Helm generated secrets

Helm functions cannot generate the SSH keypair, therefore a Kubernetes job is used to generate the SSH keypair and store it in a Kubernetes secret. In Helm-based ForgeOps deployments, password-style secrets are generated using a Kubernetes job.

When you create new ForgeOps environment using the forgeops env command, the Helm-generated secrets are enabled by default.

In a ForgeOps environment enabled with Helm-generated secrets, Helm creates any missing secrets on the first ForgeOps deployment using Helm. On later upgrades, the chart uses Helm lookup to keep the existing secret values so that upgrades do not rotate them unintentionally.

When using the Helm-generated-secrets model, deploy ForgeOps normally using Helm and the values.yaml file for your environment.

Example steps

The sample steps use the standard ForgeOps Helm deployment flow, while the Helm chart generates and preserves the secrets:

$ cd /path/to/forgeops/bin

$ ./forgeops env --env-name my-env \
  --fqdn my-fqdn.example.com  \
  --cluster-issuer my-cluster-issuer --single-instance

$ helm upgrade --install identity-platform identity-platform \
  --repo https://ForgeRock.github.io/forgeops/ \
  --namespace my-namespace \
  --values /path/to/forgeops/helm/my-env/values.yaml