ForgeOps

Ping RCS Connector

Why RCS?

The Ping Remote Connector Server (RCS) is a lightweight server that allows your ForgeOps deployment to connect to external systems that aren’t directly accessible from the deployment. You can deploy RCS in the same Kubernetes cluster as your ForgeOps deployment or in a separate cluster. You can also deploy RCS on-premises or in the cloud, depending on your needs.

This use case focuses on using RCS to sync identities from Advanced Identity Cloud to ForgeOps so you can use ForgeOps as a disaster recovery environment.

New RCS Helm chart

You can now use the new charts/rcs Helm chart to deploy RCS in a ForgeOps deployment. The Helm chart sets up the following components:

  • Communication: The server listens on port 8759

  • Security and access control: You can optionally restrict which systems are allowed to connect (using remoteIps)

  • Configuration: The Helm chart manages the server’s configuration files and logging settings

  • Extensions: You can add custom plugins or libraries to expand the server’s capabilities

  • Security certificates: You can optionally add security certificates to protect connections

    When you deploy the server, it automatically creates a shared security key that all instances use. You can either let the system generate this key automatically by using a password (RCS_KEY_PASSWORD) or provide your own existing key.

RCS registers with IDM automatically

When you deploy the ForgeOps and RCS charts to the same namespace, IDM registers the RCS automatically. An optional sample LDAP provisioner (platform.rcs.provisioner.enabled) exposes the DS idrepo user store through the RCS, which gives the admin UI a working Connectors entry and a base for synchronization setup. Stale registration files are cleaned when IDM restarts. The deployer-supplied connector configurations remain unchanged.

RCS chart hardening

  • The StatefulSet sets serviceName, which is required in Kubernetes versions earlier than 1.34 and provides DNS for each pod.

  • Secret volumes are readable by the non-root runtime UID (mode 0444).

  • The network policy uses the chart’s own selector, admits same-namespace consumers alongside remoteIps, and allows DNS over TCP.

  • A checksum/config annotation rolls the pods when the rendered configuration changes.

  • RCS_KEY is JSON-escaped before being written into IDM’s registration configuration.

  • capabilities.drop uses Kubernetes' ALL token instead of the invalid All.

  • The chart-publish workflow can no longer publish the placeholder-versioned platform charts or a chart with an unreadable version header.

Learn more about installing and configuring RCS with ForgeOps, in Helm chart for RCS.