Additional setup

This page covers setup tasks that you’ll need to perform before you can develop custom Docker images for the ForgeRock Identity Platform. Complete all of the tasks on this page before proceeding.

Additional third-party software

You should have already installed third-party software when you set up your local environment before installing the CDK. Depending on how you have installed the CDK, you might need to install additional software before you can build custom Docker images for the platform:

macOS systems with the CDK running on a Minikube cluster

Software Version Homebrew package

Software	Version	Homebrew package
Docker Desktop	4.26.1	`docker` (cask)

Docker Desktop

4.26.1

docker (cask)

macOS systems with the CDK running on a shared GKE, EKS, or AKS cluster

Software Version Homebrew package

Software	Version	Homebrew package
Docker Desktop	4.26.1	`docker` (cask)

Docker Desktop

4.26.1

docker (cask)

Linux systems with the CDK running on a shared GKE, EKS, or AKS cluster

Software	Version	Homebrew package
Docker Engine	24.0.7	n/a

Software

Version

Homebrew package

Docker Engine

24.0.7

n/a

Configure your environment to write to your Docker registry

Set up your local environment to write Docker images:

Minikube

Set up your local environment to execute docker commands on Minikube’s Docker engine.

ForgeRock recommends using the built-in Docker engine when developing custom Docker images using Minikube. When you use Minikube’s Docker engine, you don’t have to build Docker images on a local engine and then push the images to a local or cloud-based Docker registry. Instead, you build images using the same Docker engine that Minikube uses. This streamlines development.

To set up your local computer to use Minikube’s Docker engine:

Run the docker-env command in your shell:
```
$ eval $(minikube docker-env)
```

Stop Skaffold from pushing Docker images to a remote Docker registry ^[1]:

$ skaffold config set --kube-context minikube local-cluster true
set value local-cluster to true for context minikube

For more information about using Minikube’s built-in Docker engine, see Use local images by re-using the Docker daemon in the Minikube documentation.

GKE shared cluster

In the environment you’re setting up, Skaffold builds Docker images using the Docker software you’ve installed on your local computer. After it builds the images, Skaffold pushes them to a Docker registry available to your GKE cluster.

For Skaffold to be able to push the Docker images:

Docker must be running on your local computer.
Your local computer needs credentials that let Skaffold push the images to the Docker registry available to your cluster.
Skaffold needs to know the location of the Docker registry.

To set up your local computer to push Docker images:

If it’s not already running, start Docker on your local computer. For more information, see the Docker documentation.
Set up a Docker credential helper:
```
$ gcloud auth configure-docker
```
Run the kubectx command to obtain the Kubernetes context.
Configure Skaffold with the Docker registry location you obtained from your cluster administrator and the Kubernetes context you obtained in Context for the shared cluster:
```
$ skaffold config set default-repo my-docker-registry --kube-context my-kubernetes-context
```

EKS shared cluster

For Skaffold to be able to push the Docker images:

Docker must be running on your local computer.
Your local computer needs credentials that let Skaffold push the images to the Docker registry available to your cluster.
Skaffold needs to know the location of the Docker registry.

To set up your local computer to push Docker images:

If it’s not already running, start Docker on your local computer. For more information, see the Docker documentation.
Log in to Amazon ECR. Use the Docker registry location you obtained from your cluster administrator:
```
$ aws ecr get-login-password | \
 docker login --username AWS --password-stdin my-docker-registry
Login Succeeded
```
ECR login sessions expire after 12 hours. Because of this, you’ll need to perform these steps again whenever your login session expires.^[2]
Run the kubectx command to obtain the Kubernetes context.

Configure Skaffold with the Docker registry location and the Kubernetes context:

$ skaffold config set default-repo my-docker-registry --kube-context my-kubernetes-context

AKS shared cluster

For Skaffold to be able to push the Docker images:

Docker must be running on your local computer.
Your local computer needs credentials that let Skaffold push the images to the Docker registry available to your cluster.
Skaffold needs to know the location of the Docker registry.

To set up your local computer to push Docker images:

If it’s not already running, start Docker on your local computer. For more information, see the Docker documentation.
Install the ACR Docker Credential Helper.
Run the kubectx command to obtain the Kubernetes context.
Configure Skaffold with the Docker registry location you obtained from your cluster administrator and the Kubernetes context you obtained in Context for the shared cluster:
```
$ skaffold config set default-repo my-docker-registry --kube-context my-kubernetes-context
```

Create a configuration profile

A configuration profile contains customizations to ForgeRock’s canonical configuration for the CDK.

To initialize a configuration profile:

Verify that the configuration profile that you want to create does not already exist.

Suppose you want to create a configuration profile named my-profile. See if any of the following directories exist:
- /path/to/forgeops/docker/am/config-profiles/[.var]#my-profilemy-profile
- /path/to/forgeops/docker/idm/config-profiles/my-profile
If any of the directories exist, use a name other than my-profile when you create your configuration profile in the next steps.
Initialize the directories that hold the AM and IDM configuration profile. In this example, the name of the new configuration profile is my-profile:
1. Create a new directory for the AM configuration, initializing it with the canonical cdk configuration for AM:
  $ cd /path/to/forgeops/docker $ cp -R am/config-profiles/cdk am/config-profiles/my-profile
2. Create a new directory for the IDM configuration:
  $ mkdir -p idm/config-profiles/my-profile/conf
  For the IDM configuration, it’s not neccessary to copy any files into the new directory, because the idm Docker image from ForgeRock contains the canonical cdk configuration for IDM.

Initialize deployment environments

Deployment environments let you manage deployment manifests and image defaulters for multiple environments in a single forgeops repository clone.

By default, the forgeops build command updates the image defaulter in the kustomize/deploy directory.

When you specify a deployment environment, the forgeops build command updates the image defaulter in the kustomize/deploy-environment directory. For example, if you ran forgeops build --deploy-env production, the image defaulter in the kustomize/deploy-production/image-defaulter directory would be updated.

Before you can use a new deployment environment, you must initialize a directory based on the /path/to/forgeops/kustomize/deploy directory to support the deployment environment. Perform these steps to initialize a new deployment environment:

$ cd /path/to/forgeops/bin
$ ./forgeops clean
$ cd ../kustomize
$ cp -rp deploy deploy-my-environment

If you need multiple deployment environments, you’ll need to initialize each environment before you can start using it.

Next step

1. If your cluster’s context is not minikube, replace minikube with the actual context name in the skaffold config set command.

2. You can automate logging into ECR every 12 hours by using the cron utility.

ForgeOps

Additional setup

Additional third-party software

Configure your environment to write to your Docker registry

Create a configuration profile

Initialize deployment environments

Next step