--- title: Release notes archive description: This major release of the forgeops repository supports Ping Identity Platform 7.3. In addition to enabling new features in the platform, this release adds usability and security enhancements. component: forgeops version: 7.4 page_id: forgeops::rn/archive/rn canonical_url: https://docs.pingidentity.com/forgeops/7.4/rn/archive/rn.html section_ids: april_4_2023: April 4, 2023 highlights: Highlights changes: Changes deprecated: Deprecated removed: Removed documentation_updates: Documentation updates june_30_2022: June 30, 2022 highlights_2: Highlights changes_2: Changes deprecated_2: Deprecated removed_2: Removed july_12_2021: July 12, 2021 highlights_3: Highlights changes_3: Changes deprecated_3: Deprecated removed_3: Removed may_12_2021: May 12, 2021 highlights_4: Highlights changes_4: Changes deprecated_4: Deprecated august_10_2020: August 10, 2020 highlights_5: Highlights changes_5: Changes deprecated_5: Deprecated removed_4: Removed documentation_updates_2: Documentation updates july_16_2020: July 16, 2020 june_25_2020: June 25, 2020 may_18_2020: May 18, 2020 highlights_6: Highlights february_21_2020: February 21, 2020 highlights_7: Highlights changes_6: Changes deprecated_6: Deprecated removed_5: Removed --- # Release notes archive ## April 4, 2023 This major release of the `forgeops` repository supports Ping Identity Platform 7.3. In addition to enabling new features in the platform, this release adds usability and security enhancements. ### Highlights * Terraform for CDM cluster creation and deletion Use Terraform to create clusters in which you can install the CDM. Terraform artifacts are now available in the top-level terraform directory of the new `forgeops-extras` repository. Install Terraform software before you install the CDM to take advantage of this new capability. The cluster-up.sh and cluster-down.sh scripts are no longer available. Use Terraform for cluster creation and deletion instead. You'll find changes on the following pages in the documentation: * [Terraform directory in the `forgeops-extras` repository](https://docs.pingidentity.com/forgeops/7.4/forgeops-extras.html#terraform) * [Google Cloud project setup](https://docs.pingidentity.com/forgeops/7.4/cdm/gke/setup/project.html) * [GKE cluster creation](https://docs.pingidentity.com/forgeops/7.4/cdm/gke/setup/cluster.html) * [Setup for AWS](https://docs.pingidentity.com/forgeops/7.4/cdm/eks/setup/aws-env.html) * [EKS cluster creation](https://docs.pingidentity.com/forgeops/7.4/cdm/eks/setup/cluster.html) * [Azure subscription setup](https://docs.pingidentity.com/forgeops/7.4/cdm/aks/setup/subscription.html) * [AKS cluster creation](https://docs.pingidentity.com/forgeops/7.4/cdm/aks/setup/cluster.html) * [CDM deployment](https://docs.pingidentity.com/forgeops/7.4/cdm/deploy.html) * [CDM removal](https://docs.pingidentity.com/forgeops/7.4/cdm/remove.html) * [Ingress how-to](https://docs.pingidentity.com/forgeops/7.4/how-to/ingress.html) * Deployment environments Deployment environments let you manage deployment manifests and image defaulters for multiple environments in a single `forgeops` repository clone. Specify a deployment environment by using the forgeops command's new `--deploy-env` option. By default, the image defaulter and generated Kustomize manifests reside in the kustomize/deploy directory. Each deployment environment has its own image defaulter, located in the kustomize/deploy-environment/image-defaulter directory. When you specify a deployment environment, Kustomize manifests are generated in the kustomize/deploy-environment directory. For example, if you ran forgeops generate --deploy-env production, Kustomize manifests would be placed in the kustomize/deploy-production directory. * HAProxy Ingress as the CDM ingress controller You can now [install HAProxy Ingress as the ingress controller](https://docs.pingidentity.com/forgeops/7.4/how-to/ingress.html#haproxy) for CDM deployments. Ingress-NGINX Controller remains the default ingress for controller for CDK and CDM deployments. * New forgeops command reference A reference for the forgeops command is now available [here](https://docs.pingidentity.com/forgeops/7.4/tools/forgeops.html). ### Changes * CDM deployments now use Kubernetes version 1.25 When you create a cluster for deploying version 7.3 of the platform, use Kubernetes version 1.25. * CDK deployments on Minikube now use the stable Kubernetes version The cdk-minikube script has been modified to use the stable Kubernetes version instead of version 1.23.3. Refer to the [Minikube start command reference](https://minikube.sigs.k8s.io/docs/commands/start) for details about which Kubernetes version is currently considered to be the stable version. * CDM deployments should now use Ingress-NGINX Controller version 1.4.0 or higher When you deploy the [NGINX Ingress Controller](https://kubernetes.github.io/ingress-nginx) in your CDM cluster, use version 1.4.0\[[1](#_footnotedef_1 "View footnote.")] or higher. * Additional documented DS limitations in CDK and CDM deployments Three additional limitations on DS in CDK and CDM deployments are now documented [here](https://docs.pingidentity.com/forgeops/7.4/rn/limitations.html#ds-limitations): * Database encryption is not supported * DS starts successfully even when it cannot decrypt a backend * Root file system write access is required to run the DS Docker image Please note that these are not new limitations. They had inadvertently been omitted from the [DS limitations](https://docs.pingidentity.com/forgeops/7.4/rn/limitations.html#ds-limitations) section in the documentation. * Large CDM deployments now run in a single node pool Large CDM deployments are now configured to run in a single node pool. The CDM architecture previously used two node pools: one for the DS pods, and another for all the other pods in the CDM deployment. * Automatic configuration profile creation The config export am and config export idm commands now have added functionality to create new configuration profiles. You are no longer required to create and populate subdirectories under the /path/to/forgeops/docker/am/config-profiles and /path/to/forgeops/docker/idm/config-profiles directories the first time you export configuration from the CDK to a new configuration profile in your `forgeops` repository clone. * Availability and usage of `KUBECONFIG` environment variables The tf-apply script creates a kubeconfig file when it creates a cluster. The documentation has been modified to support changing the Kubernetes context using `KUBECONFIG` environment variables instead of assuming you use the default kubeconfig file, $HOME/.kube/config. * CDM deployment no longer defaults to the `prod` namespace You can now use any namespace you want for CDM deployment. Previously, cluster creation scripts created the `prod` namespace, and some scripts defaulted to using this namespace for CDM deployment. * Skaffold is no longer used to build Docker images The forgeops build command now uses Docker rather than Skaffold to build and push Docker images. Because of this, you no longer need to install Skaffold software when deploying the CDM or the CDK. * New --push-to option replaces the forgeops build command's --default-repo option The forgeops build command's --push-to option replaces the --default-repo option. When running the forgeops build command on Minikube, you must now specify --push-to none with the forgeops build command to push a Docker image to the Docker registry embedded in the Minikube cluster. Previously, it was not necessary to specify the --default-repo option when running the forgeops build command on Minikube. * The forgeops delete command issues new confirmation prompts and has a new option The forgeops delete command now issues multiple confirmation prompts, letting you choose to delete all PVCs, volume snapshots, and/or secrets from a CDK or CDM deployment. Previously, you could only choose to delete all three deployment artifacts, or none of them. The forgeops delete command's new --force --yes option lets you suppress all confirmation prompts. * eksctl is no longer used to create EKS clusters The tf-apply command uses Terraform rather than eksctl to create EKS clusters. Because of this, you no longer need to install eksctl software when deploying the CDM. * AM evaluation-only Docker image repository name change The name of the AM evaluation-only Docker image repository has been changed to `gcr.io/forgerock-io/am-cdk`. This image repository was formerly named `gcr.io/forgerock-io/am-base`. * The AM canonical configuration is now built into the `am-cdk` Docker image The AM canonical configuration for the CDK has been incorporated into the `am-cdk` Docker image. Because of this, you no longer need to copy files from the docker/am/config-profiles/cdk directory when you initialize a new configuration profile. Simply create a new subdirectory under the docker/am/config-profiles directory. ### Deprecated * ForgeOps artifacts for deploying Ping Identity Platform 7.2 The ForgeOps artifacts for deploying Ping Identity Platform 7.2 are deprecated. You should migrate to version 7.3 as soon as you're able to. ### Removed * The cluster-up and cluster-down scripts The cluster-up and cluster-down scripts are no longer available. Use Terraform for cluster creation and deletion instead. * The forgeops build command's --default-repo option The forgeops build command's --default-repo option is no longer available. It's been replaced by the new --push-to option. * The cicd directory The cicd directory has been removed from the `forgeops` repository. ### Documentation updates * New deployment step: back up the secrets that contain the DS master and TLS keys A [new step](https://docs.pingidentity.com/forgeops/7.4/cdm/deploy.html#back-up-ds-secrets) to back up the Kubernetes secrets that contain the DS master and TLS keys has been added to the instructions for deploying the CDM. It is extremely important to back up these secrets and retain them in a secure location. Loss of these secrets could result in the inability to restore data from backups. * Secret generation documentation corrected The [Secret Agent operator](https://docs.pingidentity.com/forgeops/7.4/how-to/security/secret-agent.html) page previously stated that the Secret Agent operator generates all secrets required for a Ping Identity Platform deployment. This page has been corrected to state that the Secret Agent operator generates all secrets required for a Ping Identity Platform deployment except for the DS master and TLS keys. In version 7.4, the DS operator calls the certificate manager to generate these two keys. * Secret management recommendations changed The recommendation that you always configure [cloud secret management](https://docs.pingidentity.com/forgeops/7.4/how-to/security/secret-agent.html#cloud-secret-management) has been relaxed. ForgeRock now recommends that you configure cloud secret management only when you have multiple deployments that need to use the same secrets. * Base Docker images page updated The [Base Docker images](https://docs.pingidentity.com/forgeops/7.4/how-to/base-docker-images.html) page has been significantly updated. A new section, [Create Docker images for use in production](https://docs.pingidentity.com/forgeops/7.4/how-to/base-docker-images.html#create_docker_images_for_use_in_production), explains how to build customized Docker images for the Ping Identity Platform that: * Contain customized [configuration profiles](https://docs.pingidentity.com/forgeops/7.4/cdk/develop/fr-data.html#configuration-profiles) for AM, IDM, and, optionally, PingGateway. * Must be based on [your own base Docker images](https://docs.pingidentity.com/forgeops/7.4/how-to/base-docker-images.html#base-images). * Must *not* be based on ForgeRock's evaluation-only Docker images. ## June 30, 2022 This major new release of the `forgeops` repository supports Ping Identity Platform 7.2. In addition to enabling new features in the platform, this release adds usability and security enhancements. ### Highlights [New forgeops command](highlights.html#r2022-06-30-forgeops-command) [DS operator released from technology preview status](highlights.html#r2022-06-30-ds-operator) [New CDM deployment technology](highlights.html#r2022-06-30-new-cdm) [Multicluster deployment sample](highlights.html#r2022-06-30-multicluster-sample) [Configuration profiles moved to `docker` directory](highlights.html#r2022-06-30-config-profiles-moved) [New CDM backup techniques](highlights.html#r2022-06-30-new-backup-techniques) ### Changes [The IDM canonical configuration is now built into the `idm-cdk` Docker image](changes.html#r2022-06-30-canonical-config-in-docker-images) [New bin/ds-debug.sh script](changes.html#r2022-06-30-ds-debug) [The RCS Agent has been removed from the CDM and CDK deployments](changes.html#r2022-06-30-rcs-removed) [The LDIF importer is no longer used](changes.html#r2022-06-30-ldif-importer-not-used) [CDM deployments create a third `ds-idrepo` replica](changes.html#r2022-06-30-ds-idrepo-2) [Number of AM pods in small CDM clusters changed to 2](changes.html#r2022-06-30-small-am-pods) [Changes to the steps for installing a CA certificate in a CDK deployment](changes.html#r2022-06-30-ca-cert) [Limitation on IDM workflow support in the CDK and CDM](changes.html#r2022-06-30-workflow) [Use the new cluster/minikube/cdk-minikube utility to create a Minikube cluster](changes.html#r2022-06-30-cdk-minikube) [New recommendation: use the Hyperkit and Docker drivers for Minikube clusters](changes.html#r2022-06-30-hyperkit-docker-drivers) [CDK deployments on Minikube require the volume snapshots plugin](changes.html#r2022-06-30-minikube-volumesnapshots-plugin) ### Deprecated [DevOps artifacts for deploying Ping Identity Platform 7.1](deprecated.html#r2022-06-30-7.1-artifacts) [Previous CDM technology](deprecated.html#r2022-06-30-legacy-cdm) [CDM cluster creation and deletion scripts](deprecated.html#r2022-06-30-cluster-creation-deletion) [The schedule-backups.sh script](deprecated.html#r2022-06-30-schedule-backup.sh) [Dynamic AM configuration in the `amster` Docker image](deprecated.html#r2022-06-30-amster-image) ### Removed [IDM canonical configuration in the docker/idm/config-profiles/cdk directory](removed.html#r2022-06-30-canonical-config) [Installing the CDK using the skaffold run command](removed.html#r2022-06-30-legacy-cdk) [The cdk command](removed.html#r2022-06-30-cdk-command) [The print-secrets command](removed.html#r2022-06-30-print-secrets) ## July 12, 2021 ### Highlights [New CDK technology released from technology preview status](highlights.html#r2021-07-12-new-cdk-released) [DS operator supported for use with the CDK](highlights.html#r2021-07-12-ds-operator-cdk) ### Changes [New amster command](changes.html#r2021-07-12-amster-script) [Statement on `forgeops` repository feature evolution](changes.html#r2021-07-12-feature-evolution) ### Deprecated [Previous CDK technology](deprecated.html#r2021-07-12-legacy-cdk) ### Removed [Cloud Deployment Quickstart (CDQ)](removed.html#r2021-07-12-cdq) ## May 12, 2021 This major new release of the `forgeops` repository supports Ping Identity Platform 7.1. In addition to enabling new features in the platform, this release adds usability and security enhancements. ### Highlights [New CDK technology preview](highlights.html#r2021-05-12-new-cdk) [DS operator technology preview](highlights.html#r2021-03-08-ds-operator) [New RCS Agent pod in the CDM](highlights.html#r2021-03-08-rcs-agent) [Cloud Deployment Quickstart (CDQ)](highlights.html#r2021-03-08-quickstart) [New Secret Agent operator](highlights.html#r2020-10-28-secret-agent) [New cluster provisioning scripts](highlights.html#r2020-10-28-cluster-provisioning) [Small, medium, and large CDM cluster sizing](highlights.html#r2020-10-28-sml) ### Changes [Release branch](changes.html#r2021-05-12-release-branch) [Several Docker images from ForgeRock are supported in production deployments](changes.html#r2021-05-12-ui-docker-images) [Third-Party Kubernetes support changes](changes.html#r2021-05-12-statement-of-support-changes) [Secure LDAP](changes.html#r2021-05-12-ldaps) [IDM is now a Kubernetes deployment](changes.html#r2021-05-12-idm-deployment) [Python 3 is now on the list of required third-party software](changes.html#r2021-05-12-python3) [Python scripts](changes.html#r2021-05-12-python-scripts) [Secrets are not created automatically when you install the platform on the CDM](changes.html#r2021-05-12-separate-secret-creation) [Volume snapshots technology preview](changes.html#r2021-05-12-snapshots-preview) [Configuration expressions in the AM configuration are preserved when the configuration is exported](changes.html#r2021-03-08-config-upgrader) [CDK and CDM deployment verified on newer Kubernetes versions](changes.html#r2021-03-08-k8s-version) [The Secret Agent operator lets you change individual administration passwords](changes.html#r2021-03-08-pwd-changes) [CDM deployments no longer create a third `ds-idrepo` replica](changes.html#r2021-03-08-no-ds-idrepo-2) [CDM backups are now taken from the `-0` DS instances by default](changes.html#r2021-03-08-backup-on-0) [Regions for CDM cluster creation no longer default](changes.html#r2021-03-08-no-default-regions) [Long form command-line options for the `ingress-controller-deploy.sh` command](changes.html#r2021-03-08-ingress-controller-deploy-longtails) [How to eliminate the need to accept a self-signed certificate on Minikube deployments](changes.html#r2021-03-08-mkcert) [All main AM run-time data types supported when exporting configuration data](changes.html#r2020-10-28-rt-data-types) [Performance benchmark changes](changes.html#r2020-10-28-benchmarks) [Small and medium clusters now use a single node pool](changes.html#r2020-10-28-node-pools) [Task maps and checklists in the documentation](changes.html#r2020-10-28-task-lists) [Minikube `cni=true` option](changes.html#r2020-10-28-minikube-cni) ### Deprecated [DevOps artifacts for deploying Ping Identity Platform 7.0](deprecated.html#r2021-05-12-7.0-artifacts) [`forgeops-secret` job](deprecated.html#r2020-10-28-forgeops-secret) [Cluster provisioning using Pulumi](deprecated.html#r2020-10-28-pulumi) ## August 10, 2020 [Release tag](../../forgeops.html#forgeops-updates): `2020.08.07-ZucchiniRicotta.1` This major new release of the `forgeops` repository supports Ping Identity Platform 7. In addition to enabling new features in the platform, this release adds usability and security enhancements. Click [here](https://github.com/ForgeRock/forgeops/releases/tag/2020.08.07-ZucchiniRicotta.1) for the detailed change log. ### Highlights * [Docker- and Kubernetes-ready DS](highlights.html#r2020-08-10-ds-in-cloud) * [DS backup to cloud storage](highlights.html#r2020-08-10-ds-cloud-backup) * [AM and IDM integration](highlights.html#r2020-08-10-am-idm-integration) * [DS as IDM's repository](highlights.html#r2020-08-10-ds-as-idm-repo) * [AM file-based configuration](highlights.html#r2020-08-10-am-fbc) * [Revised DevOps documentation](highlights.html#r2020-08-10-docs) ### Changes * [CDM on newer Kubernetes versions](changes.html#r2020-08-10-new-k8s-versions) * [New print-secrets.sh script](changes.html#r2020-08-10-print-secrets) * [New UI pods](changes.html#r2020-08-10-ui-pods) * [No need to explicitly scale AM in the CDM](changes.html#r2020-08-10-no-need-to-scale) * [Different directory superuser DN and backend database](changes.html#r2020-08-10-ds-superuser) * [Increased virtual hardware requirements for running the CDK on Minikube](changes.html#r2020-08-10-minikube-reqs) * [New technique for building base Docker images](changes.html#r2020-08-10-base-images) * [New technique for IDM REST API access](changes.html#r2020-08-10-idm-rest-api) ### Deprecated * [DevOps artifacts for deploying Ping Identity Platform 6.5](deprecated.html#r2020-08-10-6.5-artifacts) ### Removed * [AM, Amster, IDM, DS, and PingGateway Dockerfiles](removed.html#r2020-08-10-dockerfiles) * [Helm charts](removed.html#r2020-08-10-helm) * [`amster` pod](removed.html#r2020-08-10-amster-pod) * [PostgreSQL pod](removed.html#r2020-08-10-postgresql-pod) * [`web` pod](removed.html#r2020-08-10-web-pod) ### Documentation updates * [Miscellaneous documentation fixes (September 3, 2020)](doc-updates.html#r2020-09-03-rn-misc-fixes) * [New release note: DevOps artifacts for version 6.5 are deprecated (August 18, 2020)](doc-updates.html#r2020-08-18-rn-6.5-deprecated) * [Workaround for OPENAM-16656 and OPENAM-16658 (August 17, 2020)](doc-updates.html#r2020-08-17-OPENAM-16656) ## July 16, 2020 [Release tag](../../forgeops.html#forgeops-updates): `2020.07.15-alleVongole` This release provides performance improvements and small bug fixes. Click [here](https://github.com/ForgeRock/forgeops/releases/tag/2020.07.15-alleVongole) for the detailed change log. ## June 25, 2020 [Release tag](../../forgeops.html#forgeops-updates): `2020.06.24-laPaniscia` This release provides performance improvements and small bug fixes. Click [here](https://github.com/ForgeRock/forgeops/releases/tag/2020.06.24-laPaniscia) for the detailed change log. ## May 18, 2020 [Release tag](../../forgeops.html#forgeops-updates): `2020.05.13-AlPomodoro.1` This release changes the recommended method for obtaining the `forgeops` repository. We now recommend that users clone the repository, and then create a branch based on the current release tag. For more information, see [About the `forgeops` repository ](../../forgeops.html). The release also provides performance improvements and small bug fixes. Click [here](https://github.com/ForgeRock/forgeops/releases/tag/2020.05.13-AlPomodoro.1) for the detailed change log. ### Highlights * [`forgeops` repository release tags](highlights.html#r2020-2020-05-18-release-tags) ## February 21, 2020 This release is a major new revision of the `forgeops` repository, and provides a completely new approach to ForgeRock DevOps. This release changes the way that AM, IDM, and PingGateway configuration is stored and managed. Instead of relying on the external `forgeops-init` repository, configuration is now stored inside the Docker images for AM, IDM, and PingGateway. Instead of using Helm charts, the `forgeops` repository now includes Kustomize and Skaffold example artifacts for deploying the CDK and CDM on Kubernetes. The model for CDM cluster creation has also changed. Instead of bash scripts, the `forgeops` repository now provides Pulumi scripts to create GKE, EKS, and AKS clusters in which the CDM is installed. ### Highlights * [Docker images include the AM, IDM, and IG configuration](highlights.html#r2020-02-20-docker-images) * [Skaffold framework support](highlights.html#r2020-02-20-skaffold) * [Kustomize framework support](highlights.html#r2020-02-20-kustomize) * [The ForgeRock Cloud Developer's Kit](highlights.html#r2020-02-20-cdk) * [Identical configurations for the CDK and the CDM](highlights.html#r2020-02-20-cdk-cdm-same-config) * [Pulumi scripts for CDM cluster creation](highlights.html#r2020-02-20-pulumi) * [Secrets generator](highlights.html#r2020-02-20-forgeops-secrets) * [Completely revised AKS Cookbook](highlights.html#r2020-02-20-aks-cookbook) ### Changes * [Deployment with Skaffold and Kustomize instead of Helm](changes.html#r2020-02-20-skaffold-kustomize) * [Changes to CDM zones and node pools](changes.html#r2020-02-20-3az2np) * [New scripts for installing third-party components](changes.html#r2020-02-20-add-on-scripts) * [Helm tiller pod no longer required](changes.html#r2020-02-20-tiller) * [Revised benchmarking technique](changes.html#r2020-02-20-revised-benchmarking) * [Revised backup technique](changes.html#r2020-02-20-revised-backup) * [Modified DS topology in the CDM](changes.html#r2020-02-20-ds-topology) * [PingGateway not deployed by default](changes.html#r2020-02-20-ig-not-default) * [CDM sizing and benchmarks](changes.html#r2020-02-20-cdm-sizing-benchmarks) * [Randomly generated administrator passwords](changes.html#r2020-02-20-admin-passwords) * [New Docker image and pod names](changes.html#r2020-02-20-new-names) * [New method for building base Docker images](changes.html#r2020-02-20-build-images) * [AM WAR file customization script removed](changes.html#r2020-02-20-customize-am) * [New backup-loader.sh script](changes.html#r2020-02-20-backup-loader) * [Different default URLs](changes.html#r2020-02-20-default-urls) * [Support for newer versions of CDM third-party software](changes.html#r2020-02-20-3party) * [Certificate Manager no longer required for the CDK on Minikube](changes.html#r2020-02-20-minikube-cdk-self-signed) * [Self-signed certificates for GKE CDM deployments](changes.html#r2020-02-20-cdm-self-signed) * [*DevOps Developer's Guide* replaced](changes.html#r2020-02-20-2-devops-guides) * [*Before You Deploy* section moved](changes.html#r2020-02-20-no-before-you-deploy) * [*DevOps QuickStart Guide* removed](changes.html#r2020-02-20-no-quickstart) * [CDM and CDK installation requires Linux or macOS](changes.html#r2020-02-20-linux-mac) ### Deprecated * [Helm charts](deprecated.html#r2020-02-20-helm) ### Removed * [`forgeops-init` repository](removed.html#r2020-02-20-forgeops-init) * [bash scripts for CDM cluster creation](removed.html#r2020-02-20-cdm-bash-scripts) * [Downloader utility](removed.html#r2020-02-20-downloader) * [AM WAR file customization script](removed.html#r2020-02-20-customize-am) *** [1](#_footnoteref_1). Ingress-NGINX Controller Helm chart version 4.3.0 installs NGINX Ingress Controller version 1.4.0.