BigBangPackages.md

Big Bang Packages

Each Big Bang Package is present in the Big Bang Package repository and broken up into several sub-groupings.

Each package has at least two CODEOWNERS. Responsibilities are outlined here.

• Big Bang Packages
  • Dependencies
  • Core
    • Service Mesh
    • Auth Service
    • Logging
    • Policy Enforcement
    • Monitoring
    • Cluster Auditor
    • Twistlock
  • Addons
    • Security Tools
      • Keycloak
      • Anchore Enterprise
    • Developer Tools
      • GitLab
      • GitLab Runners
      • Sonarqube
      • Nexus
    • Collaboration Tools
      • Mattermost
    • Package Utilities
      • Minio
    • Cluster Utilities
      • ArgoCD
      • Velero
    • BB Technical Oversight Committee (BB TOC)

Dependencies

graph TB
  subgraph "Core"
  subgraph "Logging"
  LoggingElastic[Elasticsearch]
  LoggingKibana[Kibana]
  LoggingECK[ECK]
  LoggingElastic  --> LoggingECK
  LoggingKibana  --> LoggingECK
  LoggingKibana --> LoggingElastic
  Fluentd --> LoggingElastic
  end
  subgraph "Monitoring"
  Grafana --> Prometheus
  Thanos
  end
  ServiceMesh
  
  ClusterAuditor --> LoggingECK
  ClusterAuditor --> OPA[Policy Enforcement]
  end      

  subgraph "Package Utilities"
    Postgres[DB]
    MinIO[S3 Compatible Storage]
    Redis[Cache Server]
  end

  subgraph "Security"
  Keycloak --> Postgres
  Anchore[Anchore Enterprise] --> Postgres
  Twistlock
  end

  subgraph "Developer Tools"
    GitLab --> GitLabRunners[GitLab Runners]
    GitLab --> MinIO
    GitLab --> Redis
    GitLab --> Postgres
    Sonarqube --> Postgres
  end

  subgraph "Collaboration Tools"
    MatterMost --> MinIO
  end

Core

Core packages are supported Big Bang packages that have to be enabled and are located at Big Bang Core. Core packages are platform/admin level packages that are leveraged by other packages.

graph TB
  subgraph "Core"
  subgraph "Logging"
  LoggingElastic[Elasticsearch]
  LoggingKibana[Kibana]
  LoggingECK[ECK]
  LoggingElastic  --> LoggingECK
  LoggingKibana  --> LoggingECK
  LoggingKibana --> LoggingElastic
  Fluentd --> LoggingElastic
  end
  subgraph "Monitoring"
  Grafana --> Prometheus
  Thanos
  end
  ServiceMesh
  Twistlock
  
  ClusterAuditor --> LoggingECK
  ClusterAuditor --> OPA[Policy Enforcement]
  end      

Service Mesh

Current implementation of Service Mesh is provided by Istio. Service Mesh should be the first Package deployed to ensure other applications are operating with visibility and security.

Product:

• Istio

Repository:

• Istio-operator
• Istio-controlplane

Dependency: None

Owners:

• CODEOWNERS

Auth Service

authservice helps delegate the OIDC Authorization Code Grant Flow to the Istio mesh. authservice is compatible with any standard OIDC Provider as well as other Istio End-user Auth features, including Authentication Policy and RBAC. Together, they allow developers to protect their APIs and web apps without any application code required.

Product:

• authservice

Repository:

• authservice

Dependency: None

Owners:

• CODEOWNERS

Logging

The logging package is responsible for deploying Elasticsearch, Kibana, and Fluentd. It is also responsible for configuring the logging pipelines to aggregate all running containers logs for viewing by both Cluster Owners and Application Operators.

The logging capability is comprised of:

• Elastic Cloud on Kubernetes (ECK) Operator
• Elasticsearch
• Kibana
• Fluentd
• Logging Operator

Repository:

• Elasticsearch-kibana
• Fluentbit
• Eck-operator

Dependencies:

• RWO StorageClass

Owners:

• Elasticsearch-kibana CODEOWNERS
• Fluentbit CODEOWNERS
• Eck-operator CODEOWNERS

Policy Enforcement

The Policy Enforcement Package installs the Open Policy Agent Gatekeeper Operator.

Product:

• OPA Gatekeeper
• Open Policy Agent

Repository:

• Policy Repo

Dependencies: None

Owners:

• CODEOWNERS

Monitoring

Monitoring is provided by Prometheus, Grafana and Thanos.

Product:

• Prometheus
• Grafana
• Thanos

Repository:

• Monitoring Repo

Dependencies: None

Owners:

• CODEOWNERS

Cluster Auditor

Cluster Auditor is an internal tool that provides compliance information to Cluster Owners and Application Developers for insight into Reference DevSecOps compliance

Product:

Repository: Cluster Auditor

Dependencies:

• Logging
• OPA Gatekeer

Owners:

• CODEOWNERS

Repository:

• Cluster Auditor Repo

Twistlock

Twistlock provides runtime vulnerability detection

Product:

• Twistlock

Repository: Twistlock Repo

Dependencies:

• RWO StorageClass

Owners:

• CODEOWNERS

Addons

Addons are supported Big Bang packages that come disabled by default.

Security Tools

Security Tools are hosted here: Security Tools

graph TB  

  subgraph "Package Utilities"
    Postgres(DB)
  end

  subgraph "Security"
  Keycloak --> Postgres
  Anchore[Anchore Enterprise] --> Postgres
  end

Keycloak

Keycloak provides SSO to applications.

Product:

• Keycloak
• Postgres

Repository: Keycloak

Dependencies:

• Postgres

Owners:

• CODEOWNERS

Anchore Enterprise

Product:

• Anchore Enterprise

Repository: Anchore Enterprise Repo

Dependencies:

• postgres

Owners:

• CODEOWNERS

Developer Tools

Developer Tools are hosted here: Developer Tools

graph TB

  subgraph "Application Utilities"
    Postgres[DB]
    MinIO[S3 Compatible Storage]
    Redis[Cache Server]
  end


  subgraph "Package Tools"
    GitLab --> GitLabRunners[GitLab Runners]
    GitLab --> MinIO
    GitLab --> Redis
    GitLab --> Postgres
    Sonarqube --> Postgres
  end

GitLab

GitLab is a product for providing DevOps including planning, code hosting, and CICD

Product:

• GitLab

Repository:

• GitLab Repo

Dependencies:

• postgres
• S3 compatible object store (ex: Minio)
• Redis
• RWO StorageClass

Owners:

• CODEOWNERS

GitLab Runners

GitLab Runners are pods that run jobs for GitLab CI/CD

Product:

• GitLab Runners

Repository:

• GitLab Runners Repo

Dependencies:

• GitLab

Owners:

• CODEOWNERS

Sonarqube

Sonarqube provides code reviews for code quality and security

Product:

• Sonarqube

Repository:

• Sonarqube Repo

Dependencies:

• postgres
• RWO StorageClass

Owners:

• CODEOWNERS

Nexus

Nexus provides a robust artifact repository, supporting artifacts of multiple programming languages

Product:

• Nexus
• Scope:
  • The Nexus OSS will not be supported as the licenced pro version is required for HA and SAML SSO capabilities
  • Only Licended Nexus Repository Pro will be supported

Repository:

• Nexus

Dependencies:

Owners:

• CODEOWNERS

Collaboration Tools

Collaboration tools are hosted here: Collaboration Tools

graph TB
  subgraph "Package Utilities"
    Postgres[DB]
    MinIO[S3 Compatible Storage]
  end

  subgraph "Collaboration Tools"
    MatterMost --> MinIO
  end

Mattermost

Mattermost is an open sourced messaging platform.

Product:

• Mattermost

Repository:

• Mattermost Repoß

Dependencies:

• S3 compatible object store (ex: Minio)

Owners:

• CODEOWNERS

Package Utilities

Application utilities are deployments of utilities used by one or more packages. They are usually not user facing, and are dependencies of user facing packages.

A clear an obvious example of this is PostgreSQL.

graph TB
  subgraph "Package Utilities"
    Postgres[DB]
    MinIO[S3 Compatible Storage]
    Redis[Cache Server]
  end

Minio

Minio provides S3 compatible object storage

Product:

• MinIO

Repository:

• Minio Package

Dependencies: None

Owners:

• CODEOWNERS

Cluster Utilities

Packages that provider cluster level utility, such as RWX storage or generic backup capabilities.

ArgoCD

Product:

• ArgoCD

Repository:

• ArgoCD Repo

Dependency: None

Owners:

• CODEOWNERS

Velero

Velero is an open source tool to safely backup and restore, perform disaster recovery, and migrate Kubernetes cluster resources and persistent volumes

• Velero

Repository:

• Velero Package

Owners:

• CODEOWNERS

BB Technical Oversight Committee (BB TOC)

Process