v6.13.0

Released: April 16, 2025

📦 SmoothGlue Features

• A new optional variable cloudwatch_log_group_retention_in_days has been added to the env.hcl files to configure the EKS cluster log group retention time. It can be configured as shown below.

  locals {
    cluster_inputs = {
      # Adjust as needed, default is 90 days. Valid value for X is one of:
      # [0 1 3 5 7 14 30 60 90 120 150 180 365 400 545 731 1096 1827 2192 2557 2922 3288 3653]
      cloudwatch_log_group_retention_in_days = X
    }
  }

• IAM policies generated by the SmoothGlue IAC no longer apply tags to IAM policies when compatibility_mode is set to true. This change is to conform to limitations on high-side deployments

  • NOTE: On an existing cluster, you may need to delete the allow_kms and allow_cluster_autoscaler IAM policies to allow their recreation.

⏩ Upgraded Packages

• This release of SmoothGlue Enterprise v6.13.0 includes Big Bang Version 2.50.0. For more details on the features and updates included in Big Bang Version 2.50.0, please refer to the Big Bang release notes.
• Upgrades the following Big Bang third-party apps:
  • Confluence LTS: 9.2.3
  • Jira LTS: 10.3.5
  • Nexus IQ Server: 1.189.0-01

🐞 Bug Fixes

• Fixed an issue that prevented user data scripts from running on AL2023 AMIs.
• Fixed an issue that overwrote default values from SmoothGlue with customer overrides. This prevented SmoothGlue default values from being viewable at runtime. Overrides provided by customers are still overlayed on top of SmoothGlue default values, so this is a purely cosmetic change.

❗ Known Issues

• The following only applies to the initial deployment of the SmoothGlue IAC. No action is required for updates to already deployed clusters - Due to an upstream issue for the EKS module and when deploying a cluster using an AL2023 AMI, the System Integrator will need to manually generate and set a Zarf registry pull password. The following config can be added to the env.hcl file:

  locals {
    cluster_inputs = {
      zarf_registry_pull_password = "securepassword123"
    }
  }

• When using a network load balancer (NLB) with the preserve_client_ip option enabled, the default routing rules for EKS nodes prevent nodes from accessing platform services hosted on the same node, which can cause failures when logging into Keycloak, particularly on clusters with fewer nodes.

  • More specifically, the default routing rules for nodes do not route traffic to the VPC router for traffic within the node’s local subnet, since these addresses should theoretically be reachable directly by the node. However, when using the preserve_client_ip option, the VPC router rewrites the source IP for traffic; when the node attempts to talk to the NLB, the traffic is rewritten so that it appears to come from the node itself, and the return traffic is not able to be routed correctly back to the NLB.
  • The following options are potential workarounds:
    • Disabling the preserve_client_ip option on the NLB will resolve the issue at the cost of losing source attribution for incoming traffic.
    • Removing the local subnet route on nodes will resolve the issue at the cost of increasing the amount and cost of traffic being routed through the VPC router.
    • Increasing the node count for the cluster will reduce the likelihood of the issue because it will become less likely for any given traffic to be routed back to the original node.

• The Big Bang Istio Helm chart has a bug that prevents Istio Gateway deployments from properly being upgraded. During an upgrade, Istio Gateway deployments may get stuck as a result and will need manual intervention to complete the upgrade. To validate the issue in the cluster, check the health of the istiooperators.install.istio.io resource as follows:

  kubectl get istiooperators.install.istio.io -n istio-system

  If it is in Error status, delete all Istio Gateway deployments in the istio-system namespace to allow the Istio Operator to finish reconciling the upgrade and report a Healthy status. The deployments will be recreated automatically by the Istio Operator. For example:

  kubectl delete deployment.apps/admin-ingressgateway -n istio-system
  kubectl delete deployment.apps/passthrough-ingressgateway -n istio-system
  kubectl delete deployment.apps/public-ingressgateway -n istio-system

  Note: Deleting the deployments will entail some brief but non-zero downtime.

  https://repo1.dso.mil/big-bang/product/packages/istio-controlplane/-/issues/253 has been opened to track this issue, which was introduced in SmoothGlue 6.7 (Big Bang 2.44)

🌐 Compatibility

• The packages for this release were built using Zarf v0.46.0.
• The packages were tested across the following Kubernetes distributions:
  • RKE2: v1.29.8+rke2r1
  • K3s: v1.32.3+k3s1
  • EKS: v1.30.9-eks-5d632ec

🔗 Helpful Links

• Refer to the SmoothGlue documentation for additional guidance.