**BB- Product Improvement & Maintenance (Value Stream Initiative)** ## Description **Linked Issue:** https://repo1.dso.mil/big-bang/bigbang/-/issues/3096 Unified Platform (UP) teams rely heavily on Kubernetes-native certificate automation for ingress, internal services, webhooks, and other in-cluster workloads. Today, cert-manager and related trust components are typically deployed via custom overlays or patched Big Bang deployments, creating drift, operational overhead, and inconsistent security posture across environments. This Epic proposes adding **cert-manager**, **trust-manager**, and optionally **approver-policy** as **Big Bang–managed applications**, enabling UP teams to deploy and operate certificate management components through the standard Big Bang lifecycle (install, upgrade, rollback) with consistent configuration, security controls, and policy enforcement. ## Customer or Stakeholder Sponsor **Customer:** Platform One – Unified Platform (UP) **Stakeholders:** * Unified Platform platform engineering and SRE teams * Big Bang product and platform stakeholders This request originates from a Unified Platform user and is tracked in https://repo1.dso.mil/big-bang/bigbang/-/issues/3096 ## Value to user of BB Providing cert-manager and supporting trust components as BB-managed apps delivers the following value: * **Reduced configuration drift:** Eliminates the need for custom overlays that diverge from BB defaults and complicate upgrades. * **Lower operational overhead:** Standardizes deployment patterns (values, RBAC, namespaces, policies) across environments. * **Consistent trust distribution:** Enables a first-class, BB-native mechanism for managing CA bundles and trust anchors across namespaces and workloads. * **Improved security and compliance posture:** Allows certificate issuance and approval policies to be enforced consistently through BB-managed components. **Metrics / Success Indicators:** * Reduction in external overlays related to certificate management in UP clusters * Successful BB-managed upgrades of cert-manager without manual intervention * Adoption of BB-managed cert-manager by UP environments * Reduced certificate-related operational incidents or manual remediation This Epic supports Big Bang OKRs related to **platform consistency**, **secure-by-default deployments**, and **reducing operational toil for platform users**. ## Requirements/Scope The Epic is considered complete when the following high-level requirements are met: 1. **cert-manager as a BB-managed application** * Deploy controller, webhook, and cainjector * BB-aligned defaults: * Namespace conventions * Iron Bank–sourced images where applicable * Secure security contexts * Network policies (if applicable) * Configurable via values: * CRD installation * Extra arguments * Leader election namespace * Resource requests/limits * Tolerations and affinity 2. **trust-manager as a BB-managed application** * Enables distribution of trust bundles (ConfigMaps/Secrets) across namespaces * Supports internal PKI chains and service mesh integrations * Follows BB security and configuration patterns 3. **(Optional) approver-policy as a BB-managed application** * Enables centralized policy enforcement for certificate approval * Supports restrictions on: * DNS names * Issuer references * Namespaces * SAN patterns 4. **Optional-by-default behavior** * No change to existing Big Bang behavior unless explicitly enabled via values ## Out of Scope N/A ## Duration Estimated **2–6 weeks**, depending on: * Image sourcing and Iron Bank availability * Security review requirements * Integration complexity with existing BB components ## Team Big Bang product team - sub team not known at this time. ## Epic Team Members n/a ## Dependencies * Availability of approved container images (Iron Bank where required) * Ironbank capacity for maintaining these new images * Compatibility with existing Big Bang core and managed apps * Helm chart maturity and upstream release stability * Security and compliance review alignment * Determine which organization will maintain and update these charts over time. ## Risks * Upstream chart changes or release cadence causing integration delays * Iron Bank image availability impacting timelines * Complexity around CRD lifecycle management during upgrades * Overlapping functionality with existing customer-installed components ## Acceptance Criteria * cert-manager can be enabled via Big Bang packages without external overlays * sufficient CI tests for validating updates to the applications * trust-manager deploys successfully and propagates trust bundles across namespaces * approver-policy (if enabled) enforces certificate approval rules as configured * All components follow BB lifecycle (install, upgrade, rollback) cleanly * No impact to existing BB deployments unless explicitly enabled ## Related Issues and/or Epics N/A ## How this epic maps to Big Bang OKRs This Epic directly supports Big Bang goals of: * Providing **secure-by-default platform capabilities** * Reducing **customer-maintained overlays and drift** * Improving **operational consistency across environments** * Enabling **enterprise-ready security primitives** as first-class platform features ## How does this proposed work benefit the enterprise using Big Bang and/or end user SRE? From an enterprise and SRE perspective, this Epic provides a standardized, supported approach to certificate management that reduces risk, simplifies operations, and improves security posture. SREs gain predictable behavior, consistent trust distribution, and policy-backed certificate issuance without maintaining bespoke deployment logic. ## How does this benefit the internal Big Bang team This Epic reduces long-term support burden by eliminating one-off customer overlays and customizations. It improves upgrade reliability, aligns customer usage with BB-supported patterns, and strengthens Big Bang’s position as a complete, production-ready platform for secure Kubernetes operations.