Big Bang
Customers
template

Repository

git clone <your-fork-repo-url>
cd <your-repo-name>
git checkout -b template-demo
# Example using package-strategy for a 'dev' environment
cp -r package-strategy/ dev
# On Linux:
sed -i 's|./package-strategy|./dev|g' dev/bigbang.yaml
# On macOS (requires gsed, install via 'brew install gnu-sed'):
# gsed -i 's|./package-strategy|./dev|g' dev/bigbang.yaml
export GPG_FP="YOUR_KEY_FINGERPRINT" # Get this via 'gpg --list-keys'
# On Linux:
sed -i "s/pgp: FALSE_KEY_HERE/pgp: ${GPG_FP}/" .sops.yaml
# On macOS:
# gsed -i "s/pgp: FALSE_KEY_HERE/pgp: ${GPG_FP}/" .sops.yaml

git add .sops.yaml
git commit -m "chore: configure SOPS GPG key fingerprint"
sops --encrypt base/bigbang-dev-cert.yaml > base/secrets.enc.yaml
sops base/secrets.enc.yaml
# Example structure within base/secrets.enc.yaml
apiVersion: v1
kind: Secret
metadata:
  name: common-bb # Use 'environment-bb' for environment-specific secrets
stringData:
  values.yaml: |-
    # Add your Iron Bank credentials here
    registryCredentials:
    - registry: registry1.dso.mil
      username: your-iron-bank-username
      password: your-iron-bank-pat-or-cli-secret

    # Add other required secret values below
    # Example: Istio CA certificates if not using cert-manager
    # istio:
    #   values:
    #     cacerts:
    #     - secretName: cacerts
    #       certFile: |
    #         -----BEGIN CERTIFICATE-----
    #         ...
    #         -----END CERTIFICATE-----
    #       keyFile: |
    #         -----BEGIN PRIVATE KEY-----
    #         ...
    #         -----END PRIVATE KEY-----
    #       rootFile: |
    #         -----BEGIN CERTIFICATE-----
    #         ...
    #         -----END CERTIFICATE-----

  # --- Existing content from bigbang-dev-cert.yaml below ---
  # (Ensure this section remains if you keep the demo cert initially)
  istio:
    gateways:
      public:
        tls:
          key: |
            -----BEGIN PRIVATE KEY-----
            ... demo key ...
            -----END PRIVATE KEY-----
          cert: |
            -----BEGIN CERTIFICATE-----
            ... demo cert ...
            -----END CERTIFICATE-----
git add base/secrets.enc.yaml
# Optional: Remove the unencrypted demo cert if you added your own TLS secrets
# git rm base/bigbang-dev-cert.yaml
git commit -m "feat: add initial encrypted secrets (Iron Bank creds, demo TLS)"
# Example snippet from dev/bigbang.yaml
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: environment-repo # Name for the Flux GitRepository object
  namespace: bigbang
spec:
  interval: 1m
  url: https://your-private-repo-domain/your-org/your-repo-name.git # <-- UPDATE THIS
  ref:
    branch: template-demo # <-- UPDATE THIS
  secretRef:
    name: private-git # Matches the secret created during deployment
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: environment # Name for the Flux Kustomization object
  namespace: bigbang
spec:
  interval: 5m
  path: ./dev # <-- Path within your repo (should match the directory)
  prune: true
  sourceRef:
    kind: GitRepository
    name: environment-repo # Must match the GitRepository name above
  decryption:
    provider: sops
    secretRef:
      name: sops-gpg # Matches the secret containing the GPG private key
git add dev/bigbang.yaml
git commit -m "chore: configure flux git source for dev environment"
git push --set-upstream origin template-demo
# Find the version ref in base/kustomization.yaml (e.g., ?ref=2.50.0)
BB_VERSION="X.Y.Z" # Example: BB_VERSION="2.50.0"
kubectl apply -k "https://repo1.dso.mil/platform-one/big-bang/bigbang.git//base/flux?ref=${BB_VERSION}"
kubectl wait deployment --all --for condition=Available -n flux-system --timeout=5m
kubectl create ns bigbang --dry-run=client -o yaml | kubectl apply -f -
# Ensure GPG_FP is set to your key fingerprint
export GPG_FP="YOUR_KEY_FINGERPRINT"
gpg --export-secret-key --armor "${GPG_FP}" | kubectl create secret generic sops-gpg -n bigbang --from-file=bigbangkey.asc=/dev/stdin
 kubectl create secret generic private-git -n bigbang \
   --from-literal=username=<your-private-repo-username> \
   --from-literal=password=<your-private-repo-pat>
 kubectl create secret docker-registry private-registry -n flux-system \
   --docker-server=registry1.dso.mil \
   --docker-username=<your-iron-bank-username> \
   --docker-password=<your-iron-bank-pat-or-cli-secret>
# Only needed if using HelmRepository source for the main Big Bang chart
# kubectl create secret docker-registry private-registry -n bigbang \
#   --docker-server=registry1.dso.mil \
#   --docker-username=<your-iron-bank-username> \
#   --docker-password=<your-iron-bank-pat-or-cli-secret>
kubectl apply -f dev/bigbang.yaml
# Check if Flux can clone your repo and process the kustomization
kubectl get gitrepositories,kustomizations -n bigbang
# Wait for the Kustomization to report Ready status
kubectl wait kustomization/environment -n bigbang --for=condition=Ready --timeout=15m
kubectl get helmreleases -n bigbang
# Look for errors or progress
kubectl describe helmrelease bigbang -n bigbang
# Check pods across relevant namespaces (bigbang, flux-system, istio-system, etc.)
kubectl get pods -A -w
# In dev/configmap.yaml under stringData: "values.yaml":
keycloak:
  enabled: true
# In base/kustomization.yaml
bases:
# Update the tag here VVVVVVV
- https://repo1.dso.mil/platform-one/big-bang/bigbang.git//base?ref=NEW_VERSION_TAG
# ... other bases ...
# In base/kustomization.yaml
resources:
- helmrepo.yaml
- cosignsecret.yaml
# ... other resources ...

# Remove the Big Bang git base from the 'bases:' list if using OCI exclusively
# bases:
# - https://repo1.dso.mil/platform-one/big-bang/bigbang.git//base?ref=X.Y.Z # <-- REMOVE THIS LINE
# In base/kustomization.yaml
patchesStrategicMerge:
# Enable this patch to use OCI HelmRepo with Cosign Verify
- |-
  apiVersion: helm.toolkit.fluxcd.io/v2beta2
  kind: HelmRelease
  metadata:
    name: bigbang
    namespace: bigbang
  spec:
    chart:
      spec:
        # chart: bigbang # Chart name defined in HelmRepository
        version: X.Y.Z # <-- Set specific chart version
        sourceRef:
          kind: HelmRepository
          name: registry1 # Matches name in base/helmrepo.yaml
          namespace: bigbang # HelmRepository is cluster-scoped, but Flux checks namespace
        verify:
          provider: cosign
          secretRef:
            name: bigbang-cosign-pub # Matches name in base/cosignsecret.yaml
# Example: my-environment/git-ca-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: git-ca-certs
  namespace: bigbang # Must be in the same namespace as the GitRepository
stringData:
  ca.crt: |
    -----BEGIN CERTIFICATE-----
    YOUR-CUSTOM-CA-CERT-PEM
    -----END CERTIFICATE-----
  # Optional: Add username/password if needed for this specific repo
  # username: git-user
  # password: git-password
# In my-environment/bigbang.yaml
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: environment-repo
  namespace: bigbang
spec:
  # ... url, ref ...
  secretRef:
    name: private-git # Still use this for standard auth if needed
  verify: # Add this section
    mode: tls
    secretRef:
      name: git-ca-certs # Reference the secret with the CA cert
"ignorePaths": ["package-strategy/**", "umbrella-strategy"],