---
title: Ping RCS Connector
description: Deploy the Ping Remote Connector Server with ForgeOps
component: forgeops
version: 2026.3
page_id: forgeops:integration:rcs-helm-chart
canonical_url: https://docs.pingidentity.com/forgeops/2026.3/integration/rcs-helm-chart.html
llms_txt: https://docs.pingidentity.com/forgeops/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-08-12T20:30:59Z
---

# Ping RCS Connector

* Why RCS?

  The Ping Remote Connector Server (RCS) is a lightweight server that allows your ForgeOps deployment to connect to external systems that aren't directly accessible from the deployment. You can deploy RCS in the same Kubernetes cluster as your ForgeOps deployment or in a separate cluster. You can also deploy RCS on-premises or in the cloud, depending on your needs.

This use case focuses on using RCS to sync identities from Advanced Identity Cloud to ForgeOps so you can use ForgeOps as a disaster recovery environment.

* New RCS Helm chart

  You can now use the new `charts/rcs` Helm chart to deploy RCS in a ForgeOps deployment. The Helm chart sets up the following components:

  * **Communication**: The server listens on port 8759

  * **Security and access control**: You can optionally restrict which systems are allowed to connect (using `remoteIps`)

  * **Configuration**: The Helm chart manages the server's configuration files and logging settings

  * **Extensions**: You can add custom plugins or libraries to expand the server's capabilities

  * **Security certificates**: You can optionally add security certificates to protect connections

    When you deploy the server, it automatically creates a shared security key that all instances use. You can either let the system generate this key automatically by using a password (`RCS_KEY_PASSWORD`) or provide your own existing key.

* RCS registers with IDM automatically

  When you deploy the ForgeOps and RCS charts to the same namespace, IDM registers the RCS automatically. An optional sample LDAP provisioner (`platform.rcs.provisioner.enabled`) exposes the DS idrepo user store through the RCS, which gives the admin UI a working Connectors entry and a base for synchronization setup. Stale registration files are cleaned when IDM restarts. The deployer-supplied connector configurations remain unchanged.

* RCS chart hardening

  * The StatefulSet sets `serviceName`, which is required in Kubernetes versions earlier than 1.34 and provides DNS for each pod.

  * Secret volumes are readable by the non-root runtime UID (mode 0444).

  * The network policy uses the chart's own selector, admits same-namespace consumers alongside `remoteIps`, and allows DNS over TCP.

  * A `checksum/config` annotation rolls the pods when the rendered configuration changes.

  * `RCS_KEY` is JSON-escaped before being written into IDM's registration configuration.

  * `capabilities.drop` uses Kubernetes' `ALL` token instead of the invalid `All`.

  * The chart-publish workflow can no longer publish the placeholder-versioned platform charts or a chart with an unreadable version header.

Learn more about installing and configuring RCS with ForgeOps, in [Helm chart for RCS](https://github.com/ForgeRock/forgeops/tree/2026.3.2/charts/rcs/README.md).