ForgeOps 7.2 release notes

Get an email when there’s an update to ForgeOps 7.2. Go to the Notifications page in your Backstage profile and select ForgeOps 7.2 Changes in the Documentation Digests section.

Or subscribe to the ForgeOps 7.2 RSS feed.

Important information for this ForgeOps release:

Validated Kubernetes versions for deploying ForgeRock Identity Platform 7.2

Link

Validated NGINX ingress versions for deploying ForgeRock Identity Platform 7.2

Link

Limitations when deploying ForgeRock Identity Platform 7.2 on Kubernetes

Link

More information about the rapidly evolving nature of the forgeops repository, including technology previews, legacy features, and feature deprecation and removal

Link

Archive of release notes prior to June 30, 2022

Link

2023

August 10, 2023

Documentation updates

New how-to: Upgrade the platform to a newer patch release: A new how-to provides steps for upgrading to newer patch releases of version 7.2.

August 3, 2023

Changes

Running the CDK on Minikube on macOS systems with ARM-based chipsets is now available on an experimental basis: Running the CDK on Minikube on macOS systems with ARM-based chipsets, such as the Apple M1 or M2, is now available on an experimental basis.

Refer to this ForgeRock Community article for details.

July 6, 2023

Documentation updates

New how-to: Upgrade the platform from version 7.1 to 7.2: A new how-to provides steps for upgrading a version 7.1 CDM to version 7.2.

June 28, 2023

Documentation updates

Updates to the Base Docker images page: New steps describe how to build Docker images for Java, and how to base your own base Docker images on those Java images.

June 1, 2023

Highlights

New convention for forgeops repository branch names

forgeops repository branch names now consist of the major and minor release numbers of ForgeRock Identity Platform components, followed by the release date.

Updates to the forgeops repository for ForgeRock Identity Platform version 7.2

Updates for ForgeRock Identity Platform version 7.2 are available in the release/7.2-20230406 branch of the forgeops repository.

The release/7.2-20230406 branch replaces the release/7.2.0 branch. Upgrade to the new branch as soon as possible.

New evaluation-only Docker images are now available from ForgeRock

New evaluation-only Docker images are now available for the following versions of ForgeRock Identity Platform components:

ForgeRock Access Management: 7.2.1
ForgeRock Directory Services: 7.2.1
ForgeRock Identity Management: 7.2.1

The ForgeRock Identity Gateway Docker image remains at version 7.2.0.

This documentation has been updated to refer to these new versions of Docker images.

For more information about changes to the ForgeRock Identity Platform, refer to the Release Notes for platform components at https://backstage.forgerock.com/docs.

To upgrade to the new versions, you’ll need to rebuild your custom Docker images. Refer to Base Docker Images for instructions.

April 25, 2023

Highlights

New forgeops command reference: A reference for the forgeops command is now available here.

March 31, 2023

Highlights

Deployment environments: Deployment environments let you manage deployment manifests and image defaulters for multiple environments in a single forgeops repository clone.

Specify a deployment environment by using the forgeops command’s new --deploy-env option.

By default, the image defaulter and generated Kustomize manifests reside in the kustomize/deploy directory.

Each deployment environment has its own image defaulter, located in the kustomize/deploy-environment/image-defaulter directory.

When you specify a deployment environment, Kustomize manifests are generated in the kustomize/deploy-environment directory. For example, if you ran forgeops generate --deploy-env production, Kustomize manifests would be placed in the kustomize/deploy-production directory.

March 3, 2023

Changes

Additional documented DS limitations in CDK and CDM deployments

Three additional limitations on DS in CDK and CDM deployments are now documented here:

Database encryption is not supported
DS starts successfully even when it cannot decrypt a backend
Root file system write access is required to run the DS Docker image

Please note that these are not new limitations. They had inadvertently been omitted from the DS limitations section in the documentation.

December 8, 2022

Changes

CDM deployments on EKS should now use Kubernetes version 1.22: When you create an EKS cluster for deploying version 7.2 of the platform, use Kubernetes version 1.22.
CDM deployments should now use NGINX Ingress Controller version 1.4.0 or higher: When you deploy the NGINX Ingress Controller in your CDM cluster, use version 1.4.0^[1] or higher.

August 17, 2022

Changes

The bin/config export command now handles object deletion correctly: Deletion of configuration objects, such as AM authentication trees and service definitions, is now handled correctly by the bin/config export command.

In previous versions, AM object deletion was not implemented in the bin/config export command. If you deleted objects from the CDK’s AM configuration, and then exported the configuration, the deleted objects remained in your configuration profile in many instances.

August 15, 2022

Documentation

New deployment step: back up the secrets that contain the DS master and TLS keys: A new step to back up the Kubernetes secrets that contain the DS master and TLS keys has been added to the instructions for deploying the CDM.

It is extremely important to back up these secrets and retain them in a secure location. Loss of these secrets could result in the inability to restore data from backups.
Secret generation documentation corrected: The Secret Agent operator page previously stated that the Secret Agent operator generates all secrets required for a ForgeRock Identity Platform deployment.

This page has been corrected to state that the Secret Agent operator generates all secrets required for a ForgeRock Identity Platform deployment except for the DS master and TLS keys. In version 7.2, the DS operator calls the certificate manager to generate these two keys.
Secret management recommendations changed: The recommendation that you always configure cloud secret management has been relaxed. ForgeRock now recommends that you configure cloud secret management only when you have multiple deployments that need to use the same secrets.

July 26, 2022

Documentation

Base Docker images page updated

The Base Docker images page has been significantly updated. A new section, Create Docker images for use in production, explains how to build customized Docker images for the ForgeRock Identity Platform that:

Contain customized configuration profiles for AM, IDM, and, optionally, IG.
Must be based on your own base Docker images.
Must not be based on ForgeRock’s evaluation-only Docker images.

June 30, 2022

This major new release of the forgeops repository supports ForgeRock Identity Platform 7.2. In addition to enabling new features in the platform, this release adds usability and security enhancements.

Highlights

New forgeops command

A new forgeops command is now available in the bin directory of the forgeops repository. Use this new command to:

Install the CDK. The forgeops command replaces the cdk command in version 7.1. The cdk command is deprecated in version 7.2.

To install ForgeRock Identity Platform components in the CDK, run the forgeops install command with the --cdk option. See CDK deployment and Staged CDK and CDM installation for examples.
Install the CDM.

To obtain ForgeRock Identity Platform passwords after installing the CDK or CDM, run the forgeops info command.

DS operator released from technology preview status

With this release, the DS operator moves from technology preview status to evolving status.

The DS operator is now supported for use with the CDK and the CDM, and for production deployments of the ForgeRock Identity Platform.

You can migrate an existing deployment of the ForgeRock Identity Platform on Kubernetes to use the DS operator. Details here.

New CDM deployment technology

A new way to deploy the CDM is now available:

Deploying the CDM is generally simpler and faster.
The forgeops install command, already used for CDK deployments, has been enhanced to support CDM as well. See CDM deployment for an example.
As with CDK deployment, you can deploy the entire CDM with a single forgeops install command. You can also deploy individual CDM components one at a time, review the results, and then deploy the next component. Deploying the platform one component at a time can make troubleshooting simpler if you run into a problem.

For a list of CDM components you can install one at a time, run the forgeops install -h command.
The CDM’s deployment namespace is no longer required to be prod, and the deployment FQDN is no longer required to be my-namespace.iam.example.com. Use the forgeops install command’s --namespace and --fqdn arguments to specify your desired deployment namespace and FQDN. See CDM deployment for an example.
The forgeops install command is idempotent. The command checks the installation status of a component before it attempts to install it. For example, if you run the forgeops install command, and the ForgeRock UI pods are already installed and available, the installer won’t attempt to install the UI a second time unless you’ve specified different Docker images for running it, or modified the Kustomize files that orchestrate it.
The image defaulter gives developers fine-grained control over which Docker images are deployed with the CDM. The deployed Docker image no longer needs to be the last image that you built.
CDM deployment no longer uses Skaffold. Because of this, users no longer need to configure a default Skaffold repository before deploying the CDM.
The CDM incorporates ForgeRock’s DS operator, simplifying directory deployment.
The forgeops install command incorporates Secret Agent, DS operator, and cert-manager installation. Separate commands are no longer required to install these CDM components.
The CDM’s example Prometheus deployment requires cert-manager to be deployed before Prometheus can be deployed. In the new CDM, cert-manager is deployed when you run the forgeops install command. Because of this, you must now deploy the Prometheus, Grafana, and Alertmanager pods after you deploy the CDM.

The bin/certmanager-deploy.sh script is no longer used to deploy cert-manager.
Kustomize manifests are now generated in the kustomize/deploy directory when you:
- Install the CDM using the forgeops install command
- Run the new forgeops generate command, which only generates the manifests, but does not install the CDM
The Kustomize manifests let you:
- Delete and redeploy CDM components using the kubectl delete and kubectl apply commands
- More easily manage CDM deployment configuration changes using CI/CD systems
The forgeops delete command is now used to delete the CDM from a Kubernetes cluster. See Removal.

You’ll find the documentation for the new technology CDM here.

Multicluster deployment sample

Sample artifacts for a multicluster deployment of the ForgeRock Identity Platform on Google Cloud are available in the forgeops repository.

The sample includes:

Fully meshed multicluster DS topology using Cloud DNS for GKE
Global HTTP(S) load balancing across multiple clusters with a multicluster ingress
Health checks to manage application-level failover between clusters
Proximity-based routing
Active/active deployment
Failover deployment
Blue/green deployment

For details about the sample, see the multicluster README. Note that the sample artifacts are available for Google Cloud only.

Configuration profiles moved to docker directory

Configuration profiles, formerly in the config directory of the forgeops repository, now reside in the docker directory. Utility scripts have been modified to accommodate the new location. Intermediate 7.0 directories are no longer used.

For more information about the location of configuration profiles, see Configuration profiles.

This change impacts CDK deployment as follows:

The docker directory must now be Git-managed, because your configuration profiles are now stored there.
You can now use Git utilities, such as the git diff command, to review your changes to configuration profiles before you commit them.
When building a Docker image with the cdk build command, you must now use the new --config-profile option to specify the configuration profile that is to be included in your Docker image.
There is no longer a staging area in the docker directory. Previous versions required you to copy configuration (usually from the config directory) to the staging area in the docker directory before you built Docker images for the platform.
The config.sh command is deprecated.
You no longer need to use the config.sh init command to initialize the staging area.
Instead of using the config.sh export and config.sh save commands to export configuration from a running CDK instance to your configuration profile, use the new config export command. See AM image and IDM image.

If you are developing custom Docker images for the ForgeRock Identity Platform, you must move existing configuration profiles in the forgeops repository from the config directory to the new locations in the docker directory before you can work with this version of the forgeops repository. For example, if you have a configuration profile named my-profile:

Move the contents of the config/7.0/my-profile/am directory to the path docker/am/config-profiles/my-profile.
Move the contents of the config/7.0/my-profile/amster directory to the path docker/amster/config-profiles/my-profile.
Move the contents of the config/7.0/my-profile/idm directory to the path docker/idm/config-profiles/my-profile.
If present, move the contents of the config/7.0/my-profile/ig directory to the path docker/ig/config-profiles/my-profile.

Do not move the canonical cdk configuration profile. The docker directory has already been provisioned with this configuration profile.

New CDM backup techniques

The CDM now includes two new techniques that you can use when implementing data backup:

Kubernetes volume snapshots.
DS backup utilities.

See the backup and restore overview for more information.

The schedule-backups.sh script is deprecated, and ForgeRock recommends that you change your backup method to use a different backup and restore solution as soon as possible.

Changes

IDM evaluation-only Docker image repository name change: The name of the IDM evaluation-only Docker image repository has been changed to gcr.io/forgerock-io/idm-cdk. This image repository was formerly named gcr.io/forgerock-io/idm.
The IDM canonical configuration is now built in to the idm-cdk Docker image: The IDM canonical configuration for the CDK has been incorporated into the idm-cdk Docker image.

Because of this, you no longer need to copy files from the docker/idm/config-profiles/cdk directory when you initialize a new configuration profile. Simply create a new subdirectory under the docker/idm/config-profiles directory.

For an updated procedure for creating a new configuration profile, see Create a configuration profile.
New bin/ds-debug.sh script: The new bin/ds-debug.sh script lets you obtain diagnostic information for any DS pod running in your cluster. It also lets you perform several cleanup and recovery operations on DS pods.

For more information, see Debug script.
The RCS Agent has been removed from the CDM and CDK deployments: The RCS Agent is no longer available in the CDM and CDK deployments.

Building your own rcs-agent_docker_image Docker image is no longer required when deploying the ForgeRock Identity Platform on Kubernetes.
The LDIF importer is no longer used: The LDIF importer is no longer used in CDM and CDK deployments.

Building your own ldif-importer Docker image is no longer required when deploying the ForgeRock Identity Platform on Kubernetes.
CDM deployments create a third ds-idrepo replica: The ds-idrepo-2 replica is now deployed as part of the CDM for failover purposes.

Previously, IDM was not able to use a third ds-idrepo replica, so the number of ds-idrepo replicas was set at 2. A recent enhancement to IDM lets additional replicas be used for failover, so a third replica has been added to the CDM architecture.
Number of AM pods in small CDM clusters changed to 2: Small CDM clusters now have 2 AM pods. Previously, they had 3 AM pods.
Limitation on IDM workflow support in the CDK and CDM: The Release Notes now document the limitation that the CDK and CDM are not preconfigured to support IDM’s workflow engine.

Note that this limitation has existed since version 7.0 of the platform, when the CDK and CDM starting using DS as the IDM repository.
Changes to the steps for configuring the CDK and CDM to use a CA certificate: The forgeops install command now installs cert-manager as part of CDK and CDM deployment.

Because of this, the steps for configuring the CDK and CDM to use a certificate from a CA have changed. See TLS certificate for details.
Use the new cluster/minikube/cdk-minikube utility to create a Minikube cluster: The new cluster/minikube/cdk-minikube utility lets you create a Minikube cluster that’s configured for running the CDK.

The Minikube cluster page now includes an example of how to run this utility.
New recommendation: use the Hyperkit and Docker drivers for Minikube clusters: It’s now recommended that you use the Hyperkit driver for Minikube clusters on macOS systems, and the Docker driver for Minikube clusters on Linux systems.

ForgeRock has tested Minikube clusters with these two drivers, and the new cluster/minikube/cdk-minikube utility creates Minikube clusters with these two drivers by default.
CDK deployments on Minikube require the volume snapshots plugin: CDK deployments on Minikube now require you to enable the volume snapshots plugin. See Minikube cluster.

Deprecated

DevOps artifacts for deploying ForgeRock Identity Platform 7.1

The DevOps artifacts for deploying ForgeRock Identity Platform 7.1 are deprecated. You should migrate to version 7.2 as soon as you’re able to.

Previous CDM technology

The former way of deploying the CDM is deprecated.

The documentation for the former way of deploying the CDM, previously in the Cloud Deployment Model (CDM) menu, can be found here.

CDM cluster creation and deletion scripts

The following CDM cluster creation and deletion scripts in the /path/to/forgeops/cluster directory are deprecated:

gke/cluster-up.sh
gke/cluster-down.sh
eks/cluster-up.sh
eks/cluster-down.sh
aks/cluster-up.sh
aks/cluster-down.sh

Note that the scripts in the /path/to/forgeops/cluster/minikube directory are not deprecated.

The schedule-backups.sh script

The schedule-backups.sh script is deprecated, and ForgeRock recommends that you change your backup strategy to use the new backup techniques introduced in this release as soon as possible.

Dynamic AM configuration in the amster Docker image

Adding dynamic AM configuration to the amster Docker image is deprecated.

Instead, import and export dynamic configuration in and out of the CDK and CDM using utilities such as:

The bin/amster command in the forgeops repository
ForgeRock Identity Platform REST APIs
IDM reconciliation

Removed

IDM canonical configuration in the docker/idm/config-profiles/cdk directory: The IDM canonical configuration has been removed from the docker/idm/config-profiles/cdk directory. The configuration is now incorporated into the idm Docker image from Forge Rock.

It’s no longer necessary to copy files from this directory when initializing a new configuration profile.

For an updated procedure for creating a new configuration profile, see Create a configuration profile.
Installing the CDK using the skaffold run command: The ability to install the CDK using the skaffold run command, deprecated in version 7.1, is no longer available.

Use the bin/forgeops install command instead.
The cdk command: The cdk command has been removed from the forgeops repository.

Instead, use the new forgeops command to install ForgeRock Identity Platform components into the CDK, build custom Docker images, and delete components from the CDK. Note that for installing components into the CDK, you’ll need to specify the --cdk option. For example, forgeops install am --cdk.

See CDK deployment and Staged CDK and CDM installation for examples.
The print-secrets command: The print-secrets command

The forgeops info command provides equivalent functionality in this version of the forgeops repository.

1. NGINX Ingress Controller Helm chart version 4.3.0 installs NGINX Ingress Controller version 1.4.0.