ForgeOps release notes

ForgeOps 2026.3 adds integration with the PingOne Worker service so you can use real-time risk scores to make authentication decisions. Learn more in Integrate ForgeOps with the PingOne Worker service.

A new Helm chart has been created for RCS Server. This allows users to synchronize data with a ForgeOps deployment. Learn more in the ForgeOps RCS Helm chart README.md file.

The Helm release revision number is now appended to the names of amster, ds-set-passwords, and keystore-create Kubernetes jobs in the identity-platform Helm chart. For example amster-3, ds-set-passwords-3, and keystore-create-3. This ensures that when the helm upgrade command is run, it generates a distinct job name, and prevents failures caused by Kubernetes' immutability constraint on existing jobs.

The default ttlSecondsAfterFinished value for all three Kubernetes jobs has been increased from 7200 seconds (2 hours) to 43200 seconds (12 hours), to afford more time to inspect completed or failed jobs before they are automatically cleaned up.

It is now possible to create and use a secret with ForgeOps to connect to the PingOne Worker Service. This secret gets mounted on the AM filesystem so that it can be used by AM. A new flag has been added to forgeops env to set the secret name. Learn more in the PingOne Worker Service integration section.

When you upgrade a ForgeOps deployment, DS schema updates now run automatically. A new add schema script in the ds-idrepo StatefulSet startup process applies schema changes when the deployed DS version requires them or when the schema is missing.

Because the DS runtime scripts now apply changes over time, they are now part of the Helm chart. This lets schema changes apply without rebuilding DS images. For compatibility, the scripts remain hard-linked in docker/DS until older ForgeOps versions are no longer supported.

The amster, ds-set-passwords, and keystore-create Kubernetes job names in the identity-platform Helm chart now include the Helm release revision as a suffix, such as amster-3, ds-set-passwords-3, and keystore-create-3. This ensures that each helm upgrade creates a distinct job name and avoids failures caused by the Kubernetes job immutability constraint.

The forgeops prereqs command installs Traefik in NGINX compatibility mode to ease migration from the old, unmaintained NGINX ingress. If you install Traefik manually, sticky sessions can fail. ForgeOps now adds Traefik-specific annotations for sticky sessions to prevent that issue.

After kubectl rollout restart on a DS StatefulSet, forgeops wait could report success before the rollout completed. ForgeOps now uses kubectl rollout status to check readiness.

The AM service port name now uses http instead of https. The previous name worked with NGINX and with Traefik in NGINX compatibility mode, but it caused failures when Traefik ran normally because the AM pod port is not an SSL port.

The documentation now includes a detailed procedure for connecting to the PingOne Worker service. Learn more in the PingOne Worker service integration.

The documentation now includes steps for migrating from secret-agent to Helm-generated secrets. Learn more in the Helm-generated secrets and Migrate to Helm-generated secrets sections.

The forgeops upgrade-am-config command lets you upgrade PingAM configuration profiles separately in your ForgeOps deployment environments. Learn more in the forgeops upgrade-am-config command reference.

The documentation for ForgeOps releases 7.2, 7.3, and 7.4 is now archived. This documentation is for reference only and is no longer actively maintained. PDFs are available at:

The documentation now clarifies support for ForgeOps-provided Ping Advanced Identity Software images. Learn more in the Support for ForgeOps-provided images section.

Documentation pages now use table blocks instead of card blocks to improve readability and make information easier to scan.