diff --git a/content/develop/ai/agent-builder/agent-concepts.md b/content/develop/ai/agent-builder/agent-concepts.md index d44b50f92d..2a638aeb33 100644 --- a/content/develop/ai/agent-builder/agent-concepts.md +++ b/content/develop/ai/agent-builder/agent-concepts.md @@ -329,7 +329,7 @@ Production-ready agents include built-in reliability features: - Access controls: Implement proper authentication and authorization - Governed data access: Give agents defined tools instead of direct database access. [Context Gateway](/content/develop/ai/context-engine/context-gateway/concepts.md) serves these tools through one MCP endpoint, so agents never hold database or Upstream credentials. - Data retention: Automatic cleanup of personal data per regulations -- Sensitive data in memory: Keep information such as payment card numbers out of long-term memory. Agent Memory [sensitive-data exclusions](/content/operate/iris/agent-memory/create-service.md#sensitive-data-exclusions) guide automatic extraction away from it +- Sensitive data in memory: Keep information such as payment card numbers out of long-term memory. Agent Memory [sensitive-data exclusions](/content/operate/iris/cloud/agent-memory/create-service.md#sensitive-data-exclusions) guide automatic extraction away from it - Audit logging: Track all data access and modifications - Memory integrity: Validate content before it is written to agent memory and verify protected records on read. Memory written from tool results, web pages, or other agents can carry instructions that are replayed into later prompts ([OWASP Top 10 for Agentic Applications, ASI06](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/); [MITRE ATLAS AML.T0080.000](https://atlas.mitre.org/techniques/AML.T0080.000)). [OWASP Agent Memory Guard](https://github.com/OWASP/www-project-agent-memory-guard) is an open-source guard for this with adapters for LangChain, OpenAI Agents SDK, AutoGen, CrewAI, and mem0 diff --git a/content/develop/ai/context-engine/agent-memory/_index.md b/content/develop/ai/context-engine/agent-memory/_index.md index 69edb9f244..accd3c0025 100644 --- a/content/develop/ai/context-engine/agent-memory/_index.md +++ b/content/develop/ai/context-engine/agent-memory/_index.md @@ -104,12 +104,12 @@ Get started with Redis Agent Memory on Redis Cloud or deploy it with Redis Softw

Redis Cloud

Create a managed Redis Agent Memory service and make your first requests.

-

}}">Open the Redis Cloud setup guide

+

}}">Open the Redis Cloud setup guide

Redis Software

Deploy Redis Agent Memory on Kubernetes with Redis Software.

-

}}">Open the self-managed deployment guide

+

}}">Open the self-managed deployment guide

diff --git a/content/develop/ai/context-engine/agent-memory/developer-guide.md b/content/develop/ai/context-engine/agent-memory/developer-guide.md index e718cd3378..e36d4d3289 100644 --- a/content/develop/ai/context-engine/agent-memory/developer-guide.md +++ b/content/develop/ai/context-engine/agent-memory/developer-guide.md @@ -28,7 +28,7 @@ Every client needs the service endpoint, Store ID, and application programming i ### Manage a service with the Control Plane SDK -For store and extractor administration, see [Manage a service with the Control Plane SDK](/content/operate/iris/agent-memory/self-managed/api-examples.md#manage-a-service-with-the-control-plane-sdk). Keep operator credentials separate from application credentials. +For store and extractor administration, see [Manage a service with the Control Plane SDK](/content/operate/iris/self-managed/agent-memory/api-examples.md#manage-a-service-with-the-control-plane-sdk). Keep operator credentials separate from application credentials. ## Identify users and conversations @@ -51,7 +51,7 @@ Some IDs come from your application; others come from Redis Agent Memory: For example, the quickstart uses `quickstart-user` as the user's ID and `travel-planning-session` for one conversation. Replace the user ID with your authenticated account ID in an application. IDs must follow the format in the [API reference]({{< relref "/develop/ai/context-engine/agent-memory/api-reference" >}}). -For on-prem deployments, see [Server-side ownership enforcement](/content/operate/iris/agent-memory/self-managed/authentication.md#server-side-ownership-enforcement) for identity requirements and configuration. +For on-prem deployments, see [Server-side ownership enforcement](/content/operate/iris/self-managed/agent-memory/authentication.md#server-side-ownership-enforcement) for identity requirements and configuration. ### Authorize every memory request @@ -120,7 +120,7 @@ When a search returns no matches, `items` is an empty array. In the example, `re 1. If you expect a custom memory type, check that it is enabled under **Memory types & extraction**. Check that its extraction prompt covers the information in the event. 1. Compare the request's `ownerId`, `memoryType`, and namespace filters with the IDs and type used for the memory. Start with the owner filter alone to check whether an added filter excludes it. -See [View and edit service configuration]({{< relref "/operate/iris/agent-memory/view-service#configuration-tab" >}}) for the settings. Extraction uses a model, so it may not create a memory for every statement. +See [View and edit service configuration]({{< relref "/operate/iris/cloud/agent-memory/view-service#configuration-tab" >}}) for the settings. Extraction uses a model, so it may not create a memory for every statement. A failed request is different from a successful search with no matches. Handle the returned error before you use the result: @@ -222,4 +222,4 @@ Exclusions apply to automatic extraction from session events. They do not apply > [!WARNING] > Detector matches are deterministic, but semantic exclusions are advisory and do not guarantee exclusion. Sensitive session content still reaches the extraction model provider. Use appropriate controls before sending sensitive information to Redis Agent Memory or the model provider. -See [sensitive-data exclusions]({{< relref "/operate/iris/agent-memory/create-service#sensitive-data-exclusions" >}}) to configure the feature in Redis Cloud. +See [sensitive-data exclusions]({{< relref "/operate/iris/cloud/agent-memory/create-service#sensitive-data-exclusions" >}}) to configure the feature in Redis Cloud. diff --git a/content/develop/ai/context-engine/agent-memory/ingestion-webhooks.md b/content/develop/ai/context-engine/agent-memory/ingestion-webhooks.md index 73b6c29f1d..afd2aee1fa 100644 --- a/content/develop/ai/context-engine/agent-memory/ingestion-webhooks.md +++ b/content/develop/ai/context-engine/agent-memory/ingestion-webhooks.md @@ -43,11 +43,11 @@ Configuration, reads, searches, automatic expiration, and store teardown are out ## Prepare the deployment -Ask your operator to [enable ingestion webhooks](/content/operate/iris/agent-memory/self-managed/configuration.md#enable-ingestion-webhooks) and configure the signing-secret backend. +Ask your operator to [enable ingestion webhooks](/content/operate/iris/self-managed/agent-memory/configuration.md#enable-ingestion-webhooks) and configure the signing-secret backend. ## Configure a store policy -Your operator must [configure a store policy](/content/operate/iris/agent-memory/self-managed/api-examples.md#configure-a-webhook-policy), then provide the receiver with its signing keys and key IDs through a secret store. The receiver example reads them from `HOOK_KEYS_JSON`. Enable delivery after the receiver is ready. +Your operator must [configure a store policy](/content/operate/iris/self-managed/agent-memory/api-examples.md#configure-a-webhook-policy), then provide the receiver with its signing keys and key IDs through a secret store. The receiver example reads them from `HOOK_KEYS_JSON`. Enable delivery after the receiver is ready. ## Verify callbacks and return decisions diff --git a/content/develop/ai/context-engine/agent-memory/interactive-demo.md b/content/develop/ai/context-engine/agent-memory/interactive-demo.md index dc05fc45d2..fee9b3bd04 100644 --- a/content/develop/ai/context-engine/agent-memory/interactive-demo.md +++ b/content/develop/ai/context-engine/agent-memory/interactive-demo.md @@ -32,5 +32,5 @@ Try different messages to see how they change what the service remembers. Open * ## Next steps -- [Create an Agent Memory service](/content/operate/iris/agent-memory/create-service.md) on Redis Cloud. +- [Create an Agent Memory service](/content/operate/iris/cloud/agent-memory/create-service.md) on Redis Cloud. - Follow the [quickstart]({{< relref "/develop/ai/context-engine/agent-memory/quickstart" >}}) to try the same example with Python, TypeScript, or curl against a real service. diff --git a/content/develop/ai/context-engine/agent-memory/long-term-memory.md b/content/develop/ai/context-engine/agent-memory/long-term-memory.md index a6123919ea..fc86fa6c12 100644 --- a/content/develop/ai/context-engine/agent-memory/long-term-memory.md +++ b/content/develop/ai/context-engine/agent-memory/long-term-memory.md @@ -24,7 +24,7 @@ Redis Agent Memory provides two ways to create memories: Configure the long-term-memory time to live (TTL) separately from the session-memory TTL. -See [memory configuration]({{< relref "/operate/iris/agent-memory/create-service#memory-configuration" >}}) to configure the extraction cadence and long-term-memory TTL in Redis Cloud. +See [memory configuration]({{< relref "/operate/iris/cloud/agent-memory/create-service#memory-configuration" >}}) to configure the extraction cadence and long-term-memory TTL in Redis Cloud. ## Memory fields @@ -421,7 +421,7 @@ JSON Inspect the bulk response for per-record errors. Run the custom-memory search again to retrieve the record. Direct creation does not wait for background extraction and does not apply the extraction prompt or sensitive-data exclusions. Creating an eligible record with the same `id` again replaces that record. Access checks and protection for document-managed records still apply. -See [custom memory types]({{< relref "/operate/iris/agent-memory/create-service#custom-memory-types" >}}) for configuration requirements and limits. +See [custom memory types]({{< relref "/operate/iris/cloud/agent-memory/create-service#custom-memory-types" >}}) for configuration requirements and limits. ## Test semantic exclusions @@ -554,4 +554,4 @@ JSON > [!WARNING] > Semantic exclusions are advisory and do not guarantee that sensitive information is excluded. Session content still reaches the extraction model provider. Do not use real sensitive data in this exercise. Exclusions do not apply to directly created long-term memories. -See [sensitive-data exclusions]({{< relref "/operate/iris/agent-memory/create-service#sensitive-data-exclusions" >}}) for configuration details. +See [sensitive-data exclusions]({{< relref "/operate/iris/cloud/agent-memory/create-service#sensitive-data-exclusions" >}}) for configuration details. diff --git a/content/develop/ai/context-engine/agent-memory/memory-etl.md b/content/develop/ai/context-engine/agent-memory/memory-etl.md index 019855c9fd..44362617d8 100644 --- a/content/develop/ai/context-engine/agent-memory/memory-etl.md +++ b/content/develop/ai/context-engine/agent-memory/memory-etl.md @@ -19,7 +19,7 @@ Use [session extraction](/content/develop/ai/context-engine/agent-memory/session ## Prepare the service -MemoryETL is available in Redis Cloud and enabled in self-managed deployments. These examples use a self-managed service. For its model, processing limits, and worker settings, see [Configure document ingestion](/content/operate/iris/agent-memory/self-managed/configuration.md#enable-document-ingestion). +MemoryETL is available in Redis Cloud and enabled in self-managed deployments. These examples use a self-managed service. For its model, processing limits, and worker settings, see [Configure document ingestion](/content/operate/iris/self-managed/agent-memory/configuration.md#enable-document-ingestion). Install the SDK using the [quickstart](/content/develop/ai/context-engine/agent-memory/quickstart.md#install-the-sdk). Set: @@ -27,11 +27,11 @@ Install the SDK using the [quickstart](/content/develop/ai/context-engine/agent- |:---------|:------| | `AGENT_MEMORY_URL`, `STORE_ID`, `API_KEY` | The Data Plane endpoint, store, and application credential. | | `OWNER_ID` | Your application's authenticated user ID for this document. | -| `USER_TOKEN` | The user's token when self-managed ownership enforcement is enabled. See [delegation](/content/operate/iris/agent-memory/self-managed/authentication.md#delegate-a-user-with-an-agent-key). | +| `USER_TOKEN` | The user's token when self-managed ownership enforcement is enabled. See [delegation](/content/operate/iris/self-managed/agent-memory/authentication.md#delegate-a-user-with-an-agent-key). | ## Create an extractor -Ask your operator to [register a memory type and create a document extractor](/content/operate/iris/agent-memory/self-managed/api-examples.md#create-an-extractor). Set `EXTRACTOR_ID` to the returned extractor ID. Applications use their Data Plane credential to submit documents. +Ask your operator to [register a memory type and create a document extractor](/content/operate/iris/self-managed/agent-memory/api-examples.md#create-an-extractor). Set `EXTRACTOR_ID` to the returned extractor ID. Applications use their Data Plane credential to submit documents. ## Submit and track a document diff --git a/content/develop/ai/context-engine/agent-memory/namespaces/namespace-routing.md b/content/develop/ai/context-engine/agent-memory/namespaces/namespace-routing.md index 43decb6d12..8c9d2e5734 100644 --- a/content/develop/ai/context-engine/agent-memory/namespaces/namespace-routing.md +++ b/content/develop/ai/context-engine/agent-memory/namespaces/namespace-routing.md @@ -15,7 +15,7 @@ aliases: Namespace routing selects a shared namespace for an eligible memory. Admission rules check whether a memory can enter a destination. Use routing to organize shared memories by content, and admission rules to reject content that does not belong in a namespace. -The policy applies to one store. It targets existing shared namespace resources, using their stable `namespaceId` values. It does not create namespaces or change access permissions. Namespace routing is available in Redis Cloud and enabled in self-managed deployments. Configure a policy to use it for a store. For self-managed process settings, see [Configure namespace routing](/content/operate/iris/agent-memory/self-managed/configuration.md#enable-namespace-routing). +The policy applies to one store. It targets existing shared namespace resources, using their stable `namespaceId` values. It does not create namespaces or change access permissions. Namespace routing is available in Redis Cloud and enabled in self-managed deployments. Configure a policy to use it for a store. For self-managed process settings, see [Configure namespace routing](/content/operate/iris/self-managed/agent-memory/configuration.md#enable-namespace-routing). ## Understand placement and admission diff --git a/content/develop/ai/context-engine/agent-memory/overview.md b/content/develop/ai/context-engine/agent-memory/overview.md index 6caf531cbd..735bb8dbf2 100644 --- a/content/develop/ai/context-engine/agent-memory/overview.md +++ b/content/develop/ai/context-engine/agent-memory/overview.md @@ -37,7 +37,7 @@ You can think of Redis Agent Memory's tiers as analogous to human memory: Session memory is the working set: the current conversation's events, read and written every turn. Long-term memory is what survives after the session ends, durable enough to recall in a conversation the agent hasn't seen before. -Redis Agent Memory also maintains an automatically updated summary of each session, as derived session state. It returns this summary separately from long-term memories. You can also define custom long-term memory types for domain-specific information. See [Memory types & extraction]({{< relref "/operate/iris/agent-memory/create-service#memory-types-and-extraction" >}}) for the complete set of built-in and custom types. +Redis Agent Memory also maintains an automatically updated summary of each session, as derived session state. It returns this summary separately from long-term memories. You can also define custom long-term memory types for domain-specific information. See [Memory types & extraction]({{< relref "/operate/iris/cloud/agent-memory/create-service#memory-types-and-extraction" >}}) for the complete set of built-in and custom types. ## Adding to session memory diff --git a/content/develop/ai/context-engine/agent-memory/quickstart.md b/content/develop/ai/context-engine/agent-memory/quickstart.md index 8d75a4be43..298687c2cc 100644 --- a/content/develop/ai/context-engine/agent-memory/quickstart.md +++ b/content/develop/ai/context-engine/agent-memory/quickstart.md @@ -80,7 +80,7 @@ The SDK examples read `API_KEY` from your environment; replace `` and The endpoint must include `https://`. Keep the API key out of source control, application logs, and other unsecured locations. -For a self-managed service with ownership enforcement, use the authenticated client setup in [Delegate a user with an agent key](/content/operate/iris/agent-memory/self-managed/authentication.md#delegate-a-user-with-an-agent-key) and set `OWNER_ID` to the verified user ID before using these examples. +For a self-managed service with ownership enforcement, use the authenticated client setup in [Delegate a user with an agent key](/content/operate/iris/self-managed/agent-memory/authentication.md#delegate-a-user-with-an-agent-key) and set `OWNER_ID` to the verified user ID before using these examples. ## Install the SDK @@ -228,7 +228,7 @@ Run the search and inspect `items`. Extraction is asynchronous, so run the searc > [!NOTE] > **What to expect:** Results similar to `User is a vegetarian` and `User prefers spicy food`. Your application did not create these memories directly. Redis Agent Memory derived them from the session event. The exact text and memory types can vary. -The extracted memory remains searchable after the session expires, subject to the long-term memory time to live (TTL). You can change the extraction cadence and both TTLs in the [Redis Agent Memory service configuration]({{< relref "/operate/iris/agent-memory/create-service#memory-configuration" >}}). +The extracted memory remains searchable after the session expires, subject to the long-term memory time to live (TTL). You can change the extraction cadence and both TTLs in the [Redis Agent Memory service configuration]({{< relref "/operate/iris/cloud/agent-memory/create-service#memory-configuration" >}}). ## Next steps diff --git a/content/develop/ai/context-engine/agent-memory/sessions/_index.md b/content/develop/ai/context-engine/agent-memory/sessions/_index.md index 32da6c0af9..88580172ad 100644 --- a/content/develop/ai/context-engine/agent-memory/sessions/_index.md +++ b/content/develop/ai/context-engine/agent-memory/sessions/_index.md @@ -50,7 +50,7 @@ curl --fail-with-body --silent --show-error --request POST \ Send each new message once, using the same session ID throughout the conversation. -The session's `ownerId` comes from the first event's `actorId` and is returned when you retrieve the session. In on-prem deployments with [server-side ownership enforcement](/content/operate/iris/agent-memory/self-managed/authentication.md#server-side-ownership-enforcement), the first event's `actorId` must match the authenticated user ID. +The session's `ownerId` comes from the first event's `actorId` and is returned when you retrieve the session. In on-prem deployments with [server-side ownership enforcement](/content/operate/iris/self-managed/agent-memory/authentication.md#server-side-ownership-enforcement), the first event's `actorId` must match the authenticated user ID. ## Retrieve conversation context @@ -110,7 +110,7 @@ The session-memory time to live (TTL) controls how long sessions remain availabl In the Redis Cloud console, open your service's **Configuration** tab and select **Edit**. Set **Short-term TTL** under **Memory configuration**. -See [memory configuration]({{< relref "/operate/iris/agent-memory/create-service#memory-configuration" >}}) to configure the session-memory TTL in Redis Cloud. +See [memory configuration]({{< relref "/operate/iris/cloud/agent-memory/create-service#memory-configuration" >}}) to configure the session-memory TTL in Redis Cloud. ## Configure automatic summarization @@ -123,7 +123,7 @@ In the Redis Cloud console, open your service's **Configuration** tab and select For example, with **Summarize after** set to 20 and **Keep most recent** set to 10, Redis Agent Memory summarizes the older 10 messages when the session reaches 20 messages and retains the 10 most recent messages in full. -See [automatic summarization]({{< relref "/operate/iris/agent-memory/create-service#automatic-summarization" >}}) to enable summarization and configure both thresholds in Redis Cloud. +See [automatic summarization]({{< relref "/operate/iris/cloud/agent-memory/create-service#automatic-summarization" >}}) to enable summarization and configure both thresholds in Redis Cloud. For an example that combines session events with long-term recall, follow the [developer guide]({{< relref "/develop/ai/context-engine/agent-memory/developer-guide" >}}). For complete schemas, see the [session-memory application programming interface (API) reference]({{< relref "/develop/ai/context-engine/agent-memory/api-reference" >}}#operation/GetSessionMemory). diff --git a/content/develop/ai/context-engine/agent-memory/summary-views.md b/content/develop/ai/context-engine/agent-memory/summary-views.md index ad2c61f0c4..6044053c55 100644 --- a/content/develop/ai/context-engine/agent-memory/summary-views.md +++ b/content/develop/ai/context-engine/agent-memory/summary-views.md @@ -19,9 +19,9 @@ Summary Views differ from [session summarization](/content/develop/ai/context-en ## Prepare the service and identity -Summary Views are available in Redis Cloud and enabled in self-managed deployments. For self-managed model and capacity settings, see [Configure Summary Views](/content/operate/iris/agent-memory/self-managed/configuration.md#enable-summary-views). +Summary Views are available in Redis Cloud and enabled in self-managed deployments. For self-managed model and capacity settings, see [Configure Summary Views](/content/operate/iris/self-managed/agent-memory/configuration.md#enable-summary-views). -The examples use a self-managed service with ownership enforcement and [delegated user identity](/content/operate/iris/agent-memory/self-managed/authentication.md#delegate-a-user-with-an-agent-key). Set `AGENT_MEMORY_URL`, `STORE_ID`, `API_KEY`, `USER_TOKEN`, and `OWNER_ID` as described there. `OWNER_ID` must match the verified user claim. Install the SDK through the [quickstart](/content/develop/ai/context-engine/agent-memory/quickstart.md#install-the-sdk). +The examples use a self-managed service with ownership enforcement and [delegated user identity](/content/operate/iris/self-managed/agent-memory/authentication.md#delegate-a-user-with-an-agent-key). Set `AGENT_MEMORY_URL`, `STORE_ID`, `API_KEY`, `USER_TOKEN`, and `OWNER_ID` as described there. `OWNER_ID` must match the verified user claim. Install the SDK through the [quickstart](/content/develop/ai/context-engine/agent-memory/quickstart.md#install-the-sdk). The server assigns the definition's immutable `ownerId`. In on-prem deployments, creation requires an authenticated user ID even with enforcement off. A store credential without user identity cannot create a view by supplying an owner field. diff --git a/content/develop/ai/context-engine/context-gateway/_index.md b/content/develop/ai/context-engine/context-gateway/_index.md index 3f4c6527d8..a1bed357e3 100644 --- a/content/develop/ai/context-engine/context-gateway/_index.md +++ b/content/develop/ai/context-engine/context-gateway/_index.md @@ -73,7 +73,7 @@ Follow the [quickstart](/content/develop/ai/context-engine/context-gateway/quick ## Get started with Context Gateway -Context Gateway is available for self-managed deployment on Kubernetes. See [Self-managed Context Gateway](/content/operate/iris/context-gateway/self-managed/_index.md), then [create a Gateway and an agent key](/content/operate/iris/context-gateway/self-managed/api-examples.md). +Context Gateway is available for self-managed deployment on Kubernetes. See [Self-managed Context Gateway](/content/operate/iris/self-managed/context-gateway/_index.md), then [create a Gateway and an agent key](/content/operate/iris/self-managed/context-gateway/api-examples.md). You need a license key to deploy: [contact Redis](https://redis.io/contact/) to request access. diff --git a/content/develop/ai/context-engine/context-gateway/api-reference.md b/content/develop/ai/context-engine/context-gateway/api-reference.md index b278d17a76..171bc9c9a4 100644 --- a/content/develop/ai/context-engine/context-gateway/api-reference.md +++ b/content/develop/ai/context-engine/context-gateway/api-reference.md @@ -11,7 +11,7 @@ title: Redis Context Gateway MCP API reference weight: 80 --- -Agents call Redis Context Gateway through its Model Context Protocol (MCP) endpoint, the Data Plane API. Platform teams manage Gateways and Upstreams through the [Control Plane API](/content/operate/iris/context-gateway/self-managed/control-plane-api-reference.md). +Agents call Redis Context Gateway through its Model Context Protocol (MCP) endpoint, the Data Plane API. Platform teams manage Gateways and Upstreams through the [Control Plane API](/content/operate/iris/self-managed/context-gateway/control-plane-api-reference.md). For how to connect, see [MCP](/content/develop/ai/context-engine/context-gateway/mcp.md). For limits and recovery, see [Limits and errors](/content/develop/ai/context-engine/context-gateway/limits.md). diff --git a/content/develop/ai/context-engine/context-gateway/concepts.md b/content/develop/ai/context-engine/context-gateway/concepts.md index 8ed288c834..b801b1d094 100644 --- a/content/develop/ai/context-engine/context-gateway/concepts.md +++ b/content/develop/ai/context-engine/context-gateway/concepts.md @@ -38,7 +38,7 @@ The key's or token's grants must name the Gateway: MCP read-only and destructive annotations do not limit what `use` allows. Give an agent a Gateway that holds only the tools it should call. Neither the agent key nor the IdP token reaches an Upstream. -For key administration, see [Authentication and authorization](/content/operate/iris/context-gateway/self-managed/authentication.md). +For key administration, see [Authentication and authorization](/content/operate/iris/self-managed/context-gateway/authentication.md). ## Upstreams diff --git a/content/develop/ai/context-engine/context-gateway/developer-guide.md b/content/develop/ai/context-engine/context-gateway/developer-guide.md index eee198cac3..adf34059b8 100644 --- a/content/develop/ai/context-engine/context-gateway/developer-guide.md +++ b/content/develop/ai/context-engine/context-gateway/developer-guide.md @@ -42,7 +42,7 @@ Every client requires: The Python package and the CLI read both from `IRIS_CONTEXT_GATEWAY_URL` and `IRIS_CONTEXT_GATEWAY_API_KEY`. When you use HTTP, send the key as a bearer token on every request. -Ask your platform team for these values, or [create a Gateway and an agent key](/content/operate/iris/context-gateway/self-managed/api-examples.md) on a self-managed deployment. +Ask your platform team for these values, or [create a Gateway and an agent key](/content/operate/iris/self-managed/context-gateway/api-examples.md) on a self-managed deployment. ## Work with tools @@ -58,4 +58,4 @@ When result handles are on for the Gateway, a large result comes back as a stub * [Python and CLI package reference](https://pypi.org/project/redis-iris/) * [TypeScript client reference](https://www.npmjs.com/package/@redis-iris/context-gateway) * [Redis Context Gateway MCP API reference](/content/develop/ai/context-engine/context-gateway/api-reference.md) -* [Control Plane API reference](/content/operate/iris/context-gateway/self-managed/control-plane-api-reference.md) +* [Control Plane API reference](/content/operate/iris/self-managed/context-gateway/control-plane-api-reference.md) diff --git a/content/develop/ai/context-engine/context-gateway/limits.md b/content/develop/ai/context-engine/context-gateway/limits.md index 619686a788..8dae0dbdd3 100644 --- a/content/develop/ai/context-engine/context-gateway/limits.md +++ b/content/develop/ai/context-engine/context-gateway/limits.md @@ -13,7 +13,7 @@ weight: 90 Check these limits and error types when you handle a failed request or a tool result that did not come from the Upstream. Confirm deployment settings with your administrator. -The [API reference](/content/develop/ai/context-engine/context-gateway/api-reference.md) defines the Model Context Protocol (MCP) tools and their arguments. The [Control Plane API reference](/content/operate/iris/context-gateway/self-managed/control-plane-api-reference.md) defines Control Plane field formats. +The [API reference](/content/develop/ai/context-engine/context-gateway/api-reference.md) defines the Model Context Protocol (MCP) tools and their arguments. The [Control Plane API reference](/content/operate/iris/self-managed/context-gateway/control-plane-api-reference.md) defines Control Plane field formats. ## Tool and result limits diff --git a/content/develop/ai/context-engine/context-gateway/manage-context-surfaces.md b/content/develop/ai/context-engine/context-gateway/manage-context-surfaces.md index f445ba7535..714e060d62 100644 --- a/content/develop/ai/context-engine/context-gateway/manage-context-surfaces.md +++ b/content/develop/ai/context-engine/context-gateway/manage-context-surfaces.md @@ -17,7 +17,7 @@ A Context Surface is an Upstream that serves the records of a Redis database as These tasks need the Control Plane URL and the admin token. The examples use Python, cURL, and the Iris command-line interface (CLI). Export them as shown in [Manage Gateways and Upstreams](/content/develop/ai/context-engine/context-gateway/manage-gateways.md#before-you-begin). -Your administrator registers the Redis database in the deployment's database registry under an ID, and gives the Control Plane and the Data Plane each a Redis user for it. See [Context Surface databases](/content/operate/iris/context-gateway/self-managed/configuration.md#context-surface-databases). You reference the database by that ID. +Your administrator registers the Redis database in the deployment's database registry under an ID, and gives the Control Plane and the Data Plane each a Redis user for it. See [Context Surface databases](/content/operate/iris/self-managed/context-gateway/configuration.md#context-surface-databases). You reference the database by that ID. Read these limits before you create a Surface: diff --git a/content/develop/ai/context-engine/context-gateway/manage-gateways.md b/content/develop/ai/context-engine/context-gateway/manage-gateways.md index 119e8dd9a2..2622181ecb 100644 --- a/content/develop/ai/context-engine/context-gateway/manage-gateways.md +++ b/content/develop/ai/context-engine/context-gateway/manage-gateways.md @@ -15,7 +15,7 @@ Use the Control Plane to create Gateways, register their Upstreams, and decide h ## Before you begin -These tasks need the Control Plane URL and the admin token, which a platform team holds. See [Authentication and authorization](/content/operate/iris/context-gateway/self-managed/authentication.md). The admin token manages every Gateway in the deployment, so keep it out of agent and application configuration. +These tasks need the Control Plane URL and the admin token, which a platform team holds. See [Authentication and authorization](/content/operate/iris/self-managed/context-gateway/authentication.md). The admin token manages every Gateway in the deployment, so keep it out of agent and application configuration. Export these values in the shell where you run the examples: @@ -48,7 +48,7 @@ Update a Gateway's `toolExposureMode` to `full` or `search`, its display name, i ### Turn the result cache and result handles on or off -Set `cache` or `compression` to `enabled` or `disabled` on a Gateway update. Every Gateway response returns both settings. A Gateway's setting takes effect only when the deployment also turns the feature on. See [Result cache and result handles](/content/operate/iris/context-gateway/self-managed/configuration.md#result-cache-and-result-handles). +Set `cache` or `compression` to `enabled` or `disabled` on a Gateway update. Every Gateway response returns both settings. A Gateway's setting takes effect only when the deployment also turns the feature on. See [Result cache and result handles](/content/operate/iris/self-managed/context-gateway/configuration.md#result-cache-and-result-handles). ```json {"revision": "", "cache": "enabled", "compression": "disabled"} @@ -122,4 +122,4 @@ Delete an Upstream at its current revision. A Gateway can be deleted only when i A delete marks the Upstream first, then cleans up. If a delete stops after the mark, for example on a timeout, repeat it with the Upstream ID to finish. -Revoke the agent keys for a deleted Gateway. See [Operations](/content/operate/iris/context-gateway/self-managed/operations.md#rotate-credentials). +Revoke the agent keys for a deleted Gateway. See [Operations](/content/operate/iris/self-managed/context-gateway/operations.md#rotate-credentials). diff --git a/content/develop/ai/context-engine/context-gateway/mcp.md b/content/develop/ai/context-engine/context-gateway/mcp.md index 1e617817f2..992689e9e2 100644 --- a/content/develop/ai/context-engine/context-gateway/mcp.md +++ b/content/develop/ai/context-engine/context-gateway/mcp.md @@ -101,7 +101,7 @@ When the deployment turns on sign-in, an MCP client can use an access token from A request without a credential receives `401` and a `WWW-Authenticate` header that points to the Gateway's protected resource metadata. Clients that support MCP authorization read that document, find the IdP, and sign the user in. The IdP's token never reaches an Upstream. -The signed-in user still needs a grant on the Gateway. See [Identity provider sign-in](/content/operate/iris/context-gateway/self-managed/authentication.md#identity-provider-sign-in). +The signed-in user still needs a grant on the Gateway. See [Identity provider sign-in](/content/operate/iris/self-managed/context-gateway/authentication.md#identity-provider-sign-in). diff --git a/content/develop/ai/context-engine/context-gateway/quickstart.md b/content/develop/ai/context-engine/context-gateway/quickstart.md index 237d2f3de9..ec5a958681 100644 --- a/content/develop/ai/context-engine/context-gateway/quickstart.md +++ b/content/develop/ai/context-engine/context-gateway/quickstart.md @@ -22,7 +22,7 @@ Get two Gateways over the sample clinic directory from your administrator, and o - A `full` mode Gateway, which lists every tool. - A `search` mode Gateway with a Gateway database, which lists `search_tools` and `run_tool` and holds large results as handles. -For self-managed setup, [create the Gateways and the agent key](/content/operate/iris/context-gateway/self-managed/api-examples.md). +For self-managed setup, [create the Gateways and the agent key](/content/operate/iris/self-managed/context-gateway/api-examples.md). This walkthrough needs no agent framework or model-provider key. diff --git a/content/develop/ai/context-engine/intent-router/_index.md b/content/develop/ai/context-engine/intent-router/_index.md index bb0e214c05..cc153e20fa 100644 --- a/content/develop/ai/context-engine/intent-router/_index.md +++ b/content/develop/ai/context-engine/intent-router/_index.md @@ -63,7 +63,7 @@ The [redis-iris package](https://pypi.org/project/redis-iris/) covers matching, ## Get started -Redis Intent Router is available for self-managed deployment on Kubernetes. See [Self-managed Intent Router](/content/operate/iris/intent-router/self-managed/_index.md), then [create a Router and an agent key](/content/operate/iris/intent-router/self-managed/api-examples.md). +Redis Intent Router is available for self-managed deployment on Kubernetes. See [Self-managed Intent Router](/content/operate/iris/self-managed/intent-router/_index.md), then [create a Router and an agent key](/content/operate/iris/self-managed/intent-router/api-examples.md). You need a license key to deploy: [contact Redis](https://redis.io/contact/) to request access. diff --git a/content/develop/ai/context-engine/intent-router/developer-guide.md b/content/develop/ai/context-engine/intent-router/developer-guide.md index 84e01800a5..de1d235ded 100644 --- a/content/develop/ai/context-engine/intent-router/developer-guide.md +++ b/content/develop/ai/context-engine/intent-router/developer-guide.md @@ -65,4 +65,4 @@ Every client raises an error that carries the HTTP status and the problem `type` * [Python and CLI package reference](https://pypi.org/project/redis-iris/) * [TypeScript client reference](https://www.npmjs.com/package/@redis-iris/intent-router) * [Data-plane API reference](/content/develop/ai/context-engine/intent-router/api-reference.md) -* [Control-plane API reference](/content/operate/iris/intent-router/self-managed/control-plane-api-reference.md) +* [Control-plane API reference](/content/operate/iris/self-managed/intent-router/control-plane-api-reference.md) diff --git a/content/develop/ai/context-engine/intent-router/manage-routers.md b/content/develop/ai/context-engine/intent-router/manage-routers.md index 5fd88e5d05..1f9ab513db 100644 --- a/content/develop/ai/context-engine/intent-router/manage-routers.md +++ b/content/develop/ai/context-engine/intent-router/manage-routers.md @@ -15,7 +15,7 @@ Use the control plane to create the Routers that applications author intents in ## Before you begin -These tasks need the control-plane URL and its admin token, which a platform team holds. See [Authentication and authorization](/content/operate/iris/intent-router/self-managed/authentication.md). The admin token manages every Router in the deployment, so keep it out of agent and application configuration. +These tasks need the control-plane URL and its admin token, which a platform team holds. See [Authentication and authorization](/content/operate/iris/self-managed/intent-router/authentication.md). The admin token manages every Router in the deployment, so keep it out of agent and application configuration. Export these values in the shell where you run the examples: @@ -36,7 +36,7 @@ A Router's embedding model decides how well matching understands wording, and it Each model reports its `provider`, `model`, and `dimensions`. Pass the same three values as the Router's `vectorSpace`. A self-managed deployment offers one embedding model, configured by your administrator, and holds its provider credentials itself, so `authorization` is `NONE`. Creating a Router with a model that isn't listed fails with `400`. -The model also sets the Router's memory use. The Router's vector index takes about the number of examples multiplied by `dimensions`, multiplied by 4 bytes, plus the index graph. See [Size memory](/content/operate/iris/intent-router/self-managed/prerequisites.md#size-memory). +The model also sets the Router's memory use. The Router's vector index takes about the number of examples multiplied by `dimensions`, multiplied by 4 bytes, plus the index graph. See [Size memory](/content/operate/iris/self-managed/intent-router/prerequisites.md#size-memory). ## Create a Router @@ -91,7 +91,7 @@ Suspend a Router to stop it serving without deleting its intents. Data requests ## Delete a Router -Deleting a Router permanently removes it, its intents, its examples, and its search index. You can delete a Router in any state. Deleting a Router doesn't revoke its agent keys, because the keys live in the Identity Service, not the control plane. A key whose grant names a deleted Router stays in the Identity Service until you revoke it. Revoke the Router's keys before you delete it, as shown in [Rotate or revoke agent keys](/content/operate/iris/intent-router/self-managed/api-examples.md#rotate-or-revoke-agent-keys). +Deleting a Router permanently removes it, its intents, its examples, and its search index. You can delete a Router in any state. Deleting a Router doesn't revoke its agent keys, because the keys live in the Identity Service, not the control plane. A key whose grant names a deleted Router stays in the Identity Service until you revoke it. Revoke the Router's keys before you delete it, as shown in [Rotate or revoke agent keys](/content/operate/iris/self-managed/intent-router/api-examples.md#rotate-or-revoke-agent-keys). {{< clients-example set="iris_intent_router_service" step="router-delete" description="" lang_filter="Python (Iris),TypeScript (Iris),cURL (Iris),CLI (Iris)" footer="hide" />}} @@ -99,7 +99,7 @@ The delete returns `202` with the Router in `DELETING`, and the data plane finis ## Issue agent keys -The control plane doesn't issue agent keys. Your platform team issues them with the Redis Iris Identity Service, with a grant on the Router. The CLI mints one with `iris intent-router service key ROUTER_ID --role write --write PATH`, and `iris identity keys` lists, rotates, and revokes them. See [Create a Router and an agent key](/content/operate/iris/intent-router/self-managed/api-examples.md). +The control plane doesn't issue agent keys. Your platform team issues them with the Redis Iris Identity Service, with a grant on the Router. The CLI mints one with `iris intent-router service key ROUTER_ID --role write --write PATH`, and `iris identity keys` lists, rotates, and revokes them. See [Create a Router and an agent key](/content/operate/iris/self-managed/intent-router/api-examples.md). | Action | What it allows | | ------ | -------------- | diff --git a/content/develop/ai/context-engine/intent-router/quickstart.md b/content/develop/ai/context-engine/intent-router/quickstart.md index c789cc03ce..a58da2f729 100644 --- a/content/develop/ai/context-engine/intent-router/quickstart.md +++ b/content/develop/ai/context-engine/intent-router/quickstart.md @@ -15,7 +15,7 @@ Intent Router classifies each incoming user message by intent, so your applicati ## Before you begin -You need a Router in the `READY` state and an agent key with `write` access to it. `write` includes `read`. To create a Router yourself, see [Manage Routers](/content/develop/ai/context-engine/intent-router/manage-routers.md). Platform teams mint agent keys as shown in [Create a Router and an agent key](/content/operate/iris/intent-router/self-managed/api-examples.md). +You need a Router in the `READY` state and an agent key with `write` access to it. `write` includes `read`. To create a Router yourself, see [Manage Routers](/content/develop/ai/context-engine/intent-router/manage-routers.md). Platform teams mint agent keys as shown in [Create a Router and an agent key](/content/operate/iris/self-managed/intent-router/api-examples.md). This walkthrough needs no agent framework or model-provider key. diff --git a/content/develop/ai/context-engine/sdk-and-cli.md b/content/develop/ai/context-engine/sdk-and-cli.md index 1992852a3e..7c1bb368b3 100644 --- a/content/develop/ai/context-engine/sdk-and-cli.md +++ b/content/develop/ai/context-engine/sdk-and-cli.md @@ -98,7 +98,7 @@ On Redis Cloud, the [Redis Cloud console](https://cloud.redis.io/) creates servi On a self-managed deployment, the CLI creates services and keys with your operator tokens. Each token is the deployment's static admin token or an access token from your identity provider. -The services deploy on Kubernetes from the shared Redis Helm repository, `https://helm.redis.io/ai`. See [deploy self-managed Agent Memory](/content/operate/iris/agent-memory/self-managed/deploy.md) and [deploy self-managed Context Gateway](/content/operate/iris/context-gateway/self-managed/deploy.md). For a complete project, see the [self-managed project setup example](https://github.com/redis/redis-iris/tree/main/examples/project_setup/onprem). +The services deploy on Kubernetes from the shared Redis Helm repository, `https://helm.redis.io/ai`. See [deploy self-managed Agent Memory](/content/operate/iris/self-managed/agent-memory/deploy.md) and [deploy self-managed Context Gateway](/content/operate/iris/self-managed/context-gateway/deploy.md). For a complete project, see the [self-managed project setup example](https://github.com/redis/redis-iris/tree/main/examples/project_setup/onprem). 1. Create `iris.toml` with a profile for your deployment. It holds URLs only: diff --git a/content/develop/whats-new/_index.md b/content/develop/whats-new/_index.md index 726d79397c..00c136fa32 100644 --- a/content/develop/whats-new/_index.md +++ b/content/develop/whats-new/_index.md @@ -22,7 +22,7 @@ weight: 10 ### Redis Iris (Context Engine) -- Added self-managed deployment documentation for all four Redis Iris services: [LangCache](/content/operate/iris/langcache/self-managed/_index.md), [Agent Memory](/content/operate/iris/agent-memory/self-managed/_index.md), Context Retriever, and [Data Integration](/content/integrate/redis-data-integration/_index.md) +- Added self-managed deployment documentation for all four Redis Iris services: [LangCache](/content/operate/iris/langcache/self-managed/_index.md), [Agent Memory](/content/operate/iris/self-managed/agent-memory/_index.md), Context Retriever, and [Data Integration](/content/integrate/redis-data-integration/_index.md) - Updated [LangCache](/content/develop/ai/context-engine/langcache/_index.md), [Agent Memory](/content/develop/ai/context-engine/agent-memory/_index.md), Context Retriever, and [Data Integration](/content/develop/ai/context-engine/data-integration/_index.md) quickstarts with fully managed and self-managed deployment paths - Added [Redis Iris concepts](/content/develop/ai/context-engine/concepts/_index.md) explaining how agents get context from Redis Iris - Added new [AI agent builder](/content/develop/ai/agent-builder/_index.md) templates for knowledge assistants (RAG) and Redis Iris conversational assistants diff --git a/content/embeds/rc-agent-memory-get-started.md b/content/embeds/rc-agent-memory-get-started.md index d21b18c4fa..2f7c65f3d9 100644 --- a/content/embeds/rc-agent-memory-get-started.md +++ b/content/embeds/rc-agent-memory-get-started.md @@ -1,3 +1,3 @@ -Follow the [Redis Cloud setup guide]({{< relref "/operate/iris/agent-memory/create-service" >}}) to create a Redis Agent Memory service. Then use the [quickstart]({{< relref "/develop/ai/context-engine/agent-memory/quickstart" >}}) to make your first session-memory and long-term-memory requests. +Follow the [Redis Cloud setup guide]({{< relref "/operate/iris/cloud/agent-memory/create-service" >}}) to create a Redis Agent Memory service. Then use the [quickstart]({{< relref "/develop/ai/context-engine/agent-memory/quickstart" >}}) to make your first session-memory and long-term-memory requests. -After you set up Redis Agent Memory, you can [view and manage your service]({{< relref "/operate/iris/agent-memory/view-service" >}}). +After you set up Redis Agent Memory, you can [view and manage your service]({{< relref "/operate/iris/cloud/agent-memory/view-service" >}}). diff --git a/content/embeds/rc-agent-memory-quickstart-create-service.md b/content/embeds/rc-agent-memory-quickstart-create-service.md index 44a2eeb6a0..f049536319 100644 --- a/content/embeds/rc-agent-memory-quickstart-create-service.md +++ b/content/embeds/rc-agent-memory-quickstart-create-service.md @@ -15,6 +15,6 @@ 1. Copy the Redis Agent Memory API key and store it securely. > [!WARNING] -> Redis Cloud displays the Redis Agent Memory API key only once. If you lose it, [generate a new API key]({{< relref "/operate/iris/agent-memory/view-service#replace-service-api-key" >}}). +> Redis Cloud displays the Redis Agent Memory API key only once. If you lose it, [generate a new API key]({{< relref "/operate/iris/cloud/agent-memory/view-service#replace-service-api-key" >}}). -The one-minute extraction interval makes the result easier to observe in this example. For screenshots and configuration details, see [create a Redis Agent Memory service]({{< relref "/operate/iris/agent-memory/create-service" >}}). +The one-minute extraction interval makes the result easier to observe in this example. For screenshots and configuration details, see [create a Redis Agent Memory service]({{< relref "/operate/iris/cloud/agent-memory/create-service" >}}). diff --git a/content/embeds/rc-agent-memory-quickstart-prerequisites.md b/content/embeds/rc-agent-memory-quickstart-prerequisites.md index 5a8566510b..659e23b440 100644 --- a/content/embeds/rc-agent-memory-quickstart-prerequisites.md +++ b/content/embeds/rc-agent-memory-quickstart-prerequisites.md @@ -5,4 +5,4 @@ The database must be active, run a supported Redis version, and use a Pro or Ess Redis Agent Memory doesn't support Flex, Active-Active, or AWS PrivateLink databases. -For the complete list, see [prerequisites and limitations]({{< relref "/operate/iris/agent-memory/create-service#prerequisites-and-limitations" >}}). +For the complete list, see [prerequisites and limitations]({{< relref "/operate/iris/cloud/agent-memory/create-service#prerequisites-and-limitations" >}}). diff --git a/content/integrate/google-adk/_index.md b/content/integrate/google-adk/_index.md index f2474ffd7a..04100119b7 100644 --- a/content/integrate/google-adk/_index.md +++ b/content/integrate/google-adk/_index.md @@ -25,7 +25,7 @@ weight: 30 adk-redis connects several backend systems to the ADK framework: -- **[Redis Agent Memory](/content/develop/ai/context-engine/agent-memory/_index.md)** handles working memory (sessions), long-term memory (extracted facts), auto-summarization, and memory search. Use the default `redis-agent-memory` for new work. It runs either on [Redis Cloud](/content/operate/rc/context-engine/agent-memory/_index.md) or [self-managed](/content/operate/iris/agent-memory/self-managed/_index.md) on your own Kubernetes cluster; both share one Data Plane API, so you pick a deployment by pointing `api_base_url` at the right endpoint. +- **[Redis Agent Memory](/content/develop/ai/context-engine/agent-memory/_index.md)** handles working memory (sessions), long-term memory (extracted facts), auto-summarization, and memory search. Use the default `redis-agent-memory` for new work. It runs either on [Redis Cloud](/content/operate/rc/context-engine/agent-memory/_index.md) or [self-managed](/content/operate/iris/self-managed/agent-memory/_index.md) on your own Kubernetes cluster; both share one Data Plane API, so you pick a deployment by pointing `api_base_url` at the right endpoint. - **[RedisVL](/content/develop/ai/redisvl/_index.md)** (Redis Vector Library) powers the search tools and local semantic cache provider. - **[LangCache](https://redis.io/langcache/)** provides managed semantic caching with server-side embeddings. @@ -43,8 +43,8 @@ adk-redis connects several backend systems to the ADK framework: Provision a store, then pass its Data Plane endpoint, API key, and store ID to the services. -- On **Redis Cloud**, there is nothing to run. See [Create an Agent Memory service](/content/operate/iris/agent-memory/create-service.md). -- To run it **yourself**, see [Self-managed Agent Memory](/content/operate/iris/agent-memory/self-managed/_index.md) for deployment, configuration, and operations on your own Kubernetes cluster. +- On **Redis Cloud**, there is nothing to run. See [Create an Agent Memory service](/content/operate/iris/cloud/agent-memory/create-service.md). +- To run it **yourself**, see [Self-managed Agent Memory](/content/operate/iris/self-managed/agent-memory/_index.md) for deployment, configuration, and operations on your own Kubernetes cluster. Both use `backend="redis-agent-memory"`. Only `api_base_url` differs. diff --git a/content/integrate/google-adk/agent-memory-server.md b/content/integrate/google-adk/agent-memory-server.md index a3c8c826be..85b5d4179d 100644 --- a/content/integrate/google-adk/agent-memory-server.md +++ b/content/integrate/google-adk/agent-memory-server.md @@ -30,7 +30,7 @@ weight: 6 > [Redis Agent Memory](/content/integrate/google-adk/redis-agent-memory.md) > with `backend="redis-agent-memory"`, on > [Redis Cloud](/content/operate/rc/context-engine/agent-memory/_index.md) or -> [self-managed](/content/operate/iris/agent-memory/self-managed/_index.md) +> [self-managed](/content/operate/iris/self-managed/agent-memory/_index.md) > on your own Kubernetes cluster. > > This page exists only to help existing deployments migrate. @@ -62,8 +62,8 @@ for the server's own setup and reference material. ## Migrate to Redis Agent Memory 1. Provision a Redis Agent Memory store, on - [Redis Cloud](/content/operate/iris/agent-memory/create-service.md) - or [self-managed](/content/operate/iris/agent-memory/self-managed/_index.md). + [Redis Cloud](/content/operate/iris/cloud/agent-memory/create-service.md) + or [self-managed](/content/operate/iris/self-managed/agent-memory/_index.md). Either gives you a Data Plane endpoint, an API key, and a store ID. 2. Change `backend` from `opensource-agent-memory` to `redis-agent-memory` on every service and tool config, or drop the field, since it is the default. @@ -118,5 +118,5 @@ switches backends with `REDIS_MEMORY_BACKEND`, so it already runs on ## More info - [Redis Agent Memory](/content/integrate/google-adk/redis-agent-memory.md): the supported backend -- [Self-managed Agent Memory](/content/operate/iris/agent-memory/self-managed/_index.md): run Agent Memory on your own Kubernetes cluster +- [Self-managed Agent Memory](/content/operate/iris/self-managed/agent-memory/_index.md): run Agent Memory on your own Kubernetes cluster - [Agent Memory Server on GitHub](https://github.com/redis/agent-memory-server): the deprecated server's own documentation diff --git a/content/integrate/google-adk/redis-agent-memory.md b/content/integrate/google-adk/redis-agent-memory.md index acc1fa0ce0..f256d40a3d 100644 --- a/content/integrate/google-adk/redis-agent-memory.md +++ b/content/integrate/google-adk/redis-agent-memory.md @@ -31,8 +31,8 @@ not by changing `backend`: | Deployment | `api_base_url` | Setup | |------------|----------------|-------| -| Redis Cloud | Your Redis Cloud Agent Memory endpoint | [Create an Agent Memory service](/content/operate/iris/agent-memory/create-service.md) | -| Self-managed | Your own Data Plane URL | [Self-managed Agent Memory](/content/operate/iris/agent-memory/self-managed/_index.md) | +| Redis Cloud | Your Redis Cloud Agent Memory endpoint | [Create an Agent Memory service](/content/operate/iris/cloud/agent-memory/create-service.md) | +| Self-managed | Your own Data Plane URL | [Self-managed Agent Memory](/content/operate/iris/self-managed/agent-memory/_index.md) | > [!NOTE] > Running Agent Memory yourself does not mean using the deprecated @@ -248,6 +248,6 @@ Redis Cloud or self-managed; use the REST tools above. - [Integration patterns](/content/integrate/google-adk/integration-patterns.md): Detailed tradeoff comparison of the approaches - [managed_memory_quickstart](https://github.com/redis-developer/adk-redis/tree/main/examples/managed_memory_quickstart): Framework services, no Docker - [travel_agent_memory_tools](https://github.com/redis-developer/adk-redis/tree/main/examples/travel_agent_memory_tools): REST tools only -- [Self-managed Agent Memory](/content/operate/iris/agent-memory/self-managed/_index.md): run Agent Memory on your own Kubernetes cluster +- [Self-managed Agent Memory](/content/operate/iris/self-managed/agent-memory/_index.md): run Agent Memory on your own Kubernetes cluster - [Agent Memory Server (deprecated)](/content/integrate/google-adk/agent-memory-server.md): existing deployments and migration diff --git a/content/operate/_index.md b/content/operate/_index.md index 309596ba51..2a03a09832 100644 --- a/content/operate/_index.md +++ b/content/operate/_index.md @@ -83,8 +83,8 @@ Services available on cloud or self-managed infrastructure for AI applications.
  1. }}">Overview
    2. -
  2. }}">Enable Agent Memory
    3. -
  3. }}">Deploy Context Gateway
    4. +
  4. }}">Enable Agent Memory
    5. +
  5. }}">Deploy Context Gateway
  6. }}">Enable LangCache
diff --git a/content/operate/iris/_index.md b/content/operate/iris/_index.md index 056a8f3d2a..264a07c82f 100644 --- a/content/operate/iris/_index.md +++ b/content/operate/iris/_index.md @@ -1,6 +1,6 @@ --- title: Redis Iris context engine -description: Deploy and operate Redis Iris context engine services. +description: Run Redis Iris on Redis Cloud or on your own infrastructure, and provision its services with the iris CLI. linkTitle: Redis Iris context engine alwaysopen: false categories: @@ -11,34 +11,16 @@ hideListLinks: true weight: 45 --- -Redis Iris context engine provides managed and self-managed services for building AI applications with persistent memory, semantic caching, and governed access to business data. +Redis Iris runs as managed services on Redis Cloud or as a self-managed deployment on your own Kubernetes infrastructure. Your agents use the same `redis-iris` SDK and `IRIS_*` settings on either deployment. -Use this section to deploy, configure, and operate Redis Iris services. Developer guides and API integration documentation remain under [Develop with Redis]({{< relref "/develop/ai/context-engine" >}}). +Use this section to set up and operate Redis Iris. Developer guides and API references are under [Develop with Redis](/content/develop/ai/context-engine/_index.md).
- {{< tile-card icon="images/dev/icons/icon-redis-agent-memory-64-duotone.png" title="Redis Agent Memory" description="Create and manage a service on Redis Cloud or deploy it on your own infrastructure" url="/operate/iris/agent-memory" >}} - {{< tile-card icon="images/dev/icons/icon-redis-iris-64-duotone.png" title="Redis Context Gateway" description="Deploy one MCP endpoint for your agents' tools on your own infrastructure" url="/operate/iris/context-gateway" >}} - {{< tile-card icon="images/dev/icons/icon-redis-iris-64-duotone.png" title="Redis Intent Router" description="Deploy a service that classifies requests into intents on your own infrastructure" url="/operate/iris/intent-router" >}} + {{< tile-card icon="images/dev/icons/icon-redis-iris-64-duotone.png" title="Redis Iris on Redis Cloud" description="Create Iris services and their API keys in the Redis Cloud console" url="/operate/iris/cloud" >}} + {{< tile-card icon="images/dev/icons/icon-redis-iris-64-duotone.png" title="Self-managed Redis Iris" description="Deploy and operate Iris services on your own Kubernetes cluster" url="/operate/iris/self-managed" >}} + {{< tile-card icon="images/dev/icons/icon-redis-code-64-duotone.png" title="Operate Iris with the CLI" description="Provision services, mint agent keys, and check each hop from a terminal" url="/operate/iris/cli" >}}
-## Deployment options - -Redis Iris services are available as managed services on Redis Cloud. All Redis Iris services are also available for self-managed deployment. - -### Redis Cloud - -Create and manage Redis Iris services through the Redis Cloud console without deploying the supporting infrastructure yourself. - -- [Create a Redis Agent Memory service]({{< relref "/operate/iris/agent-memory/create-service" >}}) - -### Self-managed - -Deploy Redis Iris services on Kubernetes when you need to operate them on your own infrastructure. - -- [Self-managed Redis Agent Memory]({{< relref "/operate/iris/agent-memory/self-managed" >}}) -- [Self-managed Redis Context Gateway]({{< relref "/operate/iris/context-gateway/self-managed" >}}) -- [Self-managed Redis Intent Router]({{< relref "/operate/iris/intent-router/self-managed" >}}) - ## Agent Mesh SDK beta Agent Mesh provides Python SDK integrations for shared agent-to-agent task storage and resumable event delivery. Run it in your application with your own Redis connections. See the [Agent Mesh overview](/content/develop/ai/context-engine/agent-mesh/_index.md) and [quickstart](/content/develop/ai/context-engine/agent-mesh/quickstart.md). diff --git a/content/operate/iris/cli.md b/content/operate/iris/cli.md new file mode 100644 index 0000000000..a0d7763900 --- /dev/null +++ b/content/operate/iris/cli.md @@ -0,0 +1,63 @@ +--- +title: Operate Redis Iris with the CLI +description: Create Redis Iris services, mint agent keys, and check each hop with the iris command-line interface. +linkTitle: CLI +alwaysopen: false +categories: +- docs +- operate +- iris +hideListLinks: true +weight: 30 +--- + +The `iris` command-line interface (CLI) creates Redis Iris services on a self-managed deployment, mints the agent keys your applications use, writes their settings to an env file, and checks that each one works. It ships in the `redis-iris` package. On Redis Cloud, create services and keys in the [Redis Cloud console](/content/operate/iris/cloud/_index.md). + +## Install and connect + +```bash +pipx install redis-iris +iris --version +``` + +Point the CLI at your deployment with a profile in `iris.toml` and your operator tokens in environment variables. See [SDK and CLI setup](/content/develop/ai/context-engine/sdk-and-cli.md#set-up-on-a-self-managed-deployment) for the profile keys and token variables. + +## Provision services + +Each service group has the same provisioning commands: + +| Command | What it does | +|---|---| +| `service create` | Creates the service, mints its agent key, and writes the URL, ID, and key to the file you pass with `--write-env`. The key is never printed. | +| `service list`, `service show ID` | Lists the services, or shows one. | +| `service key ID --write PATH` | Mints another agent key and writes it to a file. | +| `service env ID --write PATH` | Writes the URL and ID of an existing service to an env file. | +| `service check ID` | Checks each hop, from the service to a read with the agent key, and stops at the first failure. | +| `service delete ID` | Deletes the service. It asks first unless you pass `--yes`. | + +The service groups are `agent-memory`, `agent-playbooks`, `context-gateway`, and `intent-router`. For example, to create an Agent Memory store, first do a dry run, which sends nothing and lists any missing setting, then create it and check it: + +```bash +iris agent-memory service create --name support-memory --dry-run +iris agent-memory service create --name support-memory --write-env .env +iris agent-memory service check "$IRIS_AGENT_MEMORY_STORE_ID" --env-file .env +``` + +Deleting a Context Gateway or an Agent Playbooks playbook never deletes what belongs to it: delete its Upstreams or extraction bindings first. + +## Manage agent keys + +`iris identity keys` lists, rotates, and revokes the agent keys of every service: + +```bash +iris identity keys list --product context-gateway --resource-id +iris identity keys rotate --env IRIS_CONTEXT_GATEWAY_API_KEY --write .env --grace 1h +iris identity keys revoke --product context-gateway --yes +``` + +`rotate` writes the new key to the file and keeps the old one working for the grace period. `revoke --product` refuses a key that also grants another service, because revoking deletes the whole key. + +## More information + +- [Self-managed Redis Iris](/content/operate/iris/self-managed/_index.md) +- [The `iris` CLI in the redis-iris README](https://github.com/redis/redis-iris#the-cli) diff --git a/content/operate/iris/cloud/_index.md b/content/operate/iris/cloud/_index.md new file mode 100644 index 0000000000..002ecf8ff1 --- /dev/null +++ b/content/operate/iris/cloud/_index.md @@ -0,0 +1,22 @@ +--- +title: Redis Iris on Redis Cloud +description: Create Redis Iris services and their API keys in the Redis Cloud console. +linkTitle: Redis Cloud +alwaysopen: false +categories: +- docs +- operate +- iris +hideListLinks: true +weight: 10 +--- + +On Redis Cloud, Redis runs the Iris services for you. You create each service in the Redis Cloud console, under **Iris** in the menu, on a Redis Cloud database you choose. You create the API keys your agents use in **Access & Identity**. + +After you create a service, copy its URL and ID into your agent's `IRIS_*` settings. See [SDK and CLI setup](/content/develop/ai/context-engine/sdk-and-cli.md#set-up-on-redis-cloud). + +## Services + +- [Redis Agent Memory](/content/operate/iris/cloud/agent-memory/_index.md): create a service, configure its AI models, and view and manage it. + + diff --git a/content/operate/iris/agent-memory/_index.md b/content/operate/iris/cloud/agent-memory/_index.md similarity index 62% rename from content/operate/iris/agent-memory/_index.md rename to content/operate/iris/cloud/agent-memory/_index.md index affa13b64d..16085df71f 100644 --- a/content/operate/iris/agent-memory/_index.md +++ b/content/operate/iris/cloud/agent-memory/_index.md @@ -1,6 +1,6 @@ --- -title: Redis Agent Memory -description: Deploy and operate Redis Agent Memory on Redis Cloud or your own infrastructure. +title: Redis Agent Memory on Redis Cloud +description: Create and manage Redis Agent Memory services in the Redis Cloud console. linkTitle: Agent Memory alwaysopen: false categories: @@ -9,6 +9,8 @@ categories: - iris weight: 10 hideListLinks: true +aliases: +- /operate/iris/agent-memory/ --- Redis Agent Memory provides persistent session memory and long-term memory for AI agents and applications. @@ -22,10 +24,10 @@ Redis Agent Memory provides persistent session memory and long-term memory for A Use Redis Agent Memory as a managed service on Redis Cloud. -[Create a Redis Agent Memory service]({{< relref "/operate/iris/agent-memory/create-service" >}}), [configure its AI models]({{< relref "/operate/iris/agent-memory/model-configuration" >}}), or [view and manage an existing service]({{< relref "/operate/iris/agent-memory/view-service" >}}). +[Create a Redis Agent Memory service]({{< relref "/operate/iris/cloud/agent-memory/create-service" >}}), [configure its AI models]({{< relref "/operate/iris/cloud/agent-memory/model-configuration" >}}), or [view and manage an existing service]({{< relref "/operate/iris/cloud/agent-memory/view-service" >}}). ### Self-managed Deploy, configure, secure, and operate Redis Agent Memory on your own Kubernetes infrastructure. -[Open the self-managed Redis Agent Memory documentation]({{< relref "/operate/iris/agent-memory/self-managed" >}}) +[Open the self-managed Redis Agent Memory documentation]({{< relref "/operate/iris/self-managed/agent-memory" >}}) diff --git a/content/operate/iris/agent-memory/create-service.md b/content/operate/iris/cloud/agent-memory/create-service.md similarity index 97% rename from content/operate/iris/agent-memory/create-service.md rename to content/operate/iris/cloud/agent-memory/create-service.md index ddad9d8b35..00e0dd043b 100644 --- a/content/operate/iris/agent-memory/create-service.md +++ b/content/operate/iris/cloud/agent-memory/create-service.md @@ -12,6 +12,7 @@ weight: 5 aliases: - /operate/rc/context-engine/agent-memory/create-service/ - /operate/rc/agent-memory/create-service/ +- /operate/iris/agent-memory/create-service/ --- Redis Agent Memory provides a persistent, structured memory layer that AI agents can use to store, retrieve, and manage contextual data across interactions. This guide walks you through creating and configuring an Agent Memory service in Redis Cloud. @@ -48,7 +49,7 @@ From here: > [!WARNING] > This is the only time the value of the user key is available. Save it to a secure location before closing the dialog box.

> - > If you lose the service key value, you will need to [generate a new service key]({{< relref "/operate/iris/agent-memory/view-service#replace-service-api-key" >}}) to be able to use the Agent Memory API. + > If you lose the service key value, you will need to [generate a new service key]({{< relref "/operate/iris/cloud/agent-memory/view-service#replace-service-api-key" >}}) to be able to use the Agent Memory API. After Redis Cloud creates your service, [continue with the quickstart]({{< relref "/develop/ai/context-engine/agent-memory/quickstart" >}}). @@ -112,7 +113,7 @@ LLM model options can change. Use the console to see the current choices; values ![The AI model and credentials section with Bring my own key selected. The section contains the provider, API key, LLM model, and embedding model settings.](/images/rc/agent-memory-ai-model-create.png) -The same provider key is used for both model types. The credential source, provider, and embedding model are fixed after you create the service. For configuration, key rotation, security, and troubleshooting guidance, see [Configure AI models for Agent Memory]({{< relref "/operate/iris/agent-memory/model-configuration" >}}). +The same provider key is used for both model types. The credential source, provider, and embedding model are fixed after you create the service. For configuration, key rotation, security, and troubleshooting guidance, see [Configure AI models for Agent Memory]({{< relref "/operate/iris/cloud/agent-memory/model-configuration" >}}). ### Memory types & extraction {#memory-types-and-extraction} @@ -235,7 +236,7 @@ A window containing your Agent Memory service key will appear. Select **Copy** t > [!WARNING] > This is the only time the value of the user key is available. Save it to a secure location before closing the dialog box.

> -> If you lose the service key value, you will need to [generate a new service key]({{< relref "/operate/iris/agent-memory/view-service#replace-service-api-key" >}}) to be able to use the Redis Agent Memory API. +> If you lose the service key value, you will need to [generate a new service key]({{< relref "/operate/iris/cloud/agent-memory/view-service#replace-service-api-key" >}}) to be able to use the Redis Agent Memory API. If an error occurs, verify that your database is active. For help, [contact support](https://redis.io/support/). @@ -245,4 +246,4 @@ After Redis Cloud creates your service, [continue with the quickstart]({{< relre To generate a conversational agent that connects to your service, open the [AI agent builder]({{< relref "/develop/ai/agent-builder" >}}) and select **Redis Iris Conversational Assistant**. -You can also [view and edit the service]({{< relref "/operate/iris/agent-memory/view-service" >}}). +You can also [view and edit the service]({{< relref "/operate/iris/cloud/agent-memory/view-service" >}}). diff --git a/content/operate/iris/agent-memory/model-configuration.md b/content/operate/iris/cloud/agent-memory/model-configuration.md similarity index 98% rename from content/operate/iris/agent-memory/model-configuration.md rename to content/operate/iris/cloud/agent-memory/model-configuration.md index 82dbd0c192..02731c0911 100644 --- a/content/operate/iris/agent-memory/model-configuration.md +++ b/content/operate/iris/cloud/agent-memory/model-configuration.md @@ -9,6 +9,8 @@ hideListLinks: true linktitle: Configure AI models title: Configure AI models for Agent Memory weight: 10 +aliases: +- /operate/iris/agent-memory/model-configuration/ --- You can use Redis-managed credentials for the AI models used by an Agent Memory service, or bring your own model provider API key. @@ -47,7 +49,7 @@ Before you use your own key, make sure: To configure your own model provider key: -1. Start the [custom service creation flow]({{< relref "/operate/iris/agent-memory/create-service" >}}). +1. Start the [custom service creation flow]({{< relref "/operate/iris/cloud/agent-memory/create-service" >}}). 1. In **AI model and credentials (optional)**, select **Bring my own key**. diff --git a/content/operate/iris/agent-memory/view-service.md b/content/operate/iris/cloud/agent-memory/view-service.md similarity index 94% rename from content/operate/iris/agent-memory/view-service.md rename to content/operate/iris/cloud/agent-memory/view-service.md index 3b8b09d2a7..4115f9fbaa 100644 --- a/content/operate/iris/agent-memory/view-service.md +++ b/content/operate/iris/cloud/agent-memory/view-service.md @@ -12,9 +12,10 @@ weight: 15 aliases: - /operate/rc/context-engine/agent-memory/view-service/ - /operate/rc/agent-memory/view-service/ +- /operate/iris/agent-memory/view-service/ --- -After you have [created your first Agent Memory service]({{< relref "/operate/iris/agent-memory/create-service" >}}), selecting **Agent Memory** from the Redis Cloud Console menu will take you to the **Agent Memory Services** page. +After you have [created your first Agent Memory service]({{< relref "/operate/iris/cloud/agent-memory/create-service" >}}), selecting **Agent Memory** from the Redis Cloud Console menu will take you to the **Agent Memory Services** page. This page displays a list of all Agent Memory services associated with your account. @@ -75,11 +76,11 @@ Provider and model values shown in the screenshot are examples. ![The AI model and credentials section for an existing service. It shows the provider, embedding model, LLM model, and a User-managed API key status.](/images/rc/agent-memory-ai-model-details.png) -The provider and embedding model are read-only. You can change the LLM model or replace the provider key. For update steps, key rotation behavior, security, and troubleshooting guidance, see [Configure AI models for Agent Memory]({{< relref "/operate/iris/agent-memory/model-configuration" >}}). +The provider and embedding model are read-only. You can change the LLM model or replace the provider key. For update steps, key rotation behavior, security, and troubleshooting guidance, see [Configure AI models for Agent Memory]({{< relref "/operate/iris/cloud/agent-memory/model-configuration" >}}). ### Memory types & extraction {#memory-types-and-extraction} -The **Memory types & extraction** section shows any [custom memory types]({{< relref "/operate/iris/agent-memory/create-service#custom-memory-types" >}}) defined for the service, each listed with its name, fields, and extraction strategy. +The **Memory types & extraction** section shows any [custom memory types]({{< relref "/operate/iris/cloud/agent-memory/create-service#custom-memory-types" >}}) defined for the service, each listed with its name, fields, and extraction strategy. ![The Memory types & extraction section for the Agent Memory service.](/images/rc/agent-memory-view-memory-types.png) @@ -98,7 +99,7 @@ To change a custom memory type's name or fields, you must create a new service. ### Sensitive-data exclusions {#sensitive-data-exclusions} -The **Sensitive-data exclusions** section shows the [sensitive-data exclusions]({{< relref "/operate/iris/agent-memory/create-service#sensitive-data-exclusions" >}}) configured for the service. +The **Sensitive-data exclusions** section shows the [sensitive-data exclusions]({{< relref "/operate/iris/cloud/agent-memory/create-service#sensitive-data-exclusions" >}}) configured for the service. ![The Sensitive-data exclusions section for the Agent Memory service.](/images/rc/agent-memory-view-sensitive-data-exclusions.png) diff --git a/content/operate/iris/context-gateway/_index.md b/content/operate/iris/context-gateway/_index.md deleted file mode 100644 index 23ddffa213..0000000000 --- a/content/operate/iris/context-gateway/_index.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -title: Redis Context Gateway -description: Deploy and operate Redis Context Gateway on your own infrastructure. -linkTitle: Context Gateway -alwaysopen: false -categories: -- docs -- operate -- iris -weight: 22 -hideListLinks: true -aliases: -- /operate/iris/context-retriever/ -- /operate/iris/context-retriever/create-service/ -- /operate/iris/context-retriever/view-service/ -- /operate/iris/context-retriever/view-admin-keys/ -- /operate/rc/context-engine/context-retriever/ ---- - -Deploy Redis Context Gateway on Kubernetes to give agents one Model Context Protocol (MCP) endpoint for the tools of any MCP server, plus tools over your Redis data. - -## Self-managed - -[Start with the self-managed deployment guide](/content/operate/iris/context-gateway/self-managed/_index.md). - -After setup, use the [developer quickstart](/content/develop/ai/context-engine/context-gateway/quickstart.md) to list and call your first tools. The [developer guides](/content/develop/ai/context-engine/context-gateway/_index.md) cover Upstream registration, tool policies, and agent integration. diff --git a/content/operate/iris/intent-router/_index.md b/content/operate/iris/intent-router/_index.md deleted file mode 100644 index 2f6d370274..0000000000 --- a/content/operate/iris/intent-router/_index.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: Redis Intent Router -description: Deploy and operate Redis Intent Router on your own infrastructure. -linkTitle: Intent Router -alwaysopen: false -categories: -- docs -- operate -- iris -weight: 24 -hideListLinks: true ---- - -Deploy Redis Intent Router on Kubernetes to give applications a service that classifies text into intents and returns the target to dispatch to. - -## Self-managed - -[Start with the self-managed deployment guide](/content/operate/iris/intent-router/self-managed/_index.md). - -After setup, use the [developer quickstart](/content/develop/ai/context-engine/intent-router/quickstart.md) to define your first intents and match queries. The [developer guides](/content/develop/ai/context-engine/intent-router/_index.md) cover Router administration, intent authoring, and matching. diff --git a/content/operate/iris/langcache/_index.md b/content/operate/iris/langcache/_index.md index 7b5180a1e4..f584f7e401 100644 --- a/content/operate/iris/langcache/_index.md +++ b/content/operate/iris/langcache/_index.md @@ -8,7 +8,7 @@ description: Store LLM responses for AI applications in Redis Cloud. hideListLinks: true linktitle: LangCache title: Semantic caching with LangCache on Redis Cloud -weight: 30 +weight: 40 bannerText: LangCache on Redis Cloud is currently available as a public preview. Features and behavior are subject to change. bannerChildren: true aliases: diff --git a/content/operate/iris/self-managed/_index.md b/content/operate/iris/self-managed/_index.md new file mode 100644 index 0000000000..4d345d694a --- /dev/null +++ b/content/operate/iris/self-managed/_index.md @@ -0,0 +1,35 @@ +--- +title: Self-managed Redis Iris +description: Deploy and operate Redis Iris services on your own Kubernetes cluster. +linkTitle: Self-managed +alwaysopen: false +categories: +- docs +- operate +- iris +hideListLinks: true +weight: 20 +--- + +A self-managed Redis Iris deployment runs the Iris services on your own Kubernetes cluster, with Redis databases you provide. Each service needs a license key from Redis. Contact your Redis representative or [contact sales](https://redis.io/contact/). + +## Deploy Redis Iris + + + +Deploy each service with its own Helm chart, as its guide describes. + +## Shared components + +- **Identity Service.** It issues and checks the agent keys that applications use to call each service. Each service guide covers connecting to it. The [Agent Memory guide](/content/operate/iris/self-managed/agent-memory/_index.md) also covers installing the `iris-identity-service` chart as its own release. +- **Redis Iris UI and single sign-on (SSO).** Operator guides for the UI and SSO aren't published yet. + +## Services + +- [Redis Agent Memory](/content/operate/iris/self-managed/agent-memory/_index.md) +- [Redis Context Gateway](/content/operate/iris/self-managed/context-gateway/_index.md) +- [Redis Intent Router](/content/operate/iris/self-managed/intent-router/_index.md) + + + +To create services and agent keys from a terminal after you deploy, use the [iris CLI](/content/operate/iris/cli.md). diff --git a/content/operate/iris/agent-memory/self-managed/_index.md b/content/operate/iris/self-managed/agent-memory/_index.md similarity index 93% rename from content/operate/iris/agent-memory/self-managed/_index.md rename to content/operate/iris/self-managed/agent-memory/_index.md index fc9196351f..e6086a37c1 100644 --- a/content/operate/iris/agent-memory/self-managed/_index.md +++ b/content/operate/iris/self-managed/agent-memory/_index.md @@ -6,13 +6,14 @@ categories: - operate - iris description: Deploy, configure, secure, and operate Redis Agent Memory on a self-managed Kubernetes cluster. -linkTitle: Self-managed -weight: 40 +linkTitle: Agent Memory +weight: 10 hideListLinks: true bannerText: A license key is required to deploy. Contact your Redis representative or [contact sales](https://redis.io/contact/). bannerChildren: true aliases: - /develop/ai/context-engine/agent-memory/self-managed/ +- /operate/iris/agent-memory/self-managed/ --- Redis Agent Memory provides persistent memory for AI agents and @@ -21,12 +22,12 @@ Redis Agent Memory, then query Redis Agent Memory for relevant context before ca This guide covers deployment, configuration, security, validation, API examples, and operations for self-managed Redis Agent Memory. To install, start with -[Prerequisites](/content/operate/iris/agent-memory/self-managed/prerequisites.md), then follow -[Deploy](/content/operate/iris/agent-memory/self-managed/deploy.md). +[Prerequisites](/content/operate/iris/self-managed/agent-memory/prerequisites.md), then follow +[Deploy](/content/operate/iris/self-managed/agent-memory/deploy.md). The [Redis Agent Memory API]({{< relref "/develop/ai/context-engine/agent-memory/api-reference" >}}) is the shared Data Plane API for Redis Cloud and self-managed deployments. The -[Control Plane API reference]({{< relref "/operate/iris/agent-memory/self-managed/control-plane-api-reference" >}}) +[Control Plane API reference]({{< relref "/operate/iris/self-managed/agent-memory/control-plane-api-reference" >}}) documents the self-managed admin endpoints for stores. ## What you are deploying @@ -34,7 +35,7 @@ documents the self-managed admin endpoints for stores. The `redis-agent-memory` chart `0.10.2` deploys the Data Plane, workers, and Control Plane. Install the `iris-identity-service` chart `0.10.2` as a separate release first, then connect Memory to it. Memory does not deploy Identity Service resources or include it as a subchart. -You provide the Redis databases. Follow [Deploy](/content/operate/iris/agent-memory/self-managed/deploy.md) +You provide the Redis databases. Follow [Deploy](/content/operate/iris/self-managed/agent-memory/deploy.md) to configure both releases. | Component | Purpose | Default service | diff --git a/content/operate/iris/agent-memory/self-managed/api-examples.md b/content/operate/iris/self-managed/agent-memory/api-examples.md similarity index 98% rename from content/operate/iris/agent-memory/self-managed/api-examples.md rename to content/operate/iris/self-managed/agent-memory/api-examples.md index 1db3e8012d..11a991edad 100644 --- a/content/operate/iris/agent-memory/self-managed/api-examples.md +++ b/content/operate/iris/self-managed/agent-memory/api-examples.md @@ -11,17 +11,18 @@ weight: 70 hideListLinks: true aliases: - /develop/ai/context-engine/agent-memory/self-managed/api-examples/ +- /operate/iris/agent-memory/self-managed/api-examples/ --- These examples show self-managed Control Plane, Identity Service, and Data Plane requests. They assume either an auth-disabled private Data Plane or agent-key auth -configured as described in [Authentication and authorization]({{< relref "/operate/iris/agent-memory/self-managed/authentication" >}}). +configured as described in [Authentication and authorization]({{< relref "/operate/iris/self-managed/agent-memory/authentication" >}}). For the complete shared Data Plane schema, see the [Redis Agent Memory API]({{< relref "/develop/ai/context-engine/agent-memory/api-reference" >}}). For the self-managed admin schema, see the -[Control Plane API reference]({{< relref "/operate/iris/agent-memory/self-managed/control-plane-api-reference" >}}). +[Control Plane API reference]({{< relref "/operate/iris/self-managed/agent-memory/control-plane-api-reference" >}}). ## Control Plane API examples @@ -217,11 +218,11 @@ If omitted, the Control Plane token is read from `AGENT_MEMORY_SERVICE_TOKEN`; i Store and extractor management, detectors, and memory-type reference data have Cloud and self-managed API implementations. The generated client also includes Cloud-only account database, end user license agreement (EULA), network, store-model, metrics, flush, and empty-store operations; those return `404` on-prem. The current Cloud Control Plane does not accept a programmatic credential for this SDK. Use the Cloud console for Cloud service setup rather than sending a Data Plane key or assuming a console session is a service token. -See [Create an extractor](#create-an-extractor) for extractor administration and the [self-managed Control Plane reference](/content/operate/iris/agent-memory/self-managed/control-plane-api-reference.md) for the admin REST API. Webhook-policy configuration uses the admin REST API; it is not a method on the current service SDK. +See [Create an extractor](#create-an-extractor) for extractor administration and the [self-managed Control Plane reference](/content/operate/iris/self-managed/agent-memory/control-plane-api-reference.md) for the admin REST API. Webhook-policy configuration uses the admin REST API; it is not a method on the current service SDK. ## Create an extractor -For model and processing settings, see [Configure document ingestion](/content/operate/iris/agent-memory/self-managed/configuration.md#enable-document-ingestion). Set `AGENT_MEMORY_CONTROL_PLANE_URL`, `AGENT_MEMORY_SERVICE_TOKEN`, and `STORE_ID` as described in [Manage a service with the Control Plane SDK](#manage-a-service-with-the-control-plane-sdk). +For model and processing settings, see [Configure document ingestion](/content/operate/iris/self-managed/agent-memory/configuration.md#enable-document-ingestion). Set `AGENT_MEMORY_CONTROL_PLANE_URL`, `AGENT_MEMORY_SERVICE_TOKEN`, and `STORE_ID` as described in [Manage a service with the Control Plane SDK](#manage-a-service-with-the-control-plane-sdk). First register a custom memory type on the store. For a new `document_fact` type, run this once: @@ -306,7 +307,7 @@ After setup, applications can [submit and track documents](/content/develop/ai/c ## Configure a webhook policy -First [enable ingestion webhooks](/content/operate/iris/agent-memory/self-managed/configuration.md#enable-ingestion-webhooks). Use the self-managed Control Plane REST API and an operator credential. The Data Plane SDKs expose status reads; `AgentMemoryService` does not currently expose hook-policy management. Set `AGENT_MEMORY_CONTROL_PLANE_URL`, `AGENT_MEMORY_SERVICE_TOKEN`, `STORE_ID`, and `HOOK_URL`. For the receiver example, use `https://:8443/hook`, or the HTTPS ingress URL that forwards to it. +First [enable ingestion webhooks](/content/operate/iris/self-managed/agent-memory/configuration.md#enable-ingestion-webhooks). Use the self-managed Control Plane REST API and an operator credential. The Data Plane SDKs expose status reads; `AgentMemoryService` does not currently expose hook-policy management. Set `AGENT_MEMORY_CONTROL_PLANE_URL`, `AGENT_MEMORY_SERVICE_TOKEN`, `STORE_ID`, and `HOOK_URL`. For the receiver example, use `https://:8443/hook`, or the HTTPS ingress URL that forwards to it. A policy PUT replaces the whole policy. Include every phase you want to retain; omitting a phase removes it. Read the current revision before writing: @@ -481,7 +482,7 @@ OWNER_ID="" USER_TOKEN="" ``` -With ownership enforcement enabled, [configure delegation](/content/operate/iris/agent-memory/self-managed/authentication.md#delegate-a-user-with-an-agent-key), set `USER_TOKEN` to the user's access token, and set `OWNER_ID` to its verified user ID. If enforcement is disabled, unset `USER_TOKEN` and enforce access in your backend. For auth-disabled deployments, also omit `Authorization` and rely on the deployment's hosting controls. +With ownership enforcement enabled, [configure delegation](/content/operate/iris/self-managed/agent-memory/authentication.md#delegate-a-user-with-an-agent-key), set `USER_TOKEN` to the user's access token, and set `OWNER_ID` to its verified user ID. If enforcement is disabled, unset `USER_TOKEN` and enforce access in your backend. For auth-disabled deployments, also omit `Authorization` and rely on the deployment's hosting controls. ### Write a session event diff --git a/content/operate/iris/agent-memory/self-managed/authentication.md b/content/operate/iris/self-managed/agent-memory/authentication.md similarity index 97% rename from content/operate/iris/agent-memory/self-managed/authentication.md rename to content/operate/iris/self-managed/agent-memory/authentication.md index 75d3fe2c7d..5752ae9bd8 100644 --- a/content/operate/iris/agent-memory/self-managed/authentication.md +++ b/content/operate/iris/self-managed/agent-memory/authentication.md @@ -11,6 +11,7 @@ weight: 60 hideListLinks: true aliases: - /develop/ai/context-engine/agent-memory/self-managed/authentication/ +- /operate/iris/agent-memory/self-managed/authentication/ --- Self-managed Redis Agent Memory uses separate authentication models for the Control @@ -33,7 +34,7 @@ grants. Generated token Secrets are retained across upgrades and uninstalls (`helm.sh/resource-policy: keep`). Use existing Secrets for shared credentials and for reproducible deployment automation. Secret names and keys must agree between releases. See -[Secret rotation](/content/operate/iris/agent-memory/self-managed/operations.md#secret-rotation). +[Secret rotation](/content/operate/iris/self-managed/agent-memory/operations.md#secret-rotation). ## Control Plane admin token @@ -63,14 +64,14 @@ The Data Plane defaults to agent-key authentication whenever no auth method is s ### Agent-key authentication -The [`deploy` walkthrough](/content/operate/iris/agent-memory/self-managed/deploy.md) uses agent-key +The [`deploy` walkthrough](/content/operate/iris/self-managed/agent-memory/deploy.md) uses agent-key authentication from the start. In the chart-rendered configuration, the chart writes the agent-key introspection settings from `dataplane.identityServiceBaseURL` and `identityService.credential`. These must point to the standalone release and its registered `memory-dp` credential. A bring-your-own (BYO) Data Plane configuration needs the `auth.agent_keys.introspection` block, including a BYO configuration without `auth`. See -[Bring-your-own (BYO) configuration](/content/operate/iris/agent-memory/self-managed/configuration.md#bring-your-own-byo-configuration). +[Bring-your-own (BYO) configuration](/content/operate/iris/self-managed/agent-memory/configuration.md#bring-your-own-byo-configuration). The `MEM_AUTH_METHOD` environment variable overrides the method. Clients send agent keys as Bearer credentials: @@ -326,9 +327,9 @@ Disabling enforcement restores store-wide access within the credential's grants. Redis Agent Memory workers consume background jobs and call the Data Plane to read session events and write extracted long-term memories. -The [`deploy` values](/content/operate/iris/agent-memory/self-managed/deploy.md#3-create-ram-valuesyaml) +The [`deploy` values](/content/operate/iris/self-managed/agent-memory/deploy.md#3-create-ram-valuesyaml) already enable worker callbacks. Each platform also needs the setup in -[Prepare worker identity for your platform](/content/operate/iris/agent-memory/self-managed/deploy.md#prepare-worker-identity-for-your-platform). +[Prepare worker identity for your platform](/content/operate/iris/self-managed/agent-memory/deploy.md#prepare-worker-identity-for-your-platform). For deployments where Redis Agent Memory Data Plane auth is enabled, workers should authenticate with Kubernetes projected service-account tokens. The Helm diff --git a/content/operate/iris/agent-memory/self-managed/configuration.md b/content/operate/iris/self-managed/agent-memory/configuration.md similarity index 96% rename from content/operate/iris/agent-memory/self-managed/configuration.md rename to content/operate/iris/self-managed/agent-memory/configuration.md index a3b152a2b5..8bec6a19da 100644 --- a/content/operate/iris/agent-memory/self-managed/configuration.md +++ b/content/operate/iris/self-managed/agent-memory/configuration.md @@ -12,12 +12,13 @@ hideListLinks: true aliases: - /develop/ai/context-engine/agent-memory/self-managed/data-plane-configuration/ - /operate/iris/agent-memory/self-managed/data-plane-configuration/ +- /operate/iris/agent-memory/self-managed/configuration/ --- The Memory chart renders Data Plane and Control Plane configuration from Helm values (`config.render: true` and `controlplane.config.render: true`). Identity Service uses its own release and `values-ids.yaml`. Credentials stay in existing Secrets. For a complete -example, see the values in [step 3 of Deploy](/content/operate/iris/agent-memory/self-managed/deploy.md#3-create-ram-valuesyaml). +example, see the values in [step 3 of Deploy](/content/operate/iris/self-managed/agent-memory/deploy.md#3-create-ram-valuesyaml). To supply complete configuration files in your own Secrets instead, see [Bring-your-own (BYO) configuration](#bring-your-own-byo-configuration). @@ -43,7 +44,7 @@ Data Plane settings go under `memory`, or at the top level of a BYO Data Plane c | `databases` | Required. Store Redis, as `databases."1".urls`. | | `embedding.models.default_embedding_model`, `embedding.models.dimensions` | Required. The embedding model and its vector size. The Control Plane's `embedding.dimensions` must match. | | `auth` | Data Plane authentication. Defaults to `agent_key`. | -| `ownership.enabled` | Restricts personal records to their authenticated owner while allowing shared records. Defaults to `true` in on-prem release 0.10.2. Requires a matching authenticated user ID for personal access; use an agent key with a delegated user token, or explicitly disable enforcement and authorize requests in your backend. See [Server-side ownership enforcement](/content/operate/iris/agent-memory/self-managed/authentication.md#server-side-ownership-enforcement) before enabling it. | +| `ownership.enabled` | Restricts personal records to their authenticated owner while allowing shared records. Defaults to `true` in on-prem release 0.10.2. Requires a matching authenticated user ID for personal access; use an agent key with a delegated user token, or explicitly disable enforcement and authorize requests in your backend. See [Server-side ownership enforcement](/content/operate/iris/self-managed/agent-memory/authentication.md#server-side-ownership-enforcement) before enabling it. | | `inference_providers` | Required when any `llm` block is set. Each entry holds a provider's `endpoint`. | | `server` | Data Plane bind address and port. | | `license.license_path` | Path where the license Secret is mounted. | @@ -194,7 +195,7 @@ promote_session_memory: The `auth.worker_identity` and `dataplane_client.auth` settings let workers call the Data Plane under agent-key authentication. They need `workerAuth.enabled: true` in the values, and the platform -setup in [worker identity](/content/operate/iris/agent-memory/self-managed/deploy.md#prepare-worker-identity-for-your-platform). +setup in [worker identity](/content/operate/iris/self-managed/agent-memory/deploy.md#prepare-worker-identity-for-your-platform). Create the Data Plane config Secret with the key `memory-dataplane.config.yaml`: @@ -275,7 +276,7 @@ for the two connection URLs. With a naming override, use the rendered Service na Pods can mount Secrets only from their own namespace. Provision the same runtime credential and internal token values in both namespaces, plus each namespace's trust bundle. Allow Memory to reach Identity Service and Identity Service to reach the Control Plane, including any -TLS proxies. See [Network policy](/content/operate/iris/agent-memory/self-managed/operations.md#network-policy). +TLS proxies. See [Network policy](/content/operate/iris/self-managed/agent-memory/operations.md#network-policy). ## Optional Agent Playbooks extraction @@ -390,12 +391,12 @@ Each view retains its source-access policy. Replace existing definitions when ch ## Enable ingestion webhooks -Start with the [self-managed deployment](/content/operate/iris/agent-memory/self-managed/deploy.md). These are process settings; a client cannot enable them through a request header. +Start with the [self-managed deployment](/content/operate/iris/self-managed/agent-memory/deploy.md). These are process settings; a client cannot enable them through a request header. An operator must configure both Data Plane servers and workers: 1. Enable `memory.webhooks.enabled` in chart-rendered configuration, or `webhooks.enabled` at the root of a bring-your-own file. -1. Enable the Redis job backend and [authenticated worker callbacks](/content/operate/iris/agent-memory/self-managed/authentication.md#worker-callbacks). +1. Enable the Redis job backend and [authenticated worker callbacks](/content/operate/iris/self-managed/agent-memory/authentication.md#worker-callbacks). 1. Configure the same signing-secret backend and prefix in the Control Plane, Data Plane, and worker. Supported backends are Vault and AWS Secrets Manager. The Control Plane writes keys; Data Plane processes read them. 1. Serve the receiver over HTTPS with a certificate trusted by the Data Plane. 1. For a private receiver address, allow its range in `memory.webhooks.private_cidrs` on both servers and workers. @@ -429,7 +430,7 @@ Before enabling output hooks on an existing deployment, upgrade workers first, t For Active-Active backing databases, route every server and worker for a store through the same authoritative writer connection. Do not mix member addresses or use region-dependent aliases for that connection. Before changing writers, drain old writers, wait for replication, and restart the processes to clear old connections. A store with hook history fails closed if its persisted writer connection is missing or invalid; regional queue ownership does not make independent writers safe. -Then [configure a store policy](/content/operate/iris/agent-memory/self-managed/api-examples.md#configure-a-webhook-policy) and deploy a [callback receiver](/content/develop/ai/context-engine/agent-memory/ingestion-webhooks.md#verify-callbacks-and-return-decisions). +Then [configure a store policy](/content/operate/iris/self-managed/agent-memory/api-examples.md#configure-a-webhook-policy) and deploy a [callback receiver](/content/develop/ai/context-engine/agent-memory/ingestion-webhooks.md#verify-callbacks-and-return-decisions). ## Configure namespace routing {#enable-namespace-routing} diff --git a/content/operate/iris/agent-memory/self-managed/control-plane-api-reference.md b/content/operate/iris/self-managed/agent-memory/control-plane-api-reference.md similarity index 82% rename from content/operate/iris/agent-memory/self-managed/control-plane-api-reference.md rename to content/operate/iris/self-managed/agent-memory/control-plane-api-reference.md index c8e986bf93..f7c2206ef1 100644 --- a/content/operate/iris/agent-memory/self-managed/control-plane-api-reference.md +++ b/content/operate/iris/self-managed/agent-memory/control-plane-api-reference.md @@ -6,6 +6,7 @@ type: page weight: 80 aliases: - /develop/ai/context-engine/agent-memory/self-managed/control-plane-api-reference/ +- /operate/iris/agent-memory/self-managed/control-plane-api-reference/ params: sourcefile: ./openapi-control-plane.json sortOperationsAlphabetically: false diff --git a/content/operate/iris/agent-memory/self-managed/control-plane-api-reference/openapi-control-plane.json b/content/operate/iris/self-managed/agent-memory/control-plane-api-reference/openapi-control-plane.json similarity index 100% rename from content/operate/iris/agent-memory/self-managed/control-plane-api-reference/openapi-control-plane.json rename to content/operate/iris/self-managed/agent-memory/control-plane-api-reference/openapi-control-plane.json diff --git a/content/operate/iris/agent-memory/self-managed/deploy.md b/content/operate/iris/self-managed/agent-memory/deploy.md similarity index 97% rename from content/operate/iris/agent-memory/self-managed/deploy.md rename to content/operate/iris/self-managed/agent-memory/deploy.md index 869baf3976..56d522c56f 100644 --- a/content/operate/iris/agent-memory/self-managed/deploy.md +++ b/content/operate/iris/self-managed/agent-memory/deploy.md @@ -16,6 +16,7 @@ aliases: - /develop/ai/context-engine/agent-memory/self-managed/install-k8s/ - /develop/ai/context-engine/agent-memory/self-managed/deploy-static/ - /operate/iris/agent-memory/self-managed/deploy-static/ +- /operate/iris/agent-memory/self-managed/deploy/ --- These steps install Redis Agent Memory with chart-rendered configuration and agent-key @@ -24,7 +25,7 @@ authentication, and end with one authenticated call to the Data Plane. Install Identity Service as release `ids`, then Memory as release `redis-agent-memory`. These steps use Memory chart `0.10.2` and Identity Service chart `0.10.2` in one namespace. You create the shared credentials and Identity Service control token; Memory generates its -Control Plane admin token. See [Credentials](/content/operate/iris/agent-memory/self-managed/authentication.md#credentials). +Control Plane admin token. See [Credentials](/content/operate/iris/self-managed/agent-memory/authentication.md#credentials). Before installing, provide two Transport Layer Security (TLS) endpoints through your hosting environment: one forwarding to `ids-iris-identity-service:9200`, and one forwarding to @@ -33,9 +34,9 @@ placeholders with addresses reachable from the calling pods. Obtain their certif (CA) certificates as a PEM bundle named `service-ca.crt`; use your organization's trust bundle if the endpoints use public certificates. -Ownership enforcement is on by default. Before using an agent key with personal memories, [configure delegated user identity](/content/operate/iris/agent-memory/self-managed/authentication.md#delegate-a-user-with-an-agent-key). Applications that authorize users entirely in their backend must explicitly disable ownership enforcement in their Helm values. +Ownership enforcement is on by default. Before using an agent key with personal memories, [configure delegated user identity](/content/operate/iris/self-managed/agent-memory/authentication.md#delegate-a-user-with-an-agent-key). Applications that authorize users entirely in their backend must explicitly disable ownership enforcement in their Helm values. -Before you begin, review the [prerequisites](/content/operate/iris/agent-memory/self-managed/prerequisites.md). +Before you begin, review the [prerequisites](/content/operate/iris/self-managed/agent-memory/prerequisites.md). ### Isolated lab without TLS @@ -479,7 +480,7 @@ curl --fail-with-body -sS "http://localhost:9000/iris/data/v1/agent-memory/store -H "Authorization: Bearer " ``` -Check that the store and its memory features are healthy. This verifies the agent key's store access without requiring a user identity. To write personal data, follow the [Data Plane examples](/content/operate/iris/agent-memory/self-managed/api-examples.md#data-plane-api-examples), including delegated user setup. +Check that the store and its memory features are healthy. This verifies the agent key's store access without requiring a user identity. To write personal data, follow the [Data Plane examples](/content/operate/iris/self-managed/agent-memory/api-examples.md#data-plane-api-examples), including delegated user setup. ## Evaluate locally @@ -608,7 +609,7 @@ background_jobs: If Memory is already installed, update the `ram-secrets` Secret from this file, upgrade with the edited values, and restart the Data Plane, workers, and Control Plane so they reload the -overlay. See [Secret rotation](/content/operate/iris/agent-memory/self-managed/operations.md#secret-rotation). +overlay. See [Secret rotation](/content/operate/iris/self-managed/agent-memory/operations.md#secret-rotation). Use this provider switch only in a disposable evaluation installation. Changing the settings does not migrate existing stores or their vector indexes. After switching, create a new store @@ -617,5 +618,5 @@ embedding dimensions and cannot be reused with this example. ## Next steps -- [API examples](/content/operate/iris/agent-memory/self-managed/api-examples.md) for the full API. -- [Operations](/content/operate/iris/agent-memory/self-managed/operations.md) for key rotation. +- [API examples](/content/operate/iris/self-managed/agent-memory/api-examples.md) for the full API. +- [Operations](/content/operate/iris/self-managed/agent-memory/operations.md) for key rotation. diff --git a/content/operate/iris/agent-memory/self-managed/operations.md b/content/operate/iris/self-managed/agent-memory/operations.md similarity index 98% rename from content/operate/iris/agent-memory/self-managed/operations.md rename to content/operate/iris/self-managed/agent-memory/operations.md index ee6380f736..22daa3160e 100644 --- a/content/operate/iris/agent-memory/self-managed/operations.md +++ b/content/operate/iris/self-managed/agent-memory/operations.md @@ -11,6 +11,7 @@ weight: 90 hideListLinks: true aliases: - /develop/ai/context-engine/agent-memory/self-managed/operations/ +- /operate/iris/agent-memory/self-managed/operations/ --- ## Backups @@ -32,7 +33,7 @@ aliases: ## Secret rotation -Use the [Identity Service port-forward and control token](/content/operate/iris/agent-memory/self-managed/deploy.md#7-mint-an-agent-key) +Use the [Identity Service port-forward and control token](/content/operate/iris/self-managed/agent-memory/deploy.md#7-mint-an-agent-key) from the deployment procedure to rotate agent keys: ```bash @@ -50,7 +51,7 @@ which defaults to 3600 and has a chart maximum of 604800 (`apiKeys.maxRotateGraceSeconds` on the Identity Service release). The response adds `oldExpiresAt`, the time the old key stops working. Revoking the old `keyId` ends its grace period early. For the full request and response, see -[API examples](/content/operate/iris/agent-memory/self-managed/api-examples.md#identity-service-api-examples). +[API examples](/content/operate/iris/self-managed/agent-memory/api-examples.md#identity-service-api-examples). Rotate the Control Plane admin token by updating `redis-agent-memory-controlplane-admin-token`. The Control Plane reads the token on use, so changing the token value does not diff --git a/content/operate/iris/agent-memory/self-managed/prerequisites.md b/content/operate/iris/self-managed/agent-memory/prerequisites.md similarity index 94% rename from content/operate/iris/agent-memory/self-managed/prerequisites.md rename to content/operate/iris/self-managed/agent-memory/prerequisites.md index 1f3323f2a2..b23e4d1894 100644 --- a/content/operate/iris/agent-memory/self-managed/prerequisites.md +++ b/content/operate/iris/self-managed/agent-memory/prerequisites.md @@ -13,6 +13,7 @@ aliases: - /develop/ai/context-engine/agent-memory/self-managed/prerequisites/ - /develop/ai/context-engine/agent-memory/self-managed/plan-deployment/ - /operate/iris/agent-memory/self-managed/plan-deployment/ +- /operate/iris/agent-memory/self-managed/prerequisites/ --- Redis Agent Memory is distributed as container images on Docker Hub plus a Helm @@ -85,7 +86,7 @@ TLS where required. In FIPS-oriented deployments, Redis URLs covered by the posture must use `rediss://`. The Identity Service and Control Plane also need `https://` endpoints that your hosting environment provides. See -[FIPS-oriented posture](/content/operate/iris/agent-memory/self-managed/operations.md#fips-oriented-posture). Avoid eviction of metadata keys. Losing Metadata Redis removes Control +[FIPS-oriented posture](/content/operate/iris/self-managed/agent-memory/operations.md#fips-oriented-posture). Avoid eviction of metadata keys. Losing Metadata Redis removes Control Plane store records, and losing the Identity Service Metadata Redis removes agent-key records. ## Network access @@ -98,7 +99,7 @@ Plane store records, and losing the Identity Service Metadata Redis removes agen embedding or LLM provider endpoints used by the deployment. - **Identity Service:** the Data Plane must reach its runtime endpoint. Identity Service must reach the Memory Control Plane's grant validator and its own Metadata Redis. Provide TLS - endpoints and trust for both service hops; see [Deploy](/content/operate/iris/agent-memory/self-managed/deploy.md). + endpoints and trust for both service hops; see [Deploy](/content/operate/iris/self-managed/agent-memory/deploy.md). - **Data Plane exposure:** use NetworkPolicy, ingress, gateway, service mesh, private load balancer, or equivalent controls to restrict API access. @@ -106,7 +107,7 @@ Plane store records, and losing the Identity Service Metadata Redis removes agen When `config.render: true` is set, as in the walkthrough, the chart renders configuration from Helm values. This option defaults to `false`. Credentials stay in an overlay Secret. Create the following Secrets for the -[two-release installation](/content/operate/iris/agent-memory/self-managed/deploy.md#2-create-secrets): +[two-release installation](/content/operate/iris/self-managed/agent-memory/deploy.md#2-create-secrets): | Secret | Default key | Holds | | --- | --- | --- | @@ -117,10 +118,10 @@ Helm values. This option defaults to `false`. Credentials stay in an overlay Sec Also create `memory-dp-credential` and `memory-internal-token`, shared by both releases, and `ids-control-token`, read only by Identity Service. The walkthrough supplies a `ram-ca` certificate bundle for service trust. Memory generates its Control Plane admin token unless -you provide one. See [Credentials](/content/operate/iris/agent-memory/self-managed/authentication.md#credentials). +you provide one. See [Credentials](/content/operate/iris/self-managed/agent-memory/authentication.md#credentials). To supply a complete configuration file in your own Secret instead, see -[Bring-your-own (BYO) configuration](/content/operate/iris/agent-memory/self-managed/configuration.md#bring-your-own-byo-configuration). +[Bring-your-own (BYO) configuration](/content/operate/iris/self-managed/agent-memory/configuration.md#bring-your-own-byo-configuration). ## Release artifacts and image tags @@ -275,17 +276,17 @@ namespace. | Naming | `fullnameOverride` | Keeping resource names at `redis-agent-memory*`. | | Service account | `serviceAccount.*` | Matching customer namespace security policy. | | Worker authentication | `workerAuth.*`, `worker.serviceAccount.*`, `worker.serviceAccount.token.*` | Giving Redis Agent Memory workers a Kubernetes projected service-account token for authenticated Data Plane callbacks. | -| Private certificate authority (CA) | `tls.caCertSecret` | Trusting a private CA for outbound connections, such as the cluster CA for [worker identity](/content/operate/iris/agent-memory/self-managed/deploy.md#prepare-worker-identity-for-your-platform). | +| Private certificate authority (CA) | `tls.caCertSecret` | Trusting a private CA for outbound connections, such as the cluster CA for [worker identity](/content/operate/iris/self-managed/agent-memory/deploy.md#prepare-worker-identity-for-your-platform). | | Secret rollouts | `license.existingSecretChecksum`, `config.existingSecretChecksum`, `controlplane.config.existingSecretChecksum` | Rolling pods after externally managed Secret changes. | | Control Plane | `controlplane.image.*`, `controlplane.configData`, `controlplane.adminToken.*` | Mirroring the Control Plane image, setting its configuration, or bringing your own admin token. | | Control Plane internal token | `controlplane.internalToken.*` | Bringing your own token for Identity Service checks against the Control Plane. | | Identity Service connection | `dataplane.identityServiceBaseURL`, `identityService.credential.*`, `identityService.allowInsecureTransport` | Connecting to the separately installed runtime endpoint. The credential Secret is registered on that release. | | Identity Service configuration | Separate `values-ids.yaml`: `metadata`, `control`, `runtime`, `productValidation`, `subjectGrants` | Configuring the Identity Service release, not Memory. | | Shared fallbacks | `global.security.profile`, `global.imagePullSecrets`, `global.tls.caCertSecret` | Providing fallback values within each release. Pass shared values to both releases; local values take precedence. | -| Security profile | `security.profile` or `global.security.profile` | Selecting the [FIPS-oriented posture](/content/operate/iris/agent-memory/self-managed/operations.md#fips-oriented-posture); configure it separately on each release. | +| Security profile | `security.profile` or `global.security.profile` | Selecting the [FIPS-oriented posture](/content/operate/iris/self-managed/agent-memory/operations.md#fips-oriented-posture); configure it separately on each release. | | Support bundles | `supportPackage.*` | Configuring support-bundle collection and its health checks. | | Preflight checks | `preflight.*` | Rendering the preflight checks spec as a ConfigMap. | -| Helm tests | `tests.*` | Running [chart tests](/content/operate/iris/agent-memory/self-managed/operations.md#chart-tests) with `helm test`. | +| Helm tests | `tests.*` | Running [chart tests](/content/operate/iris/self-managed/agent-memory/operations.md#chart-tests) with `helm test`. | {{< /table-scrollable >}} Do not use floating image tags in production. diff --git a/content/operate/iris/agent-memory/self-managed/reference.md b/content/operate/iris/self-managed/agent-memory/reference.md similarity index 93% rename from content/operate/iris/agent-memory/self-managed/reference.md rename to content/operate/iris/self-managed/agent-memory/reference.md index b8706001c2..e794c96ae8 100644 --- a/content/operate/iris/agent-memory/self-managed/reference.md +++ b/content/operate/iris/self-managed/agent-memory/reference.md @@ -11,6 +11,7 @@ weight: 100 hideListLinks: true aliases: - /develop/ai/context-engine/agent-memory/self-managed/reference/ +- /operate/iris/agent-memory/self-managed/reference/ --- ## Configuration reference @@ -19,7 +20,7 @@ Use these files to configure a self-managed deployment: | File | Purpose | | --- | --- | -| `ram-values.yaml` | Memory configuration and its connection to Identity Service. See [step 3](/content/operate/iris/agent-memory/self-managed/deploy.md#3-create-ram-valuesyaml). | +| `ram-values.yaml` | Memory configuration and its connection to Identity Service. See [step 3](/content/operate/iris/self-managed/agent-memory/deploy.md#3-create-ram-valuesyaml). | | `values-ids.yaml` | Separate Identity Service release configuration, including runtime credential registration, tenant, and Memory grant validation. | | `overlay.yaml` | Redis addresses and provider credentials. The Data Plane, the workers, and the Control Plane all mount it. | | `ids-metadata.yaml` | Tells the Identity Service where Metadata Redis is. | @@ -49,22 +50,22 @@ CSI-synced Secrets, make sure a Control Plane pod also mounts the corresponding | `helm search repo redis-ai/redis-agent-memory --versions` returns no results | Helm repo not added/updated, or the chart version has not been published to the repo yet | Run `helm repo add`, `helm repo update`, or install from the chart package provided by Redis. | | Rendering fails because `identityService` has an additional property | Memory values still use the removed bundled contract, such as `identityService.enabled` or `identityService.runtime` | Move service configuration to `values-ids.yaml`. Memory accepts only `identityService.credential` and `identityService.allowInsecureTransport`; remove `externalIdentityService` too. | | Rendering fails at `/externalIdentityService` with `'not' failed` | Values contain the removed external-mode block | Remove `externalIdentityService` and use `dataplane.identityServiceBaseURL` plus `identityService.credential` for the standalone connection. | -| Rendering fails with `requires dataplane.identityServiceBaseURL` | Agent-key authentication or an `identity_service` subject needs the standalone runtime endpoint | Set `dataplane.identityServiceBaseURL` and `identityService.credential.existingSecret`. See [Deploy](/content/operate/iris/agent-memory/self-managed/deploy.md). | +| Rendering fails with `requires dataplane.identityServiceBaseURL` | Agent-key authentication or an `identity_service` subject needs the standalone runtime endpoint | Set `dataplane.identityServiceBaseURL` and `identityService.credential.existingSecret`. See [Deploy](/content/operate/iris/self-managed/agent-memory/deploy.md). | | Rendering fails with `requires identityService.credential.existingSecret` | The endpoint is configured but the runtime credential Secret is missing | Name the existing Secret also registered on Identity Service as `memory-dp`. | | Rendering fails with `must be https://` or `identityService.allowInsecureTransport=true is refused under the fips security profile` | The runtime endpoint uses HTTP without an allowed exception, or insecure transport is enabled under FIPS | Use an HTTPS endpoint. An HTTP exception requires `identityService.allowInsecureTransport: true` and is refused under FIPS. | | Rendering fails with `is chart-owned` for an introspection field | An endpoint, credential, or transport flag was hand-set under `memory.auth` or `shared.auth` | Use `dataplane.identityServiceBaseURL` and `identityService.credential` for chart-rendered configuration; cache settings remain configurable. | | Rendering or startup refuses `auth.method: none` | Authentication is disabled outside the development profile | Use agent-key authentication. For isolated development only, set both `memory.profile: dev` and `memory.auth.method: none`; supplied configuration files use `profile: dev` and `auth.method: none`. | | Docker pull fails for the configured image tag | Image tag is wrong or has not been published to the configured registry | Use the image tag listed for the release on Docker Hub or provided by Redis. | -| Server and worker pods `CrashLoopBackOff`; log: `license validation failed; refusing to start: invalid license format` | `memory.license.license_path` is not set | See [CL-1](/content/operate/iris/agent-memory/self-managed/deploy.md#cl-1). | -| Worker pods `CrashLoopBackOff`; log: `strategies.instruct.llm is required` | The `instruct.llm` block is missing | See [CL-2](/content/operate/iris/agent-memory/self-managed/deploy.md#cl-2). | -| Pods `CrashLoopBackOff`; log: `provider "" is not defined in inference_providers` | An `llm.provider` doesn't name an `inference_providers` entry | See [CL-3](/content/operate/iris/agent-memory/self-managed/deploy.md#cl-3). | -| Worker callback cannot resolve the Data Plane host | `memory.dataplane_client.base_url` is wrong | See [CL-4](/content/operate/iris/agent-memory/self-managed/deploy.md#cl-4). | -| Pod is stuck in `ImagePullBackOff` or `ErrImagePull` | Cluster cannot pull the configured image, image tag is wrong, registry requires credentials, or `imagePullSecrets` is missing/wrong | Verify `image.repository`, `image.tag`, registry reachability, and `imagePullSecrets`; use the Redis Agent Memory release image tag. Configure Identity Service's image and pull Secrets on its own release. See [CL-5](/content/operate/iris/agent-memory/self-managed/deploy.md#cl-5). | -| Worker callbacks rejected with `401` | `auth.worker_identity` doesn't match the worker, or the Data Plane cannot fetch the cluster JWKS | See [CL-6](/content/operate/iris/agent-memory/self-managed/deploy.md#cl-6). | +| Server and worker pods `CrashLoopBackOff`; log: `license validation failed; refusing to start: invalid license format` | `memory.license.license_path` is not set | See [CL-1](/content/operate/iris/self-managed/agent-memory/deploy.md#cl-1). | +| Worker pods `CrashLoopBackOff`; log: `strategies.instruct.llm is required` | The `instruct.llm` block is missing | See [CL-2](/content/operate/iris/self-managed/agent-memory/deploy.md#cl-2). | +| Pods `CrashLoopBackOff`; log: `provider "" is not defined in inference_providers` | An `llm.provider` doesn't name an `inference_providers` entry | See [CL-3](/content/operate/iris/self-managed/agent-memory/deploy.md#cl-3). | +| Worker callback cannot resolve the Data Plane host | `memory.dataplane_client.base_url` is wrong | See [CL-4](/content/operate/iris/self-managed/agent-memory/deploy.md#cl-4). | +| Pod is stuck in `ImagePullBackOff` or `ErrImagePull` | Cluster cannot pull the configured image, image tag is wrong, registry requires credentials, or `imagePullSecrets` is missing/wrong | Verify `image.repository`, `image.tag`, registry reachability, and `imagePullSecrets`; use the Redis Agent Memory release image tag. Configure Identity Service's image and pull Secrets on its own release. See [CL-5](/content/operate/iris/self-managed/agent-memory/deploy.md#cl-5). | +| Worker callbacks rejected with `401` | `auth.worker_identity` doesn't match the worker, or the Data Plane cannot fetch the cluster JWKS | See [CL-6](/content/operate/iris/self-managed/agent-memory/deploy.md#cl-6). | | `helm install --atomic --wait` times out and rolls back | Cluster is small or image pull/startup takes longer than Helm's default timeout | Install without `--atomic --wait`, or set a longer `--timeout` and ensure enough cluster capacity. | | Pods are pending during install or upgrade | CPU/memory capacity is insufficient for default replicas and rollout overlap | Add nodes/headroom or lower replicas for test deployments. | | Data Plane health fails | Pod not ready, config invalid, Redis unavailable, or license invalid | Check pod logs and call `/health/liveness` and `/health/readiness`. | -| Data Plane fails with `agent_keys.introspection.base_url is required` | Bring-your-own (BYO) Data Plane config uses agent-key auth, the default when no auth method is set, without the `auth.agent_keys.introspection` block | Add the `auth.agent_keys.introspection` block. Only isolated development can use `auth.method: none` with `profile: dev`. See [Configuration](/content/operate/iris/agent-memory/self-managed/configuration.md#bring-your-own-byo-configuration). | +| Data Plane fails with `agent_keys.introspection.base_url is required` | Bring-your-own (BYO) Data Plane config uses agent-key auth, the default when no auth method is set, without the `auth.agent_keys.introspection` block | Add the `auth.agent_keys.introspection` block. Only isolated development can use `auth.method: none` with `profile: dev`. See [Configuration](/content/operate/iris/self-managed/agent-memory/configuration.md#bring-your-own-byo-configuration). | | Data Plane fails with `removed metadata configuration keys: …` | Config uses metadata keys that version 0.7.0 removed, such as `metadata.source` or `metadata.live` | Configure `metadata.urls`, `metadata.namespace`, and `databases`, then create stores through the Control Plane. | | Pod fails to start in FIPS posture | A Redis URL is not `rediss://`, an outbound HTTP client uses `skip_verify: true`, an authentication block sets `allow_insecure_transport: true`, or the Identity Service logs `product_validation..base_url must be an https URL in FIPS profile` | Update Redis URLs, HTTP client config, authentication blocks, and the Identity Service product validator URL to satisfy the posture checks. The error names the exact config path. | | Agent receives `401` | Key is missing, revoked, expired, or wrong | Check `Authorization` / `X-Api-Key` and key status. | @@ -88,7 +89,7 @@ CSI-synced Secrets, make sure a Control Plane pod also mounts the corresponding | NetworkPolicy reference | `networkpolicy.reference.yaml` at the chart root | | Chart README | `README.md` at the chart root | | Redis Agent Memory API reference | [Redis Agent Memory API]({{< relref "/develop/ai/context-engine/agent-memory/api-reference" >}}) | -| Control Plane API reference | [Control Plane API reference]({{< relref "/operate/iris/agent-memory/self-managed/control-plane-api-reference" >}}) | +| Control Plane API reference | [Control Plane API reference]({{< relref "/operate/iris/self-managed/agent-memory/control-plane-api-reference" >}}) | | Redis Agent Memory Data Plane image tags | [Docker Hub: redislabs/agent-memory](https://hub.docker.com/r/redislabs/agent-memory/tags) | | Redis Agent Memory Control Plane image tags | [Docker Hub: redislabs/agent-memory-control-plane](https://hub.docker.com/r/redislabs/agent-memory-control-plane/tags) | | Identity Service image tags | [Docker Hub: redislabs/iris-identity-service](https://hub.docker.com/r/redislabs/iris-identity-service/tags) | diff --git a/content/operate/iris/context-gateway/self-managed/_index.md b/content/operate/iris/self-managed/context-gateway/_index.md similarity index 75% rename from content/operate/iris/context-gateway/self-managed/_index.md rename to content/operate/iris/self-managed/context-gateway/_index.md index bc280a96e8..63147cbf4c 100644 --- a/content/operate/iris/context-gateway/self-managed/_index.md +++ b/content/operate/iris/self-managed/context-gateway/_index.md @@ -6,16 +6,23 @@ categories: - operate - iris description: Deploy, configure, and operate Redis Context Gateway on a self-managed Kubernetes cluster. -linkTitle: Self-managed -weight: 40 +linkTitle: Context Gateway +weight: 30 hideListLinks: true aliases: - /operate/iris/context-retriever/self-managed/ +- /operate/iris/context-gateway/self-managed/ +- /operate/iris/context-gateway/ +- /operate/iris/context-retriever/ +- /operate/iris/context-retriever/create-service/ +- /operate/iris/context-retriever/view-service/ +- /operate/iris/context-retriever/view-admin-keys/ +- /operate/rc/context-engine/context-retriever/ --- The `redis-context-gateway` Helm chart deploys one tenant's Context Gateway Control Plane and Data Plane. You provide the Identity Service release, the Redis databases, and the license. The chart does not install Identity Service, Redis, Vault, or Secrets Store CSI (Container Storage Interface) Driver resources. -Agents call the Data Plane's Model Context Protocol (MCP) endpoint, described in the [MCP API reference](/content/develop/ai/context-engine/context-gateway/api-reference.md). The [Control Plane API reference](/content/operate/iris/context-gateway/self-managed/control-plane-api-reference.md) documents the self-managed administration endpoints for Gateways and Upstreams. +Agents call the Data Plane's Model Context Protocol (MCP) endpoint, described in the [MCP API reference](/content/develop/ai/context-engine/context-gateway/api-reference.md). The [Control Plane API reference](/content/operate/iris/self-managed/context-gateway/control-plane-api-reference.md) documents the self-managed administration endpoints for Gateways and Upstreams. The chart version that matches these guides is not published yet. Set the chart version and image tags from the approved release manifest when it becomes available. @@ -60,15 +67,15 @@ Use separately managed Redis deployments for metadata, credentials, and customer ## Get started -1. Review the [prerequisites](/content/operate/iris/context-gateway/self-managed/prerequisites.md). -2. Prepare the [configuration](/content/operate/iris/context-gateway/self-managed/configuration.md). -3. [Deploy the chart](/content/operate/iris/context-gateway/self-managed/deploy.md). -4. [Load administrative credentials](/content/operate/iris/context-gateway/self-managed/authentication.md). -5. [Create a Gateway and an agent key](/content/operate/iris/context-gateway/self-managed/api-examples.md). +1. Review the [prerequisites](/content/operate/iris/self-managed/context-gateway/prerequisites.md). +2. Prepare the [configuration](/content/operate/iris/self-managed/context-gateway/configuration.md). +3. [Deploy the chart](/content/operate/iris/self-managed/context-gateway/deploy.md). +4. [Load administrative credentials](/content/operate/iris/self-managed/context-gateway/authentication.md). +5. [Create a Gateway and an agent key](/content/operate/iris/self-managed/context-gateway/api-examples.md). ## Manage the deployment - [Manage Gateways and Upstreams](/content/develop/ai/context-engine/context-gateway/manage-gateways.md) and [Context Surfaces](/content/develop/ai/context-engine/context-gateway/manage-context-surfaces.md) through the Control Plane. -- [Rotate or revoke agent keys](/content/operate/iris/context-gateway/self-managed/api-examples.md#rotate-or-revoke-agent-keys). -- [Check health, rotate credentials, back up, and upgrade](/content/operate/iris/context-gateway/self-managed/operations.md). -- [Troubleshoot the deployment](/content/operate/iris/context-gateway/self-managed/reference.md#troubleshooting). +- [Rotate or revoke agent keys](/content/operate/iris/self-managed/context-gateway/api-examples.md#rotate-or-revoke-agent-keys). +- [Check health, rotate credentials, back up, and upgrade](/content/operate/iris/self-managed/context-gateway/operations.md). +- [Troubleshoot the deployment](/content/operate/iris/self-managed/context-gateway/reference.md#troubleshooting). diff --git a/content/operate/iris/context-gateway/self-managed/api-examples.md b/content/operate/iris/self-managed/context-gateway/api-examples.md similarity index 92% rename from content/operate/iris/context-gateway/self-managed/api-examples.md rename to content/operate/iris/self-managed/context-gateway/api-examples.md index 9dbf1a1718..722179e40a 100644 --- a/content/operate/iris/context-gateway/self-managed/api-examples.md +++ b/content/operate/iris/self-managed/context-gateway/api-examples.md @@ -9,15 +9,17 @@ description: Create the Gateways and the sample Upstream, mint an agent key, ver linkTitle: API examples weight: 70 hideListLinks: true +aliases: +- /operate/iris/context-gateway/self-managed/api-examples/ --- Create the two Gateways the [developer quickstart](/content/develop/ai/context-engine/context-gateway/quickstart.md) uses, register the sample clinic directory on both, issue one agent key, and hand the connection values to a developer. -Before you begin, [deploy the chart](/content/operate/iris/context-gateway/self-managed/deploy.md) and [load the admin token](/content/operate/iris/context-gateway/self-managed/authentication.md#control-plane-admin-token). +Before you begin, [deploy the chart](/content/operate/iris/self-managed/context-gateway/deploy.md) and [load the admin token](/content/operate/iris/self-managed/context-gateway/authentication.md#control-plane-admin-token). ## Set connection values -Forward the Control Plane and the Identity Service in separate terminals, as in [Deploy](/content/operate/iris/context-gateway/self-managed/deploy.md#5-verify-pods-and-health), then export the connection values: +Forward the Control Plane and the Identity Service in separate terminals, as in [Deploy](/content/operate/iris/self-managed/context-gateway/deploy.md#5-verify-pods-and-health), then export the connection values: ```bash export IRIS_CONTEXT_GATEWAY_SERVICE_URL='http://localhost:9100' @@ -51,7 +53,7 @@ export OPERATIONS_ID="$(jq -er '.id' operations.json)" jq '{id, mcpEndpoint, toolExposureMode}' front-desk.json operations.json ``` -The `search` mode Gateway has a `databaseId`, so it starts with `cache` and `compression` enabled. Result handles also need `result_handles.enabled` on the Data Plane. See [Result cache and result handles](/content/operate/iris/context-gateway/self-managed/configuration.md#result-cache-and-result-handles). +The `search` mode Gateway has a `databaseId`, so it starts with `cache` and `compression` enabled. Result handles also need `result_handles.enabled` on the Data Plane. See [Result cache and result handles](/content/operate/iris/self-managed/context-gateway/configuration.md#result-cache-and-result-handles). diff --git a/content/operate/iris/context-gateway/self-managed/authentication.md b/content/operate/iris/self-managed/context-gateway/authentication.md similarity index 93% rename from content/operate/iris/context-gateway/self-managed/authentication.md rename to content/operate/iris/self-managed/context-gateway/authentication.md index c7beeedecd..ee155118a8 100644 --- a/content/operate/iris/context-gateway/self-managed/authentication.md +++ b/content/operate/iris/self-managed/context-gateway/authentication.md @@ -9,6 +9,8 @@ description: Configure Context Gateway Control Plane credentials, agent-key gran linkTitle: Authentication and authorization weight: 60 hideListLinks: true +aliases: +- /operate/iris/context-gateway/self-managed/authentication/ --- ## Credentials @@ -53,7 +55,7 @@ One grant covers listing and calling every tool on the Gateway, including tools The Identity Service mints a key only for a Gateway that exists in the tenant and is not being deleted. A revoked key stops working within the Identity Service cache lifetime, 300 seconds by default. -The [API examples](/content/operate/iris/context-gateway/self-managed/api-examples.md#mint-an-agent-key) show the complete request. +The [API examples](/content/operate/iris/self-managed/context-gateway/api-examples.md#mint-an-agent-key) show the complete request. ## Identity provider sign-in @@ -85,4 +87,4 @@ A specific subject grant cannot narrow the all-Gateway role, and removing a subj ## Rotate credentials -See [Operations](/content/operate/iris/context-gateway/self-managed/operations.md#rotate-credentials). +See [Operations](/content/operate/iris/self-managed/context-gateway/operations.md#rotate-credentials). diff --git a/content/operate/iris/context-gateway/self-managed/configuration.md b/content/operate/iris/self-managed/context-gateway/configuration.md similarity index 97% rename from content/operate/iris/context-gateway/self-managed/configuration.md rename to content/operate/iris/self-managed/context-gateway/configuration.md index 3e26651d89..c95511319e 100644 --- a/content/operate/iris/context-gateway/self-managed/configuration.md +++ b/content/operate/iris/self-managed/context-gateway/configuration.md @@ -9,9 +9,11 @@ description: Prepare Helm values, file references, credential storage, the datab linkTitle: Configuration weight: 30 hideListLinks: true +aliases: +- /operate/iris/context-gateway/self-managed/configuration/ --- -The chart reads non-secret settings from Helm values and every credential from a mounted file. Prepare `gateway-values.yaml` and the Secrets it references before you [deploy](/content/operate/iris/context-gateway/self-managed/deploy.md). +The chart reads non-secret settings from Helm values and every credential from a mounted file. Prepare `gateway-values.yaml` and the Secrets it references before you [deploy](/content/operate/iris/self-managed/context-gateway/deploy.md). ## Helm values @@ -77,7 +79,7 @@ Both planes probe every entry at startup. An entry that does not answer does not ## Context Surface databases -A Context Surface stores only its database ID. Give each plane its own Redis user on the database, as listed in [Redis users for Surface databases](/content/operate/iris/context-gateway/self-managed/prerequisites.md#redis-users-for-surface-databases), and put each login in that plane's registry entry. To change a password, update the Secret and restart both planes. +A Context Surface stores only its database ID. Give each plane its own Redis user on the database, as listed in [Redis users for Surface databases](/content/operate/iris/self-managed/context-gateway/prerequisites.md#redis-users-for-surface-databases), and put each login in that plane's registry entry. To change a password, update the Secret and restart both planes. Semantic and hybrid search tools embed the agent's text before they search. Point the Data Plane at an OpenAI-compatible embedding service: diff --git a/content/operate/iris/context-gateway/self-managed/control-plane-api-reference.md b/content/operate/iris/self-managed/context-gateway/control-plane-api-reference.md similarity index 71% rename from content/operate/iris/context-gateway/self-managed/control-plane-api-reference.md rename to content/operate/iris/self-managed/context-gateway/control-plane-api-reference.md index 27712197ee..555b24a8c7 100644 --- a/content/operate/iris/context-gateway/self-managed/control-plane-api-reference.md +++ b/content/operate/iris/self-managed/context-gateway/control-plane-api-reference.md @@ -9,10 +9,12 @@ params: sortOperationsAlphabetically: false schemaDefinitionsTagName: Data models showPageContent: true +aliases: +- /operate/iris/context-gateway/self-managed/control-plane-api-reference/ --- Use the self-managed Control Plane API to create Gateways, register and update Upstreams, refresh tool catalogs, and list each Upstream's tools. -[Download the OpenAPI contract]({{< relref "/operate/iris/context-gateway/self-managed/control-plane-api-reference/" >}}openapi-control-plane.json), follow the [administration examples](/content/operate/iris/context-gateway/self-managed/api-examples.md), or review [authentication and authorization](/content/operate/iris/context-gateway/self-managed/authentication.md). +[Download the OpenAPI contract]({{< relref "/operate/iris/self-managed/context-gateway/control-plane-api-reference/" >}}openapi-control-plane.json), follow the [administration examples](/content/operate/iris/self-managed/context-gateway/api-examples.md), or review [authentication and authorization](/content/operate/iris/self-managed/context-gateway/authentication.md). Agent-key management belongs to the Identity Service. Agents call tools through each Gateway's Model Context Protocol (MCP) endpoint, described in the [MCP API reference](/content/develop/ai/context-engine/context-gateway/api-reference.md). diff --git a/content/operate/iris/context-gateway/self-managed/control-plane-api-reference/openapi-control-plane.json b/content/operate/iris/self-managed/context-gateway/control-plane-api-reference/openapi-control-plane.json similarity index 100% rename from content/operate/iris/context-gateway/self-managed/control-plane-api-reference/openapi-control-plane.json rename to content/operate/iris/self-managed/context-gateway/control-plane-api-reference/openapi-control-plane.json diff --git a/content/operate/iris/context-gateway/self-managed/deploy.md b/content/operate/iris/self-managed/context-gateway/deploy.md similarity index 92% rename from content/operate/iris/context-gateway/self-managed/deploy.md rename to content/operate/iris/self-managed/context-gateway/deploy.md index fd66083121..2fcd73cc1d 100644 --- a/content/operate/iris/context-gateway/self-managed/deploy.md +++ b/content/operate/iris/self-managed/context-gateway/deploy.md @@ -9,13 +9,15 @@ description: Install Redis Context Gateway with an external Identity Service, th linkTitle: Deploy weight: 50 hideListLinks: true +aliases: +- /operate/iris/context-gateway/self-managed/deploy/ --- These steps install the Context Gateway Control Plane and Data Plane with the `redis-context-gateway` Helm chart, and end with one authenticated Model Context Protocol (MCP) call. -You use three credentials along the way: the Control Plane admin token, the Identity Service control token, and an agent key. For what each credential unlocks, see [Credentials](/content/operate/iris/context-gateway/self-managed/authentication.md#credentials). +You use three credentials along the way: the Control Plane admin token, the Identity Service control token, and an agent key. For what each credential unlocks, see [Credentials](/content/operate/iris/self-managed/context-gateway/authentication.md#credentials). -Before you begin, review the [prerequisites](/content/operate/iris/context-gateway/self-managed/prerequisites.md). +Before you begin, review the [prerequisites](/content/operate/iris/self-managed/context-gateway/prerequisites.md). ## 1. Create the namespace @@ -71,7 +73,7 @@ kubectl -n create secret generic gateway-grant-validation --fro kubectl -n create secret generic gateway-runtime --from-file=token=./runtime-token ``` -Create a `databaseConnections` Secret for the registered databases. See [Database registry](/content/operate/iris/context-gateway/self-managed/configuration.md#database-registry). +Create a `databaseConnections` Secret for the registered databases. See [Database registry](/content/operate/iris/self-managed/context-gateway/configuration.md#database-registry). ## 3. Create `gateway-values.yaml` @@ -178,5 +180,5 @@ curl -sS -X POST http://localhost:9200/v1/api-keys \ ## Next steps -- [API examples](/content/operate/iris/context-gateway/self-managed/api-examples.md) to register an Upstream and hand off to a developer. -- [Operations](/content/operate/iris/context-gateway/self-managed/operations.md) for credential rotation and upgrades. +- [API examples](/content/operate/iris/self-managed/context-gateway/api-examples.md) to register an Upstream and hand off to a developer. +- [Operations](/content/operate/iris/self-managed/context-gateway/operations.md) for credential rotation and upgrades. diff --git a/content/operate/iris/context-gateway/self-managed/operations.md b/content/operate/iris/self-managed/context-gateway/operations.md similarity index 95% rename from content/operate/iris/context-gateway/self-managed/operations.md rename to content/operate/iris/self-managed/context-gateway/operations.md index b18937b761..0bba8aeff0 100644 --- a/content/operate/iris/context-gateway/self-managed/operations.md +++ b/content/operate/iris/self-managed/context-gateway/operations.md @@ -9,13 +9,15 @@ description: Check health, rotate credentials and encryption keys, monitor the r linkTitle: Operations weight: 90 hideListLinks: true +aliases: +- /operate/iris/context-gateway/self-managed/operations/ --- ## Check service health Both planes serve `/health/liveness` and `/health/readiness` without a credential. Readiness answers `503` while a token source cannot be read or is empty, or the license is not valid. The response does not name the failed check, so read the plane's logs. -With the ports forwarded as in [Deploy](/content/operate/iris/context-gateway/self-managed/deploy.md#5-verify-pods-and-health): +With the ports forwarded as in [Deploy](/content/operate/iris/self-managed/context-gateway/deploy.md#5-verify-pods-and-health): ```bash curl -sS http://localhost:9100/health/readiness @@ -29,7 +31,7 @@ curl -sS http://localhost:8083/health/readiness | Credential | How to rotate | | --- | --- | | Upstream credential | Update the Upstream with a new value through the Control Plane. After an in-place rotation in Vault or AWS Secrets Manager, refresh the Upstream's catalog so cached results stop being served. | -| Agent key | Rotate or revoke it through the Identity Service. See [Rotate or revoke agent keys](/content/operate/iris/context-gateway/self-managed/api-examples.md#rotate-or-revoke-agent-keys). A revoked key stops working within 300 seconds by default. | +| Agent key | Rotate or revoke it through the Identity Service. See [Rotate or revoke agent keys](/content/operate/iris/self-managed/context-gateway/api-examples.md#rotate-or-revoke-agent-keys). A revoked key stops working within 300 seconds by default. | | Admin token, internal token | Replace the Secret. The Control Plane rereads the file, so no restart is needed. Coordinate an internal token change with the Identity Service release. | | Runtime token | Replace the Secret and update the matching Identity Service credential. The Data Plane rereads it on its next key check. | | Metadata, credential, and registered database URLs, Vault tokens | Replace the Secret, then restart the planes that read it. | diff --git a/content/operate/iris/context-gateway/self-managed/prerequisites.md b/content/operate/iris/self-managed/context-gateway/prerequisites.md similarity index 97% rename from content/operate/iris/context-gateway/self-managed/prerequisites.md rename to content/operate/iris/self-managed/context-gateway/prerequisites.md index f7fb1d9c99..8c1ed73b28 100644 --- a/content/operate/iris/context-gateway/self-managed/prerequisites.md +++ b/content/operate/iris/self-managed/context-gateway/prerequisites.md @@ -9,6 +9,8 @@ description: Review software, Identity Service, Redis, credential storage, netwo linkTitle: Prerequisites weight: 20 hideListLinks: true +aliases: +- /operate/iris/context-gateway/self-managed/prerequisites/ --- ## What you need @@ -99,7 +101,7 @@ Configure the ingress for Streamable HTTP: ## Credentials and Secrets -Redis URLs, tokens, keyrings, and the license belong in Kubernetes Secrets or Secrets Store Container Storage Interface (CSI) Driver files, never in Helm values or source control. See [Credentials](/content/operate/iris/context-gateway/self-managed/authentication.md#credentials) for each credential and [Configuration](/content/operate/iris/context-gateway/self-managed/configuration.md) for each file reference. +Redis URLs, tokens, keyrings, and the license belong in Kubernetes Secrets or Secrets Store Container Storage Interface (CSI) Driver files, never in Helm values or source control. See [Credentials](/content/operate/iris/self-managed/context-gateway/authentication.md#credentials) for each credential and [Configuration](/content/operate/iris/self-managed/context-gateway/configuration.md) for each file reference. ## Release artifacts and image tags diff --git a/content/operate/iris/context-gateway/self-managed/reference.md b/content/operate/iris/self-managed/context-gateway/reference.md similarity index 97% rename from content/operate/iris/context-gateway/self-managed/reference.md rename to content/operate/iris/self-managed/context-gateway/reference.md index 4c84b53b90..0a3ac6c478 100644 --- a/content/operate/iris/context-gateway/self-managed/reference.md +++ b/content/operate/iris/self-managed/context-gateway/reference.md @@ -9,13 +9,15 @@ description: Review self-managed Context Gateway configuration files, troublesho linkTitle: Configuration and troubleshooting weight: 100 hideListLinks: true +aliases: +- /operate/iris/context-gateway/self-managed/reference/ --- ## Configuration reference | File | Purpose | | --- | --- | -| `gateway-values.yaml` | Helm values for both planes. See [step 3](/content/operate/iris/context-gateway/self-managed/deploy.md#3-create-gateway-valuesyaml). | +| `gateway-values.yaml` | Helm values for both planes. See [step 3](/content/operate/iris/self-managed/context-gateway/deploy.md#3-create-gateway-valuesyaml). | | `metadata.yaml` | Metadata Redis URLs. Both planes mount it. | | `credential-redis.yaml` | Credential Redis URLs, with the encrypted Redis backend. | | `databases.yaml` | URLs for each registered database. | diff --git a/content/operate/iris/intent-router/self-managed/_index.md b/content/operate/iris/self-managed/intent-router/_index.md similarity index 79% rename from content/operate/iris/intent-router/self-managed/_index.md rename to content/operate/iris/self-managed/intent-router/_index.md index aa4d5541e6..3836492cb3 100644 --- a/content/operate/iris/intent-router/self-managed/_index.md +++ b/content/operate/iris/self-managed/intent-router/_index.md @@ -6,18 +6,21 @@ categories: - operate - iris description: Deploy, configure, and operate Redis Intent Router on a self-managed Kubernetes cluster. -linkTitle: Self-managed +linkTitle: Intent Router weight: 40 hideListLinks: true +aliases: +- /operate/iris/intent-router/self-managed/ +- /operate/iris/intent-router/ --- Intent Router classifies each incoming user message by intent, so your application can send it to the right agent, workflow, or handler. Developers define intents with example phrases, and their applications send messages to a Router to find the closest match. Before developers can do that, a platform administrator deploys Intent Router and creates Routers and agent keys for them. -This guide is for that administrator. It covers deploying Intent Router on your own Kubernetes cluster with a Helm chart, then configuring, securing, and operating it. To install, start with the [prerequisites](/content/operate/iris/intent-router/self-managed/prerequisites.md). +This guide is for that administrator. It covers deploying Intent Router on your own Kubernetes cluster with a Helm chart, then configuring, securing, and operating it. To install, start with the [prerequisites](/content/operate/iris/self-managed/intent-router/prerequisites.md). The `redis-intent-router` Helm chart deploys one tenant's Intent Router control plane and data plane. By default it also deploys an Identity Service that issues and checks agent keys. You provide the Redis databases, the embedding provider credentials, and the license. -Applications call the data plane to author intents and match queries, as described in the [data-plane API reference](/content/develop/ai/context-engine/intent-router/api-reference.md). The [control-plane API reference](/content/operate/iris/intent-router/self-managed/control-plane-api-reference.md) documents the administration endpoints for Routers. +Applications call the data plane to author intents and match queries, as described in the [data-plane API reference](/content/develop/ai/context-engine/intent-router/api-reference.md). The [control-plane API reference](/content/operate/iris/self-managed/intent-router/control-plane-api-reference.md) documents the administration endpoints for Routers. Set the chart version and image tags from the release manifest for your deployment. @@ -62,15 +65,15 @@ A Router serves requests only after the data plane has applied its current confi ## Get started -1. Review the [prerequisites](/content/operate/iris/intent-router/self-managed/prerequisites.md). -1. Prepare the [configuration](/content/operate/iris/intent-router/self-managed/configuration.md). -1. [Deploy the chart](/content/operate/iris/intent-router/self-managed/deploy.md). -1. [Load administrative credentials](/content/operate/iris/intent-router/self-managed/authentication.md). -1. [Create a Router and an agent key](/content/operate/iris/intent-router/self-managed/api-examples.md). +1. Review the [prerequisites](/content/operate/iris/self-managed/intent-router/prerequisites.md). +1. Prepare the [configuration](/content/operate/iris/self-managed/intent-router/configuration.md). +1. [Deploy the chart](/content/operate/iris/self-managed/intent-router/deploy.md). +1. [Load administrative credentials](/content/operate/iris/self-managed/intent-router/authentication.md). +1. [Create a Router and an agent key](/content/operate/iris/self-managed/intent-router/api-examples.md). ## Manage the deployment - [Manage Routers](/content/develop/ai/context-engine/intent-router/manage-routers.md) through the control plane. -- [Rotate or revoke agent keys](/content/operate/iris/intent-router/self-managed/api-examples.md#rotate-or-revoke-agent-keys). -- [Check health, rotate credentials, size memory, and upgrade](/content/operate/iris/intent-router/self-managed/operations.md). -- [Troubleshoot the deployment](/content/operate/iris/intent-router/self-managed/reference.md#troubleshooting). +- [Rotate or revoke agent keys](/content/operate/iris/self-managed/intent-router/api-examples.md#rotate-or-revoke-agent-keys). +- [Check health, rotate credentials, size memory, and upgrade](/content/operate/iris/self-managed/intent-router/operations.md). +- [Troubleshoot the deployment](/content/operate/iris/self-managed/intent-router/reference.md#troubleshooting). diff --git a/content/operate/iris/intent-router/self-managed/api-examples.md b/content/operate/iris/self-managed/intent-router/api-examples.md similarity index 94% rename from content/operate/iris/intent-router/self-managed/api-examples.md rename to content/operate/iris/self-managed/intent-router/api-examples.md index b558f37b70..d26376a903 100644 --- a/content/operate/iris/intent-router/self-managed/api-examples.md +++ b/content/operate/iris/self-managed/intent-router/api-examples.md @@ -9,15 +9,17 @@ description: Create a Router, mint an agent key, verify agent access, hand off t linkTitle: API examples weight: 70 hideListLinks: true +aliases: +- /operate/iris/intent-router/self-managed/api-examples/ --- After you deploy Intent Router, developers still can't use it until a Router and an agent key exist. This page walks through that setup: you create a Router, issue an agent key for it, check that the key works, and give the connection values to a developer. The developer then continues with the [developer quickstart](/content/develop/ai/context-engine/intent-router/quickstart.md). The page also covers rotating and revoking agent keys after handoff. -Before you begin, [deploy the chart](/content/operate/iris/intent-router/self-managed/deploy.md) and [load the administration tokens](/content/operate/iris/intent-router/self-managed/authentication.md#load-the-administration-tokens). +Before you begin, [deploy the chart](/content/operate/iris/self-managed/intent-router/deploy.md) and [load the administration tokens](/content/operate/iris/self-managed/intent-router/authentication.md#load-the-administration-tokens). ## Set connection values -Forward the control plane, the data plane, and the Identity Service in separate terminals, as in [Deploy](/content/operate/iris/intent-router/self-managed/deploy.md#5-verify-pods-and-health), then export the connection values: +Forward the control plane, the data plane, and the Identity Service in separate terminals, as in [Deploy](/content/operate/iris/self-managed/intent-router/deploy.md#5-verify-pods-and-health), then export the connection values: ```bash export IRIS_INTENT_ROUTER_SERVICE_URL='http://localhost:9400' diff --git a/content/operate/iris/intent-router/self-managed/authentication.md b/content/operate/iris/self-managed/intent-router/authentication.md similarity index 95% rename from content/operate/iris/intent-router/self-managed/authentication.md rename to content/operate/iris/self-managed/intent-router/authentication.md index d0a7f608d5..42118b03f8 100644 --- a/content/operate/iris/intent-router/self-managed/authentication.md +++ b/content/operate/iris/self-managed/intent-router/authentication.md @@ -9,6 +9,8 @@ description: Understand the Intent Router credentials, agent-key grants, and how linkTitle: Authentication and authorization weight: 60 hideListLinks: true +aliases: +- /operate/iris/intent-router/self-managed/authentication/ --- Self-managed Intent Router uses two kinds of credentials. Service tokens authenticate operators and the Intent Router components to each other, and the chart generates them for you by default. Agent keys authenticate applications to the data plane, and each key's grants control which Routers it can use and what it can do on them. @@ -33,7 +35,7 @@ An agent key gets `401` from the control plane. A key without a grant on a Route Every Router operation needs the admin token in `Authorization: Bearer `, and every agent-key operation needs the Identity Service control token. The health routes need no credential. -Load both from their Secrets before you call the control plane or the Identity Service. With the Secret names from [Deploy](/content/operate/iris/intent-router/self-managed/deploy.md#2-create-secrets): +Load both from their Secrets before you call the control plane or the Identity Service. With the Secret names from [Deploy](/content/operate/iris/self-managed/intent-router/deploy.md#2-create-secrets): ```bash export IRIS_INTENT_ROUTER_SERVICE_TOKEN="$(kubectl -n get secret \ @@ -62,7 +64,7 @@ An agent key needs a grant on each Router it uses: A grant can't use a wildcard resource ID and can't carry constraints. The Identity Service mints a key only for a Router that exists in the tenant. It asks the control plane to confirm this through the grant-validation callback, authenticated with the internal token. -The data plane checks every key with the Identity Service, which caches the answer. A revoked key stops working within the Identity Service's cache lifetime, `identityService.runtimeCache.hardTTLSeconds`, 300 seconds by default. The [API examples](/content/operate/iris/intent-router/self-managed/api-examples.md#mint-an-agent-key) show the complete request. +The data plane checks every key with the Identity Service, which caches the answer. A revoked key stops working within the Identity Service's cache lifetime, `identityService.runtimeCache.hardTTLSeconds`, 300 seconds by default. The [API examples](/content/operate/iris/self-managed/intent-router/api-examples.md#mint-an-agent-key) show the complete request. ## Configure the Identity Service @@ -78,4 +80,4 @@ When you deploy the bundled Identity Service, the chart configures it. To use an ## Rotate credentials -To rotate a token, update its Secret and its `existingSecretChecksum` and run `helm upgrade`, so the pods roll. When the Identity Service runs in its own release, rotate the internal token there at the same time, because the two must match. Rotate an agent key with the Identity Service, as shown in [Rotate or revoke agent keys](/content/operate/iris/intent-router/self-managed/api-examples.md#rotate-or-revoke-agent-keys). +To rotate a token, update its Secret and its `existingSecretChecksum` and run `helm upgrade`, so the pods roll. When the Identity Service runs in its own release, rotate the internal token there at the same time, because the two must match. Rotate an agent key with the Identity Service, as shown in [Rotate or revoke agent keys](/content/operate/iris/self-managed/intent-router/api-examples.md#rotate-or-revoke-agent-keys). diff --git a/content/operate/iris/intent-router/self-managed/configuration.md b/content/operate/iris/self-managed/intent-router/configuration.md similarity index 97% rename from content/operate/iris/intent-router/self-managed/configuration.md rename to content/operate/iris/self-managed/intent-router/configuration.md index 410ddbc0d6..d5d1a4345e 100644 --- a/content/operate/iris/intent-router/self-managed/configuration.md +++ b/content/operate/iris/self-managed/intent-router/configuration.md @@ -9,9 +9,11 @@ description: Set the Helm values, storage Secret, embedding models, customer dat linkTitle: Configuration weight: 30 hideListLinks: true +aliases: +- /operate/iris/intent-router/self-managed/configuration/ --- -This page describes how to configure self-managed Intent Router before you [deploy the chart](/content/operate/iris/intent-router/self-managed/deploy.md). You prepare a Helm values file and the Secrets it references. The values file sets your tenant, image tags, and tokens. The Secrets hold what shouldn't be in a values file: Redis connection URLs, embedding provider credentials, and the license. +This page describes how to configure self-managed Intent Router before you [deploy the chart](/content/operate/iris/self-managed/intent-router/deploy.md). You prepare a Helm values file and the Secrets it references. The values file sets your tenant, image tags, and tokens. The Secrets hold what shouldn't be in a values file: Redis connection URLs, embedding provider credentials, and the license. Every install needs the Helm values, the storage Secret, and an embedding model, covered in the first three sections. The remaining sections are optional, and their defaults work for a first deployment. Use them to store Routers in customer databases, tune search and matching, adjust Router lifecycle timing, trust a private certificate authority, enable Federal Information Processing Standards (FIPS) mode or tracing, or scale the planes. @@ -72,7 +74,7 @@ inference: dimensions: 1536 ``` -To let the chart generate a token instead, delete its `existingSecret` line. See [Credentials](/content/operate/iris/intent-router/self-managed/authentication.md#credentials). +To let the chart generate a token instead, delete its `existingSecret` line. See [Credentials](/content/operate/iris/self-managed/intent-router/authentication.md#credentials). The bundled Identity Service speaks plain Hypertext Transfer Protocol (HTTP) inside the cluster, and the data plane rejects an `http://` introspection URL. Rendering fails until you choose: set `dataplane.identityServiceBaseURL` to an `https://` endpoint, or set `dataplane.allowInsecureIdentityService=true` to accept cleartext introspection on the pod network. diff --git a/content/operate/iris/intent-router/self-managed/control-plane-api-reference.md b/content/operate/iris/self-managed/intent-router/control-plane-api-reference.md similarity index 77% rename from content/operate/iris/intent-router/self-managed/control-plane-api-reference.md rename to content/operate/iris/self-managed/intent-router/control-plane-api-reference.md index a3882a5cad..0a31f8fb7d 100644 --- a/content/operate/iris/intent-router/self-managed/control-plane-api-reference.md +++ b/content/operate/iris/self-managed/intent-router/control-plane-api-reference.md @@ -8,4 +8,6 @@ params: sourcefile: ./openapi-control-plane.json sortOperationsAlphabetically: false schemaDefinitionsTagName: Data models +aliases: +- /operate/iris/intent-router/self-managed/control-plane-api-reference/ --- diff --git a/content/operate/iris/intent-router/self-managed/control-plane-api-reference/openapi-control-plane.json b/content/operate/iris/self-managed/intent-router/control-plane-api-reference/openapi-control-plane.json similarity index 100% rename from content/operate/iris/intent-router/self-managed/control-plane-api-reference/openapi-control-plane.json rename to content/operate/iris/self-managed/intent-router/control-plane-api-reference/openapi-control-plane.json diff --git a/content/operate/iris/intent-router/self-managed/deploy.md b/content/operate/iris/self-managed/intent-router/deploy.md similarity index 89% rename from content/operate/iris/intent-router/self-managed/deploy.md rename to content/operate/iris/self-managed/intent-router/deploy.md index eb7b2cd2c3..306e680866 100644 --- a/content/operate/iris/intent-router/self-managed/deploy.md +++ b/content/operate/iris/self-managed/intent-router/deploy.md @@ -9,13 +9,15 @@ description: Install Redis Intent Router, then create a Router, mint an agent ke linkTitle: Deploy weight: 50 hideListLinks: true +aliases: +- /operate/iris/intent-router/self-managed/deploy/ --- Follow these steps to install the Intent Router control plane, data plane, and Identity Service with the `redis-intent-router` Helm chart, and end with one authenticated match request. -You use three credentials along the way: the control-plane admin token, the Identity Service control token, and an agent key. For what each credential unlocks, see [Credentials](/content/operate/iris/intent-router/self-managed/authentication.md#credentials). +You use three credentials along the way: the control-plane admin token, the Identity Service control token, and an agent key. For what each credential unlocks, see [Credentials](/content/operate/iris/self-managed/intent-router/authentication.md#credentials). -Before you begin, review the [prerequisites](/content/operate/iris/intent-router/self-managed/prerequisites.md). +Before you begin, review the [prerequisites](/content/operate/iris/self-managed/intent-router/prerequisites.md). ## 1. Create the namespace @@ -27,7 +29,7 @@ kubectl create namespace ### Create the connection files -Save the three Redis connections as `intent-controlplane-storage.yaml`, `intent-dataplane-storage.yaml`, and `identity-service-metadata.yaml`, as shown in [Storage Secret](/content/operate/iris/intent-router/self-managed/configuration.md#storage-secret). The file names become the Secret's keys. +Save the three Redis connections as `intent-controlplane-storage.yaml`, `intent-dataplane-storage.yaml`, and `identity-service-metadata.yaml`, as shown in [Storage Secret](/content/operate/iris/self-managed/intent-router/configuration.md#storage-secret). The file names become the Secret's keys. ### Create the Secrets @@ -51,11 +53,11 @@ kubectl -n create secret generic intent-identity-runtime --from To let the chart generate a token instead, skip its Secret and delete its `existingSecret` line from the values file. The chart keeps a generated token across upgrades and never rotates it. -For an embedding provider other than `noop`, also create the inference Secret, as shown in [Embedding models](/content/operate/iris/intent-router/self-managed/configuration.md#embedding-models). +For an embedding provider other than `noop`, also create the inference Secret, as shown in [Embedding models](/content/operate/iris/self-managed/intent-router/configuration.md#embedding-models). ## 3. Create `intent-values.yaml` -Write the values file from [Helm values](/content/operate/iris/intent-router/self-managed/configuration.md#helm-values), with your tenant, image tags, and Secret names. +Write the values file from [Helm values](/content/operate/iris/self-managed/intent-router/configuration.md#helm-values), with your tenant, image tags, and Secret names. ## Before you install: check your values @@ -129,11 +131,11 @@ export IRIS_INTENT_ROUTER_SERVICE_TOKEN="$(kubectl -n get secre If the chart generated the admin token, read it from `intent-redis-intent-router-controlplane-admin-token` instead. -The [API examples](/content/operate/iris/intent-router/self-managed/api-examples.md#create-a-router) create the Router and wait until its state is `READY`. +The [API examples](/content/operate/iris/self-managed/intent-router/api-examples.md#create-a-router) create the Router and wait until its state is `READY`. ## 7. Mint an agent key -Mint a key with a grant on the Router through the Identity Service. See [Mint an agent key](/content/operate/iris/intent-router/self-managed/api-examples.md#mint-an-agent-key). +Mint a key with a grant on the Router through the Identity Service. See [Mint an agent key](/content/operate/iris/self-managed/intent-router/api-examples.md#mint-an-agent-key). ## 8. Make one authenticated call @@ -151,4 +153,4 @@ A Router with no intents returns `200` and `{"items": []}`. A `401` means the ke ## Next steps - [Define intents and match queries](/content/develop/ai/context-engine/intent-router/quickstart.md). -- [Operate the deployment](/content/operate/iris/intent-router/self-managed/operations.md). +- [Operate the deployment](/content/operate/iris/self-managed/intent-router/operations.md). diff --git a/content/operate/iris/intent-router/self-managed/operations.md b/content/operate/iris/self-managed/intent-router/operations.md similarity index 92% rename from content/operate/iris/intent-router/self-managed/operations.md rename to content/operate/iris/self-managed/intent-router/operations.md index f24c720a84..77aef5227c 100644 --- a/content/operate/iris/intent-router/self-managed/operations.md +++ b/content/operate/iris/self-managed/intent-router/operations.md @@ -9,6 +9,8 @@ description: Check health, rotate credentials, watch memory, update configuratio linkTitle: Operations weight: 90 hideListLinks: true +aliases: +- /operate/iris/intent-router/self-managed/operations/ --- This page describes how to operate self-managed Intent Router after you deploy it and give Routers to developers. It covers routine checks, such as service health and data-plane Redis memory, and how the deployment responds when Redis is unavailable. It also covers the maintenance tasks you run with `helm upgrade`: rotating credentials, updating Secrets, and upgrading the chart. It ends with backing up and uninstalling the deployment. @@ -34,17 +36,17 @@ With `tests.enabled=true`, `helm test intent -n ` probes every s ## Rotate credentials -Rotate the control plane and Identity Service tokens as described in [Rotate credentials](/content/operate/iris/intent-router/self-managed/authentication.md#rotate-credentials). To rotate an embedding provider credential, update `embedders_connection_details` in the inference Secret, update `inference.existingSecretChecksum`, and run `helm upgrade`, so the data plane rolls. +Rotate the control plane and Identity Service tokens as described in [Rotate credentials](/content/operate/iris/self-managed/intent-router/authentication.md#rotate-credentials). To rotate an embedding provider credential, update `embedders_connection_details` in the inference Secret, update `inference.existingSecretChecksum`, and run `helm upgrade`, so the data plane rolls. ## Watch the data-plane Redis -The data-plane Redis holds every Router's examples and vector index. Watch its memory against the estimate in [Size memory](/content/operate/iris/intent-router/self-managed/prerequisites.md#size-memory), and add memory before a large authoring run. Intent limits stop a Router growing past `dataplane.limits.max_intents_per_router`, but not past the memory of the database. A Router whose database runs out of memory answers `424` with `/errors/database-out-of-memory`. +The data-plane Redis holds every Router's examples and vector index. Watch its memory against the estimate in [Size memory](/content/operate/iris/self-managed/intent-router/prerequisites.md#size-memory), and add memory before a large authoring run. Intent limits stop a Router growing past `dataplane.limits.max_intents_per_router`, but not past the memory of the database. A Router whose database runs out of memory answers `424` with `/errors/database-out-of-memory`. The data plane rebuilds a Router's index if it is lost, and reports the Router ready only after the index is built. While it rebuilds, match requests return `503` with `Retry-After`. ## Handle Redis outages -A Router whose database is unreachable answers `503` with `Retry-After` until the database returns. See [Customer databases](/content/operate/iris/intent-router/self-managed/configuration.md#customer-databases) for what happens to a new Router. +A Router whose database is unreachable answers `503` with `Retry-After` until the database returns. See [Customer databases](/content/operate/iris/self-managed/intent-router/configuration.md#customer-databases) for what happens to a new Router. ## Update configuration and license Secrets diff --git a/content/operate/iris/intent-router/self-managed/prerequisites.md b/content/operate/iris/self-managed/intent-router/prerequisites.md similarity index 90% rename from content/operate/iris/intent-router/self-managed/prerequisites.md rename to content/operate/iris/self-managed/intent-router/prerequisites.md index 0f1e894317..e963291fef 100644 --- a/content/operate/iris/intent-router/self-managed/prerequisites.md +++ b/content/operate/iris/self-managed/intent-router/prerequisites.md @@ -9,9 +9,11 @@ description: Check the software, Redis databases, embedding provider, network ac linkTitle: Prerequisites weight: 20 hideListLinks: true +aliases: +- /operate/iris/intent-router/self-managed/prerequisites/ --- -Self-managed Intent Router runs on your Kubernetes cluster and depends on Redis databases, an embedding provider, and Secrets that you set up first. The chart doesn't create the databases or the provider connection for you. This page lists what you need before you [deploy the chart](/content/operate/iris/intent-router/self-managed/deploy.md): the software, the Redis databases and how to size them, the embedding provider, network access, credentials, and image tags. It ends with the Helm values that stop an install when they're wrong. +Self-managed Intent Router runs on your Kubernetes cluster and depends on Redis databases, an embedding provider, and Secrets that you set up first. The chart doesn't create the databases or the provider connection for you. This page lists what you need before you [deploy the chart](/content/operate/iris/self-managed/intent-router/deploy.md): the software, the Redis databases and how to size them, the embedding provider, network access, credentials, and image tags. It ends with the Helm values that stop an install when they're wrong. ## What you need @@ -48,11 +50,11 @@ The data plane builds one Hierarchical Navigable Small World (HNSW) vector index ### Customer databases -By default every Router keeps its data in the data-plane Redis. To let Routers live in a customer's own Redis, register those databases in the configuration. See [Customer databases](/content/operate/iris/intent-router/self-managed/configuration.md#customer-databases). +By default every Router keeps its data in the data-plane Redis. To let Routers live in a customer's own Redis, register those databases in the configuration. See [Customer databases](/content/operate/iris/self-managed/intent-router/configuration.md#customer-databases). ## Embedding provider -A deployment offers one embedding model, and every Router embeds its examples and queries with it. The data plane needs a connection to the model's provider. A Router's model is fixed when it is created, so choose the model before you create Routers. See [Embedding models](/content/operate/iris/intent-router/self-managed/configuration.md#embedding-models). +A deployment offers one embedding model, and every Router embeds its examples and queries with it. The data plane needs a connection to the model's provider. A Router's model is fixed when it is created, so choose the model before you create Routers. See [Embedding models](/content/operate/iris/self-managed/intent-router/configuration.md#embedding-models). The `noop` provider needs no connection, but it matches by shared words, not meaning. The chart refuses it unless you set `inference.allowLocalModels=true`. @@ -73,7 +75,7 @@ The chart ships `networkpolicy.reference.yaml`, a default-deny starting point. R ## Credentials and Secrets -Create these Secrets before you install: the storage Secret that holds the Redis URLs, the license Secret, and an inference Secret when you use a provider other than `noop`. The four tokens can be generated by the chart or supplied by you. See [Authentication and authorization](/content/operate/iris/intent-router/self-managed/authentication.md#credentials). +Create these Secrets before you install: the storage Secret that holds the Redis URLs, the license Secret, and an inference Secret when you use a provider other than `noop`. The four tokens can be generated by the chart or supplied by you. See [Authentication and authorization](/content/operate/iris/self-managed/intent-router/authentication.md#credentials). ## Release artifacts and image tags @@ -89,4 +91,4 @@ Rendering fails with a named message when: - Two tokens reference the same Secret key. - `dataplane.identityServiceBaseURL` isn't `https://` and `dataplane.allowInsecureIdentityService` isn't `true`. -See [Configuration](/content/operate/iris/intent-router/self-managed/configuration.md). +See [Configuration](/content/operate/iris/self-managed/intent-router/configuration.md). diff --git a/content/operate/iris/intent-router/self-managed/reference.md b/content/operate/iris/self-managed/intent-router/reference.md similarity index 92% rename from content/operate/iris/intent-router/self-managed/reference.md rename to content/operate/iris/self-managed/intent-router/reference.md index 527f668741..c88cc9ad6e 100644 --- a/content/operate/iris/intent-router/self-managed/reference.md +++ b/content/operate/iris/self-managed/intent-router/reference.md @@ -9,9 +9,11 @@ description: Look up Helm values and resolve common Intent Router deployment pro linkTitle: Configuration and troubleshooting weight: 100 hideListLinks: true +aliases: +- /operate/iris/intent-router/self-managed/reference/ --- -This page is a lookup reference for self-managed Intent Router. It lists the main Helm values with their defaults, and a troubleshooting table that matches common symptoms to their causes and fixes. For how to choose and set these values, see [Configuration](/content/operate/iris/intent-router/self-managed/configuration.md). +This page is a lookup reference for self-managed Intent Router. It lists the main Helm values with their defaults, and a troubleshooting table that matches common symptoms to their causes and fixes. For how to choose and set these values, see [Configuration](/content/operate/iris/self-managed/intent-router/configuration.md). ## Configuration reference @@ -35,7 +37,7 @@ This page is a lookup reference for self-managed Intent Router. It lists the mai | `tests.enabled` | `false` | Add `helm test` pods. | | `tracing.enabled` | `false` | Send spans to an OpenTelemetry collector. | -See [Configuration](/content/operate/iris/intent-router/self-managed/configuration.md) for the limits and match settings. +See [Configuration](/content/operate/iris/self-managed/intent-router/configuration.md) for the limits and match settings. ## Troubleshooting @@ -58,5 +60,5 @@ See [Configuration](/content/operate/iris/intent-router/self-managed/configurati ## References - [Data-plane API reference](/content/develop/ai/context-engine/intent-router/api-reference.md) -- [Control-plane API reference](/content/operate/iris/intent-router/self-managed/control-plane-api-reference.md) +- [Control-plane API reference](/content/operate/iris/self-managed/intent-router/control-plane-api-reference.md) - [Service limits and errors](/content/develop/ai/context-engine/intent-router/limits.md) diff --git a/content/operate/rc/changelog/may-2026.md b/content/operate/rc/changelog/may-2026.md index 2cd20c414a..bac5b616c2 100644 --- a/content/operate/rc/changelog/may-2026.md +++ b/content/operate/rc/changelog/may-2026.md @@ -18,7 +18,7 @@ tags: ### Redis Iris -Redis Iris is a suite of fully-managed services that give AI agents the context engine they need to reliably act on business data. Both [Redis Agent Memory](/content/operate/iris/agent-memory/_index.md) and Redis Context Retriever are now available on Redis Cloud as a public preview. +Redis Iris is a suite of fully-managed services that give AI agents the context engine they need to reliably act on business data. Both [Redis Agent Memory](/content/operate/iris/cloud/agent-memory/_index.md) and Redis Context Retriever are now available on Redis Cloud as a public preview. ### Bring your own Cloud resource tags diff --git a/content/operate/rc/context-engine/_index.md b/content/operate/rc/context-engine/_index.md index d08bf91821..0fc9d1213b 100644 --- a/content/operate/rc/context-engine/_index.md +++ b/content/operate/rc/context-engine/_index.md @@ -13,7 +13,7 @@ weight: 36 ## Redis Cloud -* [Redis Agent Memory on Redis Cloud](/content/operate/iris/agent-memory/_index.md) +* [Redis Agent Memory on Redis Cloud](/content/operate/iris/cloud/agent-memory/_index.md) Store agent memory for AI applications in Redis Cloud. * [Semantic caching with LangCache on Redis Cloud](/content/operate/iris/langcache/_index.md) diff --git a/content/operate/rc/context-engine/agent-memory/_index.md b/content/operate/rc/context-engine/agent-memory/_index.md index 9767bce0ce..02010eb186 100644 --- a/content/operate/rc/context-engine/agent-memory/_index.md +++ b/content/operate/rc/context-engine/agent-memory/_index.md @@ -15,6 +15,6 @@ aliases: Redis Agent Memory is available as a managed service on Redis Cloud. -Use the Redis Iris operational documentation to [create an Agent Memory service](/content/operate/iris/agent-memory/create-service.md), [configure its AI models](/content/operate/iris/agent-memory/model-configuration.md), or [view and manage an existing service](/content/operate/iris/agent-memory/view-service.md). +Use the Redis Iris operational documentation to [create an Agent Memory service](/content/operate/iris/cloud/agent-memory/create-service.md), [configure its AI models](/content/operate/iris/cloud/agent-memory/model-configuration.md), or [view and manage an existing service](/content/operate/iris/cloud/agent-memory/view-service.md). -For deployment options, see the [Agent Memory operational overview](/content/operate/iris/agent-memory/_index.md). +For deployment options, see the [Agent Memory operational overview](/content/operate/iris/cloud/agent-memory/_index.md).