A step was missing in base-generate.sh that prevented the updated files from being placed properly. It now copies the results of helm template into the proper location.

Included the --full option in forgeops amster export to enable exporting all realm entities. The bugs in this option have been fixed.

The 8.0.2 am-config-upgrader image changed permissions on some files which caused forgeops upgrade-am-config to break. The forgeops upgrade-am-config command now connects to the container as root. This is an ephemeral container running outside the cluster and reduces the security impact.

Forgeops secret generator is used to replace secret agent. The secret generator will be the default secrets provisioning tool in a future release. Learn more about Secret Generator.

The key stores can be provisioned using the new keystore-create Kubernetes job. This requires you to set up the secret generator in your ForgeOps deployment. Learn more about Secret Generator.

The default root certificate authorities are now provided by OpenSSL in the container. Learn more about providing user-supplied certificates to the truststore.

New forgeops rotate command uses multiple userPassword fields enables no downtime DS password rotations.

The new migrate.py script assists with migrating secrets enabled by the secret agent to the new secret generator. Learn more about how to migrate secrets to secret generator.

New forgeops upgrade command option upgrades your Kustomize overlays to support the new secrets base layout.

The forgeops prereqs command enables setting up the prerequisites, such as certificate agent, ingress controller, and secret management. Learn more about the new forgeops prereqs command here.

The new platform secret descriptions and mount points are described in the Secrets Reference.

ForgeOps documentation can now be accessed through the Develop with Ping Identity site. To access ForgeOps documentation from there, click Build > ForgeOps.

A new technology preview section has been added, describing the secret generator and its setup process.

The base-generate.sh script, creates kustomize/base from the Helm chart, We’ve updated the base-generate.sh script to use the --output-dir option with helm template to generate individual template files. This allowed removing logic from the Helm chart.

We’ve updated the platform.secrets functionality to allow for adding custom secrets. This enables users to use an alternate secrets provider such as external-secrets, or add extra secrets without having to use secret-generator. The Helm value platform.secret_generator_enable has been renamed to platform .secrets_enabled.

In the ForgeOps release 2025.2.0, the import-pem-certs.sh script was moved from the docker/am directory in PingAM docker image to a configmap. Because the script isn’t available as a configmap in release 2025.1.x, the latest AM images built for ForgeOps 2025.2.0 fail when deployed to a ForgeOps 2025.1.x environment. To fix this issue, the import-pem-certs.sh script is added back to the docker/am directory in the PingAM image.

The Bitnami images are no longer available from Docker Hub. So we’ve switched to use the Alpine kubectl image for the keystore-create and ds-snapshot jobs.

In 2025.2.0, we added the ability to perform DS passwords rotation with no downtime. This requires allow-mutliple-password-values to be set to true in the default and root password policies. This was added to docker/ds/ds-setup.sh, but that’s only effective for fresh deployment. We’ve added the dsconfig commands necessary to enable no downtime password rotations to the startup for DS pods.

The procedure to perform secrets rotation without downtime has been added in the Technology Preview section. Learn more at Secrets Rotation.

Added the [How to add custom secrets] page that describes how to create custom secrets with secret-generator. It also describes how to use the same platform.secrets dictionary to use an alternate Kubernetes secrets provider.

We’ve released the new secret agent 1.2.11 to resolve the latest security vulnerabilities.

The following product releases are also available for use in ForgeOps deployments:

When secret-generator and keystore-create Kubernetes jobs are enabled, a single keystore is created for PingAM and PingIDM, and the keystore configurations are consolidated under the keystore_create.config Helm values.

OpenSSL now provides the default root certificate authorities. Users can provide additional certificates through the Helm chart.

Curl often has security vulnerabilities, and is removed from ldif-importer and amster jobs. Curl has been replaced with:

This new command helps with no downtime in DS password rotations for the ds-env-secrets and ds-passwords secrets. It creates old-ds-env-secrets and old-ds-passwords secrets that are used by the ds-set-passwords job and the init container to maintain the old passwords during the rotation process.

Use this command to upgrade existing Kustomize overlays. It’s used to update the secrets child overlay with the new structure and to update the ForgeOps-provided default overlay in the future.

Customers who need to build their own container images can create their own release files so forgeops image and forgeops info commands can work with these custom images.

Reordered the patches in the amster/upload and amster/export sub overlays to manage amster configuration correctly.

To reduce confusion, the optional FORGEOPS_ROOT environment variable is renamed FORGEOPS_DATA. The forgeops command prompts and fixes this in the ~/.forgeops.conf file if FORGEOPS_ROOT is detected.

Ensure the openam container has access to the default boot.json when something causes the container to restart. This is because the fbc-init init container doesn’t run when the openam container restarts so the default boot.json isn’t set for startup.

The forgeops info -e my-env command would throw an exception when an image has a tag that is not in the form x.y.z. This was due to a bug in lib.python.releases.is_valid_release(). It now returns false if a tag doesn’t match that pattern.

The forgeops build command didn’t work properly if the proper tag was not provided. It now will use latest if a tag is not specified.

PingGateway 2025.3.0 Docker image has been released. The forgeops command has been updated to deploy PingGateway in a ForgeOps deployment.

PingGateway has two endpoints now:

The Terraform cluster creation manifests have been updated to use Kubernetes version 1.32 on all platforms.

Implemented a mechanism to define extra environment variables for AM, IDM and custom variables to the platform configuration map.

The following new features have been added to the install-prereqs script:

Added the ability to enable Prometheus and Grafana in the Helm chart.

Using forgeops image and forgeops info commands, you can now look for and select a newer version, skipping the version you specified in the command if it isn’t available.

Added the --amster-retain option to the forgeops env command. You can configure a ForgeOps deployment environment to keep the amster pod running for troubleshooting purposes.

The forgeops env command now adds a patch to update the namespace when enabling volume snapshots.

The deprecated forgeops generate command has been removed.

The certmanager-deploy.sh and secret-agent scripts have been removed in favor of the charts/scripts/install-prereqs script, which includes steps to deploy certmanager and secret-agent.

Monitoring tools Grafana and Prometheus have been updated to use the latest versions, along with newer monitoring endpoints. Learn more at About ForgeOps deployment monitoring.

You can set FORGEOPS_ROOT parameter to specify the local folder that contains the Docker, Helm, and Kustomize configurations. This allows you to keep your changes in a separate Git repository. You can create a ~/.forgeops.conf file with your overrides. Your development team can place a forgeops.conf file in their FORGEOPS_ROOT location which contains team-wide settings.

You can now get a list of supported platform releases and their latest flags using the forgeops info --list-releases command.

You can now define and update PingGateway node configuration parameters, such as CPU, memory, replicas, and pull policy in a ForgeOps deployment environment. This lets you install PingGateway quickly in a ForgeOps deployment.

The version of pyyaml is updated. Run the [.command]forgeops configure# command to update your libraries.

The timestamp issue in the forgeops info --env-name has been fixed.

Helm pre-install hooks are now used to deploy DS certificates. These certificates are no longer deleted when the Helm chart is uninstalled.

Updated the AM service in the Helm chart to use HTTPS target port.

Prometheus default ports and labels have been updated to match the new Helm chart.

The procedures to upgrade ForgeOps artifacts and component images are revised. Learn more in Upgrade and Migration Overview.

Because we’ve removed the forgeops-minikube script, we’ve revised the steps to create a minikube cluster to use the generic minikube command. Learn more about creating a minikube cluster here.

We’ve added the step to create the fast storage class required for ForgeOps deployment on minikube.

The new forgeops command reference contains more information on the new forgeops command.

Learn more about the new ForgeOps release process here

Learn more about customizing DS image in the new section on Customizing DS image.