank/big-bang/cypress (source) updated from 15.17.0 → 15.19.0

Monitoring¶

!8072: monitoring update to 88.3.0-bb.0
!8059: monitoring update to 88.2.0-bb.0 and prometheusOperatorCRDs update to 31.0.1-bb.0

Click to show Changelog

# Changelog Updates

## [88.3.0-bb.0] (2026-08-12)
### Changed
- kube-prometheus-stack 88.2.0 -> 88.3.0

## [88.2.0-bb.0] (2026-08-11)
### Changed
- bb-common 1.2.0 -> 1.4.0
- gluon 1.1.2 -> 1.1.5
- kube-prometheus-stack 87.10.1 -> 88.2.0
- prometheus-blackbox-exporter 11.15.1 -> 11.17.2
- prometheus-snmp-exporter 9.16.1 -> 9.17.1
- registry1.dso.mil/ironbank/big-bang/grafana/grafana-plugins 13.0.1 -> 13.1.0
- registry1.dso.mil/ironbank/kiwigrid/k8s-sidecar 2.8.1 -> 2.10.1
- registry1.dso.mil/ironbank/opensource/bats/bats 1.13.0 -> 1.14.0
- registry1.dso.mil/ironbank/opensource/prometheus-operator/prometheus-config-reloader v0.92.1 -> v0.93.1
- registry1.dso.mil/ironbank/opensource/prometheus-operator/prometheus-operator v0.92.1 -> v0.93.1
- registry1.dso.mil/ironbank/opensource/prometheus/node-exporter v1.11.1 -> v1.12.1
- registry1.dso.mil/ironbank/opensource/prometheus/prometheus v3.13.0 -> v3.13.2
- registry1.dso.mil/ironbank/opensource/thanos/thanos v0.41.0 -> v0.42.4
### Fixed
- Moved the ThanosRuler image override to `upstream.thanosRuler.thanosRulerSpec.image` so the Iron Bank image is used when ThanosRuler is enabled
### Removed
- Removed the unused `upstream.prometheusOperator.kubectlImage` values block and its `helm.sh/images` entry; no chart template consumes it

Neuvector¶

!8017: neuvector update to 2.11.0-bb.2

Prometheus Operator Crds¶

!8059: monitoring update to 88.2.0-bb.0 and prometheusOperatorCRDs update to 31.0.1-bb.0

Click to show Changelog

# Changelog Updates

## [31.0.1-bb.0] (2026-08-11)
### Changed
- Prometheus Operator CRDs updated from 30.0.1 to 31.0.1

Renovate¶

!8063: renovate update to 46.251.0-bb.0

Click to show Changelog

# Changelog Updates

## [46.251.0-bb.0] - 2026-08-10
### Changed
- Updated the upstream Renovate chart from 46.31.6 to 46.251.0
- Updated the Renovate image from 43.31.7 to 44.14.3
- Updated bb-common from 0.14.2 to 1.4.0
- Updated Gluon from 0.9.8 to 1.1.5
- Updated the devops-tester image from 1.1 to 1.2
- Updated the Gitea test fixture image from v1.26.0 to v1.27.1
- Removed stale Redis and Redis exporter metadata and documentation after their removal from the upstream chart
- Removed deprecated `bigbang.dev/applicationVersions` metadata
- Added Renovate extraction coverage for the bbtests image values
- Updated the development guide and override for the current Big Bang generic package schema, dev-cluster bb-common egress behavior, and rendered CronJob name

Sonarqube¶

!8024: sonarqube update to 2026.4.0-bb.0
!8023: sonarqube update to 2026.3.1-bb.3

Click to show Changelog

# Changelog Updates

## [2026.4.0-bb.0] - 2026-07-30
### Updated
- Updated bb-common 1.1.0 -> 1.3.1
- Updated gluon 1.1.2 -> 1.1.3
- Updated sonarqube 2026.3.1 -> 2026.4.0
- Added Renovate coverage for the chart appVersion
- Disabled unsupported SonarQube MCP because its image is not available in Iron Bank

## [2026.3.1-bb.3] - 2026-07-22
### Fixed
- ServiceMonitor uses http scheme and omits sidecar certs in ambient mode (#222)

Twistlock¶

!8012: twistlock update to 0.28.0-bb.3

Click to show Changelog

# Changelog Updates

## [0.28.0-bb.3] (2026-07-28)
### Changed
- bb-common 1.0.2 -> 1.3.1
- gluon 1.1.1 -> 1.1.3

Vault¶

!8056: vault update to 0.34.0-bb.0

Click to show Changelog

# Changelog Updates

## [0.34.0-bb.0] - 2026-08-10
### Changed
- bb-common 1.0.2 -> 1.4.0
- gluon 1.1.2 -> 1.1.5
- registry1.dso.mil/ironbank/hashicorp/vault-csi-provider v1.7.3 -> v1.7.4
- vault 0.33.0 -> 0.34.0
- Updated development testing instructions and overrides for current Big Bang paths, gateway, domain, and TLS settings

Velero¶

!8085: velero update to 12.1.0-bb.3

Click to show Changelog

# Changelog Updates

## [12.1.0-bb.3] (2026-08-05)
### Changed
- bb-common 1.3.1 -> 1.4.0
- gluon 1.1.3 -> 1.1.4

Helpful Links¶

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

Open issues here
Join our Mattermost channel
Join our Slack
Check out the documentation for guidance on how to get started

Future¶

Don’t see your feature and/or bug fix? Check out our epics for estimates on when you can expect things to drop, and as always, feel free to comment or create issues if you have questions, comments, or concerns.

Release Notes - 3.31.1¶

Upgrade Notices¶

BigBang - MR¶

BigBang - MR¶

BigBang - MR¶

BigBang - MR¶

Gateway Api - MR¶

Gitlab - MR¶

Known Issues¶

Upgrades from previous releases¶

Packages¶

Changes in 3.31.1¶

Big Bang MRs¶

Alloy¶

Argocd¶

Authservice¶

Elasticsearch Kibana¶

External Secrets Operator¶

Fortify¶

Gatekeeper¶

Gateway Api¶

Gitlab¶

Harbor¶

Headlamp¶

Keycloak¶

Kiali¶

Kyverno¶

Kyverno Reporter¶

Mattermost¶

Mattermost Operator¶

Minio¶

Minio Operator¶

Monitoring¶

Neuvector¶

Prometheus Operator Crds¶

Renovate¶

Sonarqube¶

Twistlock¶

Vault¶

Velero¶

Helpful Links¶

Future¶

BigBang - MR ¶

BigBang - MR ¶

BigBang - MR ¶

BigBang - MR ¶

Gateway Api - MR ¶

Gitlab - MR ¶