---
title: Helm generated secrets
description: Helm functions cannot generate the SSH keypair, therefore a Kubernetes job is used to generate the SSH keypair and store it in a Kubernetes secret. In Helm-based ForgeOps deployments, password-style secrets are generated using a Kubernetes job.
component: forgeops
version: 2026.3
page_id: forgeops:prepare:security/helm-gen-sec
canonical_url: https://docs.pingidentity.com/forgeops/2026.3/prepare/security/helm-gen-sec.html
llms_txt: https://docs.pingidentity.com/forgeops/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
keywords: ["Security", "Helm", "Secrets generation"]
---

# Helm generated secrets

Helm functions cannot generate the SSH keypair, therefore a Kubernetes job is used to generate the SSH keypair and store it in a Kubernetes secret. In Helm-based ForgeOps deployments, password-style secrets are generated using a Kubernetes job.

When you create new ForgeOps environment using the `forgeops env` command, the Helm-generated secrets are enabled by default.

In a ForgeOps environment enabled with Helm-generated secrets, Helm creates any missing secrets on the first ForgeOps deployment using Helm. On later upgrades, the chart uses Helm `lookup` to keep the existing secret values so that upgrades do not rotate them unintentionally.

When using the Helm-generated-secrets model, deploy ForgeOps normally using Helm and the `values.yaml` file for your environment.

* Example steps

  The sample steps use the standard ForgeOps Helm deployment flow, while the Helm chart generates and preserves the secrets:

  ```
  $ cd /path/to/forgeops/bin

  $ ./forgeops env --env-name my-env \
    --fqdn my-fqdn.example.com  \
    --cluster-issuer my-cluster-issuer --single-instance

  $ helm upgrade --install identity-platform identity-platform \
    --repo https://ForgeRock.github.io/forgeops/ \
    --namespace my-namespace \
    --values /path/to/forgeops/helm/my-env/values.yaml
  ```