ForgeOps

Release notes archive

April 4, 2023

This major release of the forgeops repository supports ForgeRock Identity Platform 7.3. In addition to enabling new features in the platform, this release adds usability and security enhancements.

Highlights

Terraform for CDM cluster creation and deletion

Use Terraform to create clusters in which you can install the CDM. Terraform artifacts are now available in the top-level terraform directory of the new forgeops-extras repository. Install Terraform software before you install the CDM to take advantage of this new capability.

The cluster-up.sh and cluster-down.sh scripts are no longer available. Use Terraform for cluster creation and deletion instead.

You’ll find changes on the following pages in the documentation:

Deployment environments

Deployment environments let you manage deployment manifests and image defaulters for multiple environments in a single forgeops repository clone.

Specify a deployment environment by using the forgeops command’s new --deploy-env option.

By default, the image defaulter and generated Kustomize manifests reside in the kustomize/deploy directory.

Each deployment environment has its own image defaulter, located in the kustomize/deploy-environment/image-defaulter directory.

When you specify a deployment environment, Kustomize manifests are generated in the kustomize/deploy-environment directory. For example, if you ran forgeops generate --deploy-env production, Kustomize manifests would be placed in the kustomize/deploy-production directory.

HAProxy Ingress as the CDM ingress controller

You can now install HAProxy Ingress as the ingress controller for CDM deployments.

NGINX Ingress Controller remains the default ingress for controller for CDK and CDM deployments.

New forgeops command reference

A reference for the forgeops command is now available here.

Changes

CDM deployments now use Kubernetes version 1.25

When you create a cluster for deploying version 7.3 of the platform, use Kubernetes version 1.25.

CDK deployments on Minikube now use the stable Kubernetes version

The cdk-minikube script has been modified to use the stable Kubernetes version instead of version 1.23.3. Refer to the Minikube start command reference for details about which Kubernetes version is currently considered to be the stable version.

CDM deployments should now use NGINX Ingress Controller version 1.4.0 or higher

When you deploy the NGINX Ingress Controller in your CDM cluster, use version 1.4.0[1] or higher.

Additional documented DS limitations in CDK and CDM deployments

Three additional limitations on DS in CDK and CDM deployments are now documented here:

  • Database encryption is not supported

  • DS starts successfully even when it cannot decrypt a backend

  • Root file system write access is required to run the DS Docker image

Please note that these are not new limitations. They had inadvertently been omitted from the DS limitations section in the documentation.

Large CDM deployments now run in a single node pool

Large CDM deployments are now configured to run in a single node pool.

The CDM architecture previously used two node pools: one for the DS pods, and another for all the other pods in the CDM deployment.

Automatic configuration profile creation

The config export am and config export idm commands now have added functionality to create new configuration profiles.

You are no longer required to create and populate subdirectories under the /path/to/forgeops/docker/am/config-profiles and /path/to/forgeops/docker/idm/config-profiles directories the first time you export configuration from the CDK to a new configuration profile in your forgeops repository clone.

Availability and usage of KUBECONFIG environment variables

The tf-apply script creates a kubeconfig file when it creates a cluster. The documentation has been modified to support changing the Kubernetes context using KUBECONFIG environment variables instead of assuming you use the default kubeconfig file, $HOME/.kube/config.

CDM deployment no longer defaults to the prod namespace

You can now use any namespace you want for CDM deployment.

Previously, cluster creation scripts created the prod namespace, and some scripts defaulted to using this namespace for CDM deployment.

Skaffold is no longer used to build Docker images

The forgeops build command now uses Docker rather than Skaffold to build and push Docker images.

Because of this, you no longer need to install Skaffold software when deploying the CDM or the CDK.

New --push-to option replaces the forgeops build command’s --default-repo option

The forgeops build command’s --push-to option replaces the --default-repo option.

When running the forgeops build command on Minikube, you must now specify --push-to none with the forgeops build command to push a Docker image to the Docker registry embedded in the Minikube cluster. Previously, it was not necessary to specify the --default-repo option when running the forgeops build command on Minikube.

The forgeops delete command issues new confirmation prompts and has a new option

The forgeops delete command now issues multiple confirmation prompts, letting you choose to delete all PVCs, volume snapshots, and/or secrets from a CDK or CDM deployment.

Previously, you could only choose to delete all three deployment artifacts, or none of them.

The forgeops delete command’s new --force --yes option lets you suppress all confirmation prompts.

eksctl is no longer used to create EKS clusters

The tf-apply command uses Terraform rather than eksctl to create EKS clusters.

Because of this, you no longer need to install eksctl software when deploying the CDM.

AM evaluation-only Docker image repository name change

The name of the AM evaluation-only Docker image repository has been changed to gcr.io/forgerock-io/am-cdk. This image repository was formerly named gcr.io/forgerock-io/am-base.

The AM canonical configuration is now built into the am-cdk Docker image

The AM canonical configuration for the CDK has been incorporated into the am-cdk Docker image.

Because of this, you no longer need to copy files from the docker/am/config-profiles/cdk directory when you initialize a new configuration profile. Simply create a new subdirectory under the docker/am/config-profiles directory.

Deprecated

ForgeOps artifacts for deploying ForgeRock Identity Platform 7.2

The ForgeOps artifacts for deploying ForgeRock Identity Platform 7.2 are deprecated. You should migrate to version 7.3 as soon as you’re able to.

Removed

The cluster-up and cluster-down scripts

The cluster-up and cluster-down scripts are no longer available. Use Terraform for cluster creation and deletion instead.

The forgeops build command’s --default-repo option

The forgeops build command’s --default-repo option is no longer available. It’s been replaced by the new --push-to option.

The cicd directory

The cicd directory has been removed from the forgeops repository.

Documentation updates

New deployment step: back up the secrets that contain the DS master and TLS keys

A new step to back up the Kubernetes secrets that contain the DS master and TLS keys has been added to the instructions for deploying the CDM.

It is extremely important to back up these secrets and retain them in a secure location. Loss of these secrets could result in the inability to restore data from backups.

Secret generation documentation corrected

The Secret Agent operator page previously stated that the Secret Agent operator generates all secrets required for a ForgeRock Identity Platform deployment.

This page has been corrected to state that the Secret Agent operator generates all secrets required for a ForgeRock Identity Platform deployment except for the DS master and TLS keys. In version 7.4, the DS operator calls the certificate manager to generate these two keys.

Secret management recommendations changed

The recommendation that you always configure cloud secret management has been relaxed. ForgeRock now recommends that you configure cloud secret management only when you have multiple deployments that need to use the same secrets.

Base Docker images page updated

The Base Docker images page has been significantly updated. A new section, Create Docker images for use in production, explains how to build customized Docker images for the ForgeRock Identity Platform that:

May 12, 2021

This major new release of the forgeops repository supports ForgeRock Identity Platform 7.1. In addition to enabling new features in the platform, this release adds usability and security enhancements.

July 16, 2020

Release tag: 2020.07.15-alleVongole

This release provides performance improvements and small bug fixes.

Click here for the detailed change log.

June 25, 2020

Release tag: 2020.06.24-laPaniscia

This release provides performance improvements and small bug fixes.

Click here for the detailed change log.

May 18, 2020

Release tag: 2020.05.13-AlPomodoro.1

This release changes the recommended method for obtaining the forgeops repository. We now recommend that users clone the repository, and then create a branch based on the current release tag. For more information, see About the forgeops repository .

The release also provides performance improvements and small bug fixes.

Click here for the detailed change log.

February 21, 2020

This release is a major new revision of the forgeops repository, and provides a completely new approach to ForgeRock DevOps. This release changes the way that AM, IDM, and IG configuration is stored and managed. Instead of relying on the external forgeops-init repository, configuration is now stored inside the Docker images for AM, IDM, and IG. Instead of using Helm charts, the forgeops repository now includes Kustomize and Skaffold example artifacts for deploying the CDK and CDM on Kubernetes.

The model for CDM cluster creation has also changed. Instead of bash scripts, the forgeops repository now provides Pulumi scripts to create GKE, EKS, and AKS clusters in which the CDM is installed.

Deprecated


1. NGINX Ingress Controller Helm chart version 4.3.0 installs NGINX Ingress Controller version 1.4.0.