CDK architecture

You deploy the CDK to get the ForgeRock Identity Platform up and running on Kubernetes. CDK deployments are useful for demonstrations and proofs of concept. They’re also intended for development—building custom Docker images for the platform.

Do not use the CDK as the basis for a production deployment of the ForgeRock Identity Platform.

Before you can deploy the CDK, you must have:

Access to a Kubernetes cluster with the NGINX ingress controller deployed on it.
Access to a namespace in the cluster.
Third-party software installed in your local environment, as described in the Setup section that pertains to your cluster type.

This diagram shows the CDK components:

The forgeops install command deploys the CDK in a Kubernetes cluster:

Installs Docker images for the platform specified in the image defaulter. Initially, the image defaulter specifies the evaluation-only Docker images of the platform, available from ForgeRock’s public registry. These images use ForgeRock’s canonical configurations for AM and IDM.
Installs additional software as needed^[1]:
- Secret Agent operator. Generates Kubernetes secrets for ForgeRock Identity Platform deployments. More information here.
- DS operator. Deploys and manages DS instances running in a Kubernetes cluster. More information here.
- cert-manager software. Provides certificate management services for the cluster. More information here.

After you’ve deployed the CDK, you can access AM and IDM UIs and REST APIs to customize the ForgeRock Identity Platform’s configuration. You can then create Docker images that contain your customized configuration by using the forgeops build command. This command:

Builds Kubernetes manifests based on the Kustomize bases and overlays in your local forgeops repository clone.
Updates the image defaulter file to specify the customized images, so that the next time you deploy the CDK, your customized images will be used.

See am image and idm image for detailed information about building customized AM and IDM Docker images.

CDK pods

After deploying the CDK, you’ll see the following pods running in your namespace:

am

Runs ForgeRock Access Management.

When AM starts in a CDK deployment, it obtains its configuration from the AM Docker image specified in the image defaulter.

After the am pod has started, a job is triggered that populates AM’s application store with several agents and OAuth 2.0 client definitions that are used by the CDK.

ds-idrepo-0

The ds-idrepo-0 pod provides directory services for:

The identity repository shared by AM and IDM
The IDM repository
The AM application and policy store
AM’s Core Token Service

idm

Runs ForgeRock Identity Management.

When IDM starts in a CDK deployment, it obtains its configuration from the IDM Docker image specified in the image defaulter.

In containerized deployments, IDM must retrieve its configuration from the file system and not from the IDM repository. The default values for the openidm.fileinstall.enabled and openidm.config.repo.enabled properties in the CDK’s system.properties file ensure that IDM retrieves its configuration from the file system. Do not override the default values for these properties.

UI pods

Several pods provide access to ForgeRock common user interfaces:

admin-ui
end-user-ui
login-ui

Next step

1. If any of these software components are already installed in your cluster, they are not reinstalled.

ForgeOps

CDK architecture

CDK pods

Next step