--- title: ForgeOps release notes description: Subscribe to the ForgeOps 2026.3 RSS feed to get notified when the latest ForgeOps documentation is updated. component: forgeops version: 2026.3 page_id: forgeops:rn:rn canonical_url: https://docs.pingidentity.com/forgeops/2026.3/rn/rn.html llms_txt: https://docs.pingidentity.com/forgeops/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md section_ids: 2026: 2026 forgeops_2026_3_release_features: ForgeOps 2026.3 release features new_features_and_updated_functionality: New features and updated functionality bug_fixes: Bug fixes documentation_updates: Documentation updates --- # ForgeOps release notes Subscribe to the [icon: rss-square, set=fa][ForgeOps 2026.3 RSS feed](https://docs.pingidentity.com/forgeops/latest/rn/rn.xml) to get notified when the latest ForgeOps documentation is updated. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | Learn more about configuring GitHub notifications [here](https://docs.github.com/en/account-and-profile/managing-subscriptions-and-notifications-on-github/setting-up-notifications/configuring-notifications) so you can get notified on ForgeOps releases. | | | | | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------ | | Validated Kubernetes, Ingress-NGINX Controller, HAProxy Ingress, cert-manager, and operator versions for deploying Ping Advanced Identity Software 2026.3 | [Link](versions.html) | | Limitations when deploying Ping Advanced Identity Software `2026.3` on Kubernetes | [Link](limitations.html) | | More information about the evolving nature of the `forgeops` repository, including technology previews, legacy features, and feature deprecation and removal | [Link](evolution.html) | | Legal notices | [Link](legal.html) | | Release notes for ForgeOps 2026.2 | [Link](https://docs.pingidentity.com/forgeops/2026.2/rn/rn.html) | | Release notes for ForgeOps 2026.1 | [Link](https://docs.pingidentity.com/forgeops/2026.1/rn/rn.html) | | Release notes for ForgeOps 2025.1 and 2025.2 | [Link](https://docs.pingidentity.com/forgeops/2025.2/rn/rn.html) | | Release notes for 2024 and earlier | [Link](https://docs.pingidentity.com/forgeops/7.5/rn/rn.html#2024) | | Release notes for 2023 and earlier | [Link](https://docs.pingidentity.com/forgeops/7.4/rn/rn.html#2023) | ## 2026 ### ForgeOps 2026.3 release features #### New features and updated functionality * Helm-based secrets * Secrets generation (Helm only) You can now generate secrets with Helm in ForgeOps deployments. When you create a new ForgeOps environment with release 2026.3 or later, Helm-based secret generation is enabled by default. Learn more in [Helm-generated secrets](../prepare/security/helm-gen-sec.html). * ssh-keygen job Helm cannot generate ssh keys, so a Kubernetes job is used to generate an ssh key and store it in a secret. This is used by `amster` to connect to am. * New migration command A new subcommand, **forgeops migrate sa2hs**, has been added. This subcommand can be used to migrate secrets from secret agent to Helm-generated secrets. * Integration with the PingOne Worker service ForgeOps 2026.3 adds integration with the PingOne Worker service so you can use real-time risk scores to make authentication decisions. Learn more in [Integrate ForgeOps with the PingOne Worker service](../integration/int-p1-worker.html). * Helm chart for RCS A new Helm chart has been created for RCS Server. This allows users to synchronize data with a ForgeOps deployment. Learn more in the [ForgeOps RCS Helm chart README.md file](https://github.com/ForgeRock/forgeops/tree/2026.3.0/charts/rcs/README.md). * Dynamic job naming (Helm only) The Helm release revision number is now appended to the names of `amster`, `ds-set-passwords`, and `keystore-create` Kubernetes jobs in the `identity-platform` Helm chart. For example `amster-3`, `ds-set-passwords-3`, and `keystore-create-3`. This ensures that when the `helm upgrade` command is run, it generates a distinct job name, and prevents failures caused by Kubernetes' immutability constraint on existing jobs. * Increased TTL for Helm jobs (Helm only) The default `ttlSecondsAfterFinished` value for all three Kubernetes jobs has been increased from 7200 seconds (2 hours) to 43200 seconds (12 hours), to afford more time to inspect completed or failed jobs before they are automatically cleaned up. * Adding PingOne secret It is now possible to create and use a secret with ForgeOps to connect to the PingOne Worker Service. This secret gets mounted on the AM filesystem so that it can be used by AM. A new flag has been added to `forgeops env` to set the secret name. Learn more in the [PingOne Worker Service integration](../integration/int-p1-worker.html) section. * Applying schema updates to existing deployments When you upgrade a ForgeOps deployment, DS schema updates now run automatically. A new `add schema` script in the `ds-idrepo` StatefulSet startup process applies schema changes when the deployed DS version requires them or when the schema is missing. * Moving DS runtime scripts into the Helm chart Because the DS runtime scripts now apply changes over time, they are now part of the Helm chart. This lets schema changes apply without rebuilding DS images. For compatibility, the scripts remain hard-linked in `docker/DS` until older ForgeOps versions are no longer supported. #### Bug fixes * Dynamic Kubernetes job naming (Helm only) The `amster`, `ds-set-passwords`, and `keystore-create` Kubernetes job names in the `identity-platform` Helm chart now include the Helm release revision as a suffix, such as `amster-3`, `ds-set-passwords-3`, and `keystore-create-3`. This ensures that each `helm upgrade` creates a distinct job name and avoids failures caused by the Kubernetes job immutability constraint. * Adding annotations for Traefik sticky sessions The `forgeops prereqs` command installs Traefik in NGINX compatibility mode to ease migration from the old, unmaintained NGINX ingress. If you install Traefik manually, sticky sessions can fail. ForgeOps now adds Traefik-specific annotations for sticky sessions to prevent that issue. * `forgeops wait` reports success prematurely After `kubectl rollout restart` on a DS StatefulSet, `forgeops wait` could report success before the rollout completed. ForgeOps now uses `kubectl rollout status` to check readiness. * Set the AM service port to HTTP The AM service port name now uses `http` instead of `https`. The previous name worked with NGINX and with Traefik in NGINX compatibility mode, but it caused failures when Traefik ran normally because the AM pod port is not an SSL port. #### Documentation updates * Connecting to the PingOne Worker service The documentation now includes a detailed procedure for connecting to the PingOne Worker service. Learn more in the [PingOne Worker service integration](../integration/int-p1-worker.html). * Migrating to Helm-based secrets The documentation now includes steps for migrating from secret-agent to Helm-generated secrets. Learn more in the [Helm-generated secrets](../prepare/security/helm-gen-sec.html) and [Migrate to Helm-generated secrets](../prepare/security/migrate-helmsec.html) sections. * `forgeops upgrade-am-config` command The `forgeops upgrade-am-config` command lets you upgrade PingAM configuration profiles separately in your ForgeOps deployment environments. Learn more in the [`forgeops upgrade-am-config` command reference](../reference/forgeops-cmd-ref.html#upgrade-am-config). * Archived ForgeOps documentation for releases 7.2, 7.3, and 7.4 The documentation for ForgeOps releases 7.2, 7.3, and 7.4 is now [archived](https://docs.pingidentity.com/archive/#family-forgeops). This documentation is for reference only and is no longer actively maintained. PDFs are available at: * [ForgeOps 7.2 PDF](https://cdn-docs.pingidentity.com/archive/pdf/forgeops/7.2/forgeops-7.2.pdf) * [ForgeOps 7.3 PDF](https://cdn-docs.pingidentity.com/archive/pdf/forgeops/7.3/forgeops-7.3.pdf) * [ForgeOps 7.4 PDF](https://cdn-docs.pingidentity.com/archive/pdf/forgeops/7.4/forgeops-7.4.pdf) * Support policy for ForgeOps-provided Ping Advanced Identity Software images The documentation now clarifies support for ForgeOps-provided Ping Advanced Identity Software images. Learn more in the [Support for ForgeOps-provided images](../start/support.html#forgeops-image-support) section. * Replaced card blocks with table blocks in the documentation Documentation pages now use table blocks instead of card blocks to improve readability and make information easier to scan.