ForgeOps

Deploy using Helm on Minikube

In a development or demo environment, you can use the helm chart available locally in /path/to/forgeops/charts directory for performing ForgeOps deployment. In a production environment, it is highly recommended to use the Helm charts published on the registry.

  1. Verify that you have set up your environment and created a Kubernetes cluster as documented in the setup section.

  2. Enable the Python3 virtual environment:

    $ source .venv/bin/activate

  3. Set up a ForgeOps deployment environment:

    $ cd /path/to/forgeops/bin
$ ./forgeops env --env-name my-env --fqdn my-fqdn --cluster-issuer my-cluster-issuer --deployment-size

    In the command above, replace my-fqdn, my-cluster-issuer, and --deployment-size with appropriate values from your environment.

    • If you want to use the issuer provided with the platform for demo, then you can use default-issuer.

    • For a single-instance deployment, specify --deployment-size as --single-instance.

    • For small, medium, and large deployments, specify --deployment-size as --small, --medium, or --large.

      Learn more about single-instance deployments and deployment sizes in Cluster and deployment sizes.

  4. (Optional) By default, the latest platform images are used for ForgeOps deployment. If you need a specific image version to be deployed, then ensure that the image.repository and image.tag settings for the platform components are correct in the /path/to/forgeops/helm/my-env/values.yaml Helm values file.

  5. Set up your Kubernetes context:

    1. Create a Kubernetes namespace in the cluster for the Ping Identity Platform pods:

      $ kubectl create namespace my-namespace

    2. Set the active namespace in your Kubernetes context to the Kubernetes namespace you just created:

      $ kubens my-namespace

  6. Set up the certificate management utility. The forgeops repository contains certmanager-deploy.sh to install cert-manager in your cluster. If you need to use a different certificate management utility, then you refer to the corresponding documentation for installing that utility.

    $ cd /path/to/forgeops/bin
$ ./certmanager-deploy.sh

  7. Run the install-prereqs command:

    $ cd /path/to/forgeops/charts/scripts
$ ./install-prereqs

  8. Run the helm-upgrade command:

    $ cd ../identity-platform
$ helm upgrade --install identity-platform . \
 --version 2025.1.0 --namespace my-namespace \
 --set 'ds_idrepo.volumeClaimSpec.storageClassName=standard' \
 --set 'ds_cts.volumeClaimSpec.storageClassName=standard' \
 --values helm/my-env/values.yaml

    The preceding command creates a single-instance ForgeOps deployment. Only single-instance deployments are supported on Minikube.

    Learn more about single-instance deployments in Cluster and deployment sizes.

    Ping Identity only offers its software or services to legal entities that have entered into a binding license agreement with Ping Identity. When you install Docker images provided by ForgeOps, you agree either that: 1) you are an authorized user of a Ping Identity Platform customer that has entered into a license agreement with Ping Identity governing your use of the Ping Identity software; or 2) your use of the Ping Identity Platform software is subject to the Ping Identity Subscription Agreements.

  9. Check the status of the pods in the namespace in which you deployed the platform until all the pods are ready:

    1. Run the kubectl get pods command.

    2. Review the output. Deployment is complete when:

      • All entries in the STATUS column indicate Running or Completed.

      • The READY column indicates all running containers are available. The entry in the READY column represents [total number of containers/number of available containers].

    3. If necessary, continue to query your deployment’s status until all the pods are ready.

  10. Perform this step only if you are running Minikube on an ARM-based macOS system[1] :

    In a separate terminal tab or window, run the minikube tunnel command, and enter your system’s superuser password when prompted:

    $ minikube tunnel
✅  Tunnel successfully started

📌  NOTE: Please do not close this terminal as this process must stay alive for the tunnel to be accessible …​

❗  The service/ingress forgerock requires privileged ports to be exposed: [80 443]
🔑  sudo permission will be asked for it.
❗  The service/ingress ig requires privileged ports to be exposed: [80 443]
🏃  Starting tunnel for service forgerock.
🔑  sudo permission will be asked for it.
🏃  Starting tunnel for service ig.
Password:

    The tunnel creates networking that lets you access the Minikube cluster’s ingress on the localhost IP address (127.0.0.1). Leave the tab or window that started the tunnel open for as long as you run the ForgeOps deployment.

    Refer to this post for an explanation about why a Minikube tunnel is required to access ingress resources when running Minikube on an ARM-based macOS system.

  11. (Optional) Install a TLS certificate instead of using the default self-signed certificate in your ForgeOps deployment. Refer to TLS certificate for details.

Next step

1. For example, systems based on M1 or M2 chipsets.