Big Bang Baseline — the DoD foundation SmoothGlue builds on
The problem this solves
Standing up a DoD-compliant Kubernetes platform means more than picking the right tools — it means deploying only hardened, approved container images, enforcing zero-trust networking, wiring SSO across every service, and keeping all of it in sync when packages update. Doing this by hand on every cluster is error-prone, audit-unfriendly, and slow.
Big Bang gives you the framework. SmoothGlue gives you Big Bang — already configured.
What Big Bang is
Big Bang is DoD Platform One's open-source Kubernetes framework for deploying a hardened DevSecOps platform. Technically, it is a Helm umbrella chart that orchestrates a curated set of platform packages. Every image it deploys comes exclusively from Iron Bank — Platform One's hardened, CVE-scanned container registry.
Deployments are managed by Flux, a GitOps operator. When Big Bang is installed, Flux watches a Git repository and reconciles the cluster state against it using HelmRelease Custom Resources. This means the running cluster always reflects what is declared in Git — no manual kubectl apply required.
A single values.yaml file controls which packages are enabled and how they are configured. This is your control plane for the entire platform stack.
Core packages in a standard Big Bang deployment include:
- Istio — service mesh for encrypted east-west traffic and zero-trust mTLS
- Kyverno — policy engine for enforcing security baselines across all workloads
- Keycloak — identity provider for SSO across platform tools
- Cert-Manager — automated TLS certificate provisioning
- Additional packages for observability, secrets management, and ingress
Big Bang by itself is not a turnkey solution. It is a framework that requires expertise to configure correctly for your environment.
How SmoothGlue extends Big Bang
SmoothGlue delivers Big Bang as a Service (BBaaS) — Big Bang with all the hard configuration decisions already made and validated.
Where vanilla Big Bang gives you knobs to turn, SmoothGlue ships with those knobs pre-set for regulated environments: SSO is wired, Iron Bank image pulls are configured, Istio is in enforce mode, and Flux is watching a tested upgrade path. You get a functional, audit-ready platform on day one instead of spending weeks on initial configuration.
SmoothGlue also wraps the Big Bang upgrade process. Rather than manually tracking upstream releases, SmoothGlue pins to semantic versioning ranges and lets Flux handle controlled rollouts — so your cluster stays current with Iron Bank image refreshes without manual intervention between upgrades.
What's pre-configured for you
| Area | What SmoothGlue handles |
|---|---|
| SSO | Keycloak is deployed and pre-wired to all platform tools — no manual OAuth client registration |
| Iron Bank images | All packages pull from Iron Bank automatically; no registry configuration required |
| Zero-trust networking | Istio is deployed in strict mTLS mode with Kyverno policies enforcing traffic rules at install time |
| GitOps drift prevention | Flux is configured to watch the SmoothGlue-managed release repository; configuration drift is automatically reconciled |
| Automatic updates | Flux applies Big Bang upgrades on a semantic versioning schedule, keeping images current with Iron Bank CVE patches |
What you still own
- Your tenant application Helm charts and deployment manifests
- Cluster-specific infrastructure (cloud account, node groups, networking CIDRs)
- Your
values.yamloverrides for any platform packages you customize beyond defaults - Domain names and externally issued TLS certificates
- The decision of which optional Big Bang packages to enable or disable for your mission