---
title: What’s new in ForgeOps 2025.2
description: In the ForgeOps 2025.2 release, the team focused on streamlining secrets provisioning and rotation in ForgeOps deployment environments. It's planned to deprecate the proprietary secret agent operator and move to use a more generic industry-familiar third-party tooling.
component: forgeops
version: 2025.2
page_id: forgeops:start:whats-new
canonical_url: https://docs.pingidentity.com/forgeops/2026.3/start/whats-new.html
llms_txt: https://docs.pingidentity.com/forgeops/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
superseded_by: https://docs.pingidentity.com/forgeops/2026.3/start/whats-new.html
section_ids:
  highlights: Highlights
  documentation_updates: Documentation Updates
  release_information: Release information
---

# What's new in ForgeOps 2025.2

In the ForgeOps 2025.2 release, the team focused on streamlining secrets provisioning and rotation in ForgeOps deployment environments. It's planned to deprecate the proprietary secret agent operator and move to use a more generic industry-familiar third-party tooling.

## Highlights

* Provision secrets using the secret generator operator

  Forgeops secret generator is used to replace secret agent. The secret generator will be the default secrets provisioning tool in a future release. Learn more about [Secret Generator](../preview/secret-generator.html).

* Key stores can be provisioned by a Kubernetes job

  The key stores can be provisioned using the new `keystore-create` Kubernetes job. This requires you to set up the secret generator in your ForgeOps deployment. Learn more about [Secret Generator](../preview/secret-generator.html).

* Trust stores are no longer provisioned by the secret agent

  The default root certificate authorities are now provided by OpenSSL in the container. Learn more [about providing user-supplied certificates to the truststore](https://github.com/ForgeRock/forgeops/blob/dev/charts/identity-platform/values.yaml#L155).

* DS password rotation without downtime

  New forgeops rotate command uses multiple `userPassword` fields enables no downtime DS password rotations.

* New script to migrate secrets from secret agent to secret generator

  The new `migrate.py` script assists with migrating secrets enabled by the secret agent to the new secret generator. Learn more about how to [migrate secrets to secret generator](../preview/migrate-to-secgen.html).

* Upgrade Kustomize overlays to use new secrets

  New forgeops upgrade command option upgrades your Kustomize overlays to support the new secrets base layout.

* New forgeops prereqs command

  The forgeops prereqs command enables setting up the prerequisites, such as certificate agent, ingress controller, and secret management. Learn more about the new forgeops prereqs command [here](../reference/forgeops-cmd-ref.html#prereqs-ref).

* New secrets reference guide

  The new platform secret descriptions and mount points are described in the [Secrets Reference](../reference/secrets-reference.html).

## Documentation Updates

* ForgeOps docs are on the Developer site

  ForgeOps documentation can now be accessed through the [Develop with Ping Identity](https://developer.pingidentity.com/) site. To access ForgeOps documentation from there, click **Build > ForgeOps**.

* New Technology Preview section

  A new technology preview section has been added, describing the secret generator and its setup process.

## Release information

Further release information is available in the [ForgeOps `2025.2.1` release notes](../rn/rn.html)