Ping Identity Devops

Deploy an Example Stack

A video demonstration of this example is available here.

This example was written using Docker Desktop on the Mac platform using the Apple Silicon chip, with Kubernetes provided by the Docker Desktop kind implementation in a multi-node configuration. Results would be similar under Docker Desktop’s default Kubernetes implementation. The Docker Desktop version used for this guide was 4.96.3 (244472), which includes Docker Engine v29.9.2 and Kubernetes v1.35.1. Helm version 4.3.1 was used to deploy the Ping Identity Helm chart 0.16.0 (product images 2609). The traefik ingress controller version was v3.7.16, deployed from Helm chart version 42.1.3.

If you are new to Kubernetes-based deployments, there is a distinct difference when running under Kubernetes compared to running applications on servers. In a server model, many applications typically run on the same server, and you can access any of them using the same host. For example, many on-premise deployments of PingFederate also include the PingDataConsole, hosted on the same server.

Under Kubernetes, however, each application that requires external access is associated with a service. A service is a fixed endpoint in the cluster that routes traffic to a given application. So, in this example, there are distinct service endpoints for PingFederate, PingDataConsole, and the other products.

In this demo, these service endpoints are load balanced using the Traefik ingress controller. By adding entries to the /etc/hosts file, you can access them using typical URL entries.

The Ping Identity Helm Getting Started page has instructions on getting your environment configured for using the Ping Helm charts.

For more examples, see Helm Chart Example Configurations.

For more information on Helm with Ping products, see Ping Identity DevOps Helm Charts.

What You Will Do

After using Git to clone the pingidentity-devops-getting-started repository, you will use Helm to deploy a sample stack to a Kubernetes cluster.

Prerequisites

  • Register for the Ping DevOps program and set your DevOps User and Key as environment variables

  • Install Git

  • Follow the instructions on the helm Getting Started page up through updating to the latest charts to ensure you have the latest version of our charts

  • Access to a Kubernetes cluster. You can enable Kubernetes in Docker Desktop for a simple cluster (on the Mac platform), which is the cluster used for this guide.

Clone the getting-started repository

  1. Clone the pingidentity-devops-getting-started repository to your local ${PING_IDENTITY_DEVOPS_HOME} directory.

    The ${PING_IDENTITY_DEVOPS_HOME} environment variable points to your DevOps projects parent directory.

    		 
    cd "${PING_IDENTITY_DEVOPS_HOME}"
git clone \
  https://github.com/pingidentity/pingidentity-devops-getting-started.git

Deploy the example stack

  1. Deploy the example stack of our product containers.

    For this guide, avoid making changes to the everything.yaml file to ensure a successful first-time deployment.

    1. Create a namespace for running the stack in your Kubernetes cluster.

      # Create the namespace
kubectl create ns pinghelm

# Set the kubectl context to the namespace
kubectl config set-context --current --namespace=pinghelm

# Confirm
kubectl config view --minify | grep namespace:

    2. Deploy the ingress controller to Docker Desktop:

      cd <repository-root>/30-helm/

helm repo add traefik https://traefik.github.io/charts

helm repo update traefik

helm upgrade --install traefik traefik/traefik \
    --namespace traefik --create-namespace \
    -f ingress-traefik-values.yaml

The values file used to configure traefik during deployment is configured to skip backend TLS verification so the Ping product consoles with self-signed certificates will work with Traefik. Do not use this setting in production.

  1. To wait for the Traefik ingress to reach a healthy state, run the following command. You can also observe the pod status using k9s. You should see one controller pod running when the ingress controller is ready:

    kubectl get pods --namespace traefik

  2. Create a secret in the namespace you will be using to run the example (pinghelm). This secret provides credentials to obtain an evaluation license based on your Ping DevOps username and key:

    kubectl create secret generic devops-secret \
  --from-literal=PING_IDENTITY_DEVOPS_USER="$PING_IDENTITY_DEVOPS_USER" \
  --from-literal=PING_IDENTITY_DEVOPS_KEY="$PING_IDENTITY_DEVOPS_KEY" \
  --from-literal=PING_IDENTITY_ACCEPT_EULA="$PING_IDENTITY_ACCEPT_EULA" \
  --type=Opaque \
  --dry-run=client -o yaml | kubectl apply -f -

  3. This example will use the Helm release name demo and DNS domain suffix *pingdemo.example for accessing applications. Add all expected hosts to /etc/hosts:

    echo '127.0.0.1 demo-pingaccess-admin.pingdemo.example demo-pingaccess-engine.pingdemo.example demo-pingauthorize.pingdemo.example demo-pingauthorizepap.pingdemo.example demo-pingdataconsole.pingdemo.example demo-pingdelegator.pingdemo.example demo-pingdirectory.pingdemo.example demo-pingfederate-admin.pingdemo.example demo-pingfederate-engine.pingdemo.example demo-pingcentral.pingdemo.example' | sudo tee -a /etc/hosts > /dev/null

  4. To install the chart, go to your local "${PING_IDENTITY_DEVOPS_HOME}"/pingidentity-devops-getting-started/30-helm directory and run the command shown here. In this example, the release (deployment into Kubernetes by Helm) is called demo, forming the prefix for all objects created. The ingress-demo.yaml file configures the ingresses for the products to use the ping-local domain:

    helm upgrade --install demo pingidentity/ping-devops -f everything.yaml -f ingress-demo.yaml

    The latest product Docker images are automatically downloaded if they have not previously been pulled from Docker Hub.

    Sample output:

    NAME: demo
LAST DEPLOYED: Fri Oct 23 15:16:57 2026
NAMESPACE: pinghelm
STATUS: deployed
REVISION: 1
DESCRIPTION: Install complete
TEST SUITE: None
NOTES:
#-------------------------------------------------------------------------------------
# Ping DevOps
#
# Description: Ping Identity helm charts - October 2, 2026
#-------------------------------------------------------------------------------------
#
#           Product          tag   typ  #  cpu R/L   mem R/L  Ing
#    --------------------- ------- --- -- --------- --------- ---
#    global                2609              0/0       0/0     √
#
#  √ pingaccess-admin      2609    sts  1    0/2     1Gi/4Gi   √
#  √ pingaccess-engine     2609    dep  1    0/2     1Gi/4Gi   √
#  √ pingauthorize         2609    dep  1    0/2    1.5G/4Gi   √
#    pingauthorizepap
#    pingcentral
#  √ pingdataconsole       2609    dep  1    0/2    .5Gi/2Gi   √
#    pingdatasync
#    pingdelegator
#  √ pingdirectory         2609    sts  1  50m/2     2Gi/8Gi   √
#    pingdirectoryproxy
#  √ pingfederate-admin    2609    dep  1    0/2     1Gi/4Gi   √
#  √ pingfederate-engine   2609    dep  1    0/2     1Gi/4Gi   √
#
#    ldap-sdk-tools
#    pd-replication-timing
#    pingtoolkit
#
#-------------------------------------------------------------------------------------
# To see values info, simply set one of the following on your helm install/upgrade
#
#    --set help.values=all         # Provides all (i.e. .Values, .Release, .Chart, ...) yaml
#    --set help.values=global      # Provides global values
#    --set help.values={ image }   # Provides image values merged with global
#-------------------------------------------------------------------------------------

    As you can see, PingAccess Admin and Engine, PingData Console, PingDirectory, PingAuthorize, and the PingFederate Admin and Engine are deployed from the provided everything.yaml values file.

    It will take several minutes for all components to become operational.

  5. To display the status of the deployed components, you can use k9s or issue the corresponding commands shown here:

    • Display the services (endpoints for connecting) by running kubectl get service --selector=app.kubernetes.io/instance=demo

      NAME                            TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                   AGE
demo-pingaccess-admin           ClusterIP   10.96.23.229    <none>        9090/TCP,9000/TCP         4m20s
demo-pingaccess-admin-cluster   ClusterIP   None            <none>        <none>                    4m20s
demo-pingaccess-engine          ClusterIP   10.96.53.209    <none>        3000/TCP                  4m20s
demo-pingauthorize              ClusterIP   10.96.109.172   <none>        443/TCP                   4m20s
demo-pingauthorize-cluster      ClusterIP   None            <none>        1636/TCP                  4m20s
demo-pingdataconsole            ClusterIP   10.96.158.114   <none>        8443/TCP                  4m20s
demo-pingdirectory              ClusterIP   10.96.245.124   <none>        443/TCP,389/TCP,636/TCP   4m20s
demo-pingdirectory-cluster      ClusterIP   None            <none>        1636/TCP                  4m20s
demo-pingfederate-admin         ClusterIP   10.96.252.14    <none>        9999/TCP                  4m20s
demo-pingfederate-cluster       ClusterIP   None            <none>        7600/TCP,7700/TCP         4m20s
demo-pingfederate-engine        ClusterIP   10.96.207.25    <none>        9031/TCP                  4m20s

    • To view the pods, run kubectl get pods --selector=app.kubernetes.io/instance=demo - you will need to run this at intervals until all pods have started ( Running status):

      NAME                                       READY   STATUS    RESTARTS   AGE
demo-pingaccess-admin-0                    1/1     Running   0          4m20s
demo-pingaccess-engine-78f75b56d6-w7k6w    1/1     Running   0          4m20s
demo-pingauthorize-58f9f76fcb-gsdb6        1/1     Running   0          4m20s
demo-pingdataconsole-66cc557887-l9b7x      1/1     Running   0          4m20s
demo-pingdirectory-0                       1/1     Running   0          4m20s
demo-pingfederate-admin-6c658cf4b7-2f6x6   1/1     Running   0          4m20s
demo-pingfederate-engine-8d6f8cfd4-7klbf   1/1     Running   0          4m20s

    • To see the ingresses you will use to access the product, run kubectl get ingress. If the ingress controller is configured properly, you should see the ingress address populated as shown here (localhost under Docker Desktop’s default Kubernetes implementation, or the ingress controller pod IP under the kind implementation):

      NAME                       CLASS     HOSTS                                       ADDRESS     PORTS     AGE
demo-pingaccess-admin      traefik     demo-pingaccess-admin.pingdemo.example      172.19.0.7   80, 443   4m20s
demo-pingaccess-engine     traefik     demo-pingaccess-engine.pingdemo.example     172.19.0.7   80, 443   4m20s
demo-pingauthorize         traefik     demo-pingauthorize.pingdemo.example         172.19.0.7   80, 443   4m20s
demo-pingdataconsole       traefik     demo-pingdataconsole.pingdemo.example       172.19.0.7   80, 443   4m20s
demo-pingdirectory         traefik     demo-pingdirectory.pingdemo.example         172.19.0.7   80, 443   4m20s
demo-pingfederate-admin    traefik     demo-pingfederate-admin.pingdemo.example    172.19.0.7   80, 443   4m20s
demo-pingfederate-engine   traefik     demo-pingfederate-engine.pingdemo.example   172.19.0.7   80, 443   4m20s

    • To see everything tied to the helm release run kubectl get all --selector=app.kubernetes.io/instance=demo:

      NAME                                           READY   STATUS    RESTARTS   AGE
pod/demo-pingaccess-admin-0                    1/1     Running   0          4m21s
pod/demo-pingaccess-engine-78f75b56d6-w7k6w    1/1     Running   0          4m21s
pod/demo-pingauthorize-58f9f76fcb-gsdb6        1/1     Running   0          4m21s
pod/demo-pingdataconsole-66cc557887-l9b7x      1/1     Running   0          4m21s
pod/demo-pingdirectory-0                       1/1     Running   0          4m21s
pod/demo-pingfederate-admin-6c658cf4b7-2f6x6   1/1     Running   0          4m21s
pod/demo-pingfederate-engine-8d6f8cfd4-7klbf   1/1     Running   0          4m21s
      NAME                                  TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                   AGE
service/demo-pingaccess-admin         ClusterIP   10.96.23.229    <none>        9090/TCP,9000/TCP         4m21s
service/demo-pingaccess-admin-cluster ClusterIP   None            <none>        <none>                    4m21s
service/demo-pingaccess-engine        ClusterIP   10.96.53.209    <none>        3000/TCP                  4m21s
service/demo-pingauthorize            ClusterIP   10.96.109.172   <none>        443/TCP                   4m21s
service/demo-pingauthorize-cluster    ClusterIP   None            <none>        1636/TCP                  4m21s
service/demo-pingdataconsole          ClusterIP   10.96.158.114   <none>        8443/TCP                  4m21s
service/demo-pingdirectory            ClusterIP   10.96.245.124   <none>        443/TCP,389/TCP,636/TCP   4m21s
service/demo-pingdirectory-cluster    ClusterIP   None            <none>        1636/TCP                  4m21s
service/demo-pingfederate-admin       ClusterIP   10.96.252.14    <none>        9999/TCP                  4m21s
service/demo-pingfederate-cluster     ClusterIP   None            <none>        7600/TCP,7700/TCP         4m21s
service/demo-pingfederate-engine      ClusterIP   10.96.207.25    <none>        9031/TCP                  4m21s
      NAME                                       READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/demo-pingaccess-engine     1/1     1            1           4m21s
deployment.apps/demo-pingauthorize         1/1     1            1           4m21s
deployment.apps/demo-pingdataconsole       1/1     1            1           4m21s
deployment.apps/demo-pingfederate-admin    1/1     1            1           4m21s
deployment.apps/demo-pingfederate-engine   1/1     1            1           4m21s
      NAME                                                 DESIRED   CURRENT   READY   AGE
replicaset.apps/demo-pingaccess-engine-78f75b56d6    1         1         1       4m21s
replicaset.apps/demo-pingauthorize-58f9f76fcb        1         1         1       4m21s
replicaset.apps/demo-pingdataconsole-66cc557887      1         1         1       4m21s
replicaset.apps/demo-pingfederate-admin-6c658cf4b7   1         1         1       4m21s
replicaset.apps/demo-pingfederate-engine-8d6f8cfd4   1         1         1       4m21s
      NAME                                     READY   AGE
statefulset.apps/demo-pingaccess-admin   1/1     4m21s
statefulset.apps/demo-pingdirectory      1/1     4m21s

    • To view logs, look at the logs for the deployment of the product in question. For example:

      kubectl logs -f deployment/demo-pingfederate-admin

      1. These are the URLs and credentials to sign on to the management consoles for the products.

        This example uses self-signed certificates that will have to be accepted in your browser or added to your keystore.

        With the ingresses in place, you can access the products at these URLs:

        Product Connection Details

        PingFederate

        PingDirectory

        PingAccess

        PingAuthorize

      2. When you are finished, you can remove the demonstration components by running the uninstall command for helm:

        helm uninstall demo

Next Steps

Now that you have deployed a set of our product images using the provided chart, you can move on to deployments using configurations that more closely reflect use cases to be explored. Refer to Helm Chart Examples for other typical deployments.

Maintaining logs in a containerized model is different from the typical server-deployed application. See this page for additional details.