Iris docs: align Context Gateway and Intent Router self-managed docs with the operator runbooks

content/operate/iris/context-gateway/self-managed/_index.md

@@ -17,7 +17,7 @@ The `redis-context-gateway` Helm chart deploys one tenant's Context Gateway Cont
 
 Agents call the Data Plane's Model Context Protocol (MCP) endpoint, described in the [MCP API Reference](/content/develop/ai/context-engine/context-gateway/api-reference.md). The [Control Plane API Reference](/content/operate/iris/context-gateway/self-managed/control-plane-api-reference.md) documents the self-managed administration endpoints for Gateways and Upstreams.
 
-Set the chart version and image tags from the approved release manifest. Use a release that includes the unified Gateway API and GA hardening described in these guides.
+Set the chart version from the approved release. Each chart release pins its matching Control Plane and Data Plane images by default. Use a release that includes the unified Gateway API and GA hardening described in these guides.
 
 <!-- TODO: Replace with the published chart version and the global Iris release instructions at GA. -->
 

content/operate/iris/context-gateway/self-managed/configuration.md

@@ -237,6 +237,8 @@ Both planes serve Prometheus metrics at `/metrics`. Set `shared.config.opentelem
 
 ## Scale and schedule the planes
 
-Each plane starts one replica. Set `replicaCount`, or turn on `autoscaling`, with `resources`, `nodeSelector`, `tolerations`, and `affinity` under `controlplane` and `dataplane`. The probes are chart-managed. Leave headroom for old and new pods during upgrades.
+Each plane starts one replica. Set `replicaCount`, or turn on `autoscaling`, with `resources`, `nodeSelector`, `tolerations`, and `affinity` under `controlplane` and `dataplane`. Autoscaling is off by default, needs Metrics Server, and needs `resources.requests.cpu` or `resources.requests.memory` for each target it uses. Leave headroom for old and new pods during upgrades.
+
+The `startupProbe`, `livenessProbe`, and `readinessProbe` of each plane use `/health/liveness` and `/health/readiness` by default, and accept native Kubernetes probe fields. Set a probe to `null` to turn it off. The default startup probe allows 150 seconds before liveness checks begin.
 
 <!-- TODO: Add qualified production sizing and availability guidance for the launch release. -->

content/operate/iris/context-gateway/self-managed/deploy.md

@@ -76,7 +76,7 @@ Create a `databaseConnections` Secret for the registered databases. See [Databas
 
 ## 3. Create `gateway-values.yaml`
 
-Save this file, replacing the angle-bracket placeholders with your tenant, public Data Plane origin, and approved release image tags. It uses the Secrets created in step 2 and an Identity Service release named `ids` in the same namespace.
+Save this file, replacing the angle-bracket placeholders with your tenant and public Data Plane origin. The chart's default images match its version, so the file sets no image values. It uses the Secrets created in step 2 and an Identity Service release named `ids` in the same namespace.
 
 ```yaml
 tenantId: <tenant-id>
@@ -101,19 +101,13 @@ credentialStorage:
       k1: k1
     activeKeyId: k1
 controlplane:
-  image:
-    repository: redislabs/iris-context-gateway-control
-    tag: <control-plane-image-tag>
   adminToken:
     existingSecret: gateway-admin
     secretKey: token
   internalToken:
     existingSecret: gateway-grant-validation
     secretKey: token
 dataplane:
-  image:
-    repository: redislabs/iris-context-gateway-data
-    tag: <data-plane-image-tag>
   runtimeToken:
     existingSecret: gateway-runtime
     secretKey: token
@@ -135,7 +129,7 @@ Check each value in `gateway-values.yaml` before you install. If one is wrong, y
 | `identityService.allowInsecureTransport` is `true` for an `http://` Identity Service URL | Rendering fails with `HTTP Identity Service requires explicit allowInsecureTransport`. | Set it, or use an `https://` URL. |
 | The admin, internal, and runtime tokens come from three different Secrets or keys | Rendering fails, or the Identity Service cannot check keys | Create three distinct token files. |
 | `license` points to a valid license | The Control Plane's `/health/readiness` answers `503`, and an invalid license stops either plane at startup | Mount the license file as issued. |
-| Both component `image.repository` and `image.tag` are set | Pods `ImagePullBackOff` | Set both to the release images. |
+| Any `image.repository` or `image.tag` override names an image your cluster can pull | Pods `ImagePullBackOff` | Remove the overrides to use the chart's default images, or mirror those images unchanged. |
 {{< /table-scrollable >}}
 
 ## 4. Install
@@ -150,7 +144,7 @@ helm install gateway redis-ai/redis-context-gateway \
   --wait --timeout 5m
 ```
 
-Use the chart version and image tags supplied for the same release. A merged server change does not by itself publish a chart or image.
+Use a published chart version. A merged server change does not by itself publish a chart or image.
 
 ## 5. Verify pods and health
 

content/operate/iris/context-gateway/self-managed/operations.md

@@ -90,7 +90,9 @@ Back up Metadata Redis and credential storage together. A Gateway record without
 
 ## Upgrade the chart
 
-Upgrade both planes together and roll forward, not back. An older Data Plane cannot read tool policy members that a newer Control Plane wrote, and serves those tools uncached.
+Upgrade both planes together and roll forward, not back. An older Data Plane cannot read tool policy members that a newer Control Plane wrote, and serves those tools uncached. `helm rollback` restores the release's Kubernetes resources only. It does not undo database writes or restore external Secrets.
+
+Chart 0.2.0 renamed the `dataplane.config` blocks `result_cache` to `cache` and `result_handles` to `compression`. Every nested key keeps its name. Move these settings before you upgrade: the values schema rejects the old blocks, and a Data Plane ignores them. Upgrade the chart and images together, because an older image ignores the new keys and leaves both features off. The same release renamed the Gateway fields `resultCache` and `resultHandles` to `cache` and `compression`. Gateways stored under the old names lose their settings and tool policies, so set them again.
 
 After an upgrade, refresh an Upstream's catalog when the release notes ask for it.
 

content/operate/iris/context-gateway/self-managed/prerequisites.md

@@ -108,13 +108,13 @@ Redis URLs, tokens, keyrings, and the license belong in Kubernetes Secrets or Se
 | Control Plane | `redislabs/iris-context-gateway-control:<control-plane-image-tag>` |
 | Data Plane | `redislabs/iris-context-gateway-data:<data-plane-image-tag>` |
 
-Set both `image.repository` and `image.tag` from the release manifest.
+The chart defaults to these repositories and pins the image tags that match its chart version. Leave `image.repository` and `image.tag` unset for a public install, and override them only to pull from a mirror.
 
 <!-- TODO: Add the published image tags and chart version from the release manifest. -->
 
 ## Air-gapped and private registry installs
 
-For a disconnected installation, mirror both images to your registry, set each component's `image.repository`, and set `imagePullSecrets`. Install from a downloaded chart package instead of the Redis AI Helm repository.
+For a disconnected installation, mirror both images to your registry with their tags unchanged, set each component's `image.repository` and `image.tag`, and set `imagePullSecrets`. Install from a downloaded chart package instead of the Redis AI Helm repository.
 
 ## Helm values to review
 

content/operate/iris/intent-router/self-managed/_index.md

@@ -15,7 +15,7 @@ Intent Router classifies each incoming user message by intent, so your applicati
 
 This guide is for that administrator. It covers deploying Intent Router on your own Kubernetes cluster with a Helm chart, then configuring, securing, and operating it. To install, start with the [prerequisites](/content/operate/iris/intent-router/self-managed/prerequisites.md).
 
-The `redis-intent-router` Helm chart deploys one tenant's Intent Router control plane and data plane. By default it also deploys an Identity Service that issues and checks agent keys. You provide the Redis databases, the embedding provider credentials, and the license.
+The `redis-intent-router` Helm chart deploys one tenant's Intent Router control plane and data plane. It deploys no Identity Service: it connects to an Identity Service release that you install separately, which issues and checks agent keys. You provide the Identity Service release, the Redis databases, the embedding provider credentials, and the license.
 
 Applications call the data plane to author intents and match queries, as described in the [data-plane API reference](/content/develop/ai/context-engine/intent-router/api-reference.md). The [control-plane API reference](/content/operate/iris/intent-router/self-managed/control-plane-api-reference.md) documents the administration endpoints for Routers.
 
@@ -28,7 +28,7 @@ Set the chart version and image tags from the release manifest for your deployme
 | --- | --- | --- |
 | Control plane | Create and manage Routers, and validate agent-key grants. | `9400` |
 | Data plane | Store intents and examples, build each Router's vector index, and serve matching. | `9401` |
-| Identity Service | Issue agent keys and check them for the data plane. | `9200` |
+| Identity Service | Issue agent keys and check them for the data plane. Installed as its own release. | `9200` |
 | Metadata Redis | Store Router records and the mailbox the planes coordinate through. | Customer-provided |
 | Data-plane Redis | Store intents, examples, and a vector index for each Router. Needs Redis Search. | Customer-provided |
 | Embedding provider | Embed examples and queries. | Customer-provided |

content/operate/iris/intent-router/self-managed/authentication.md

@@ -11,7 +11,7 @@ weight: 60
 hideListLinks: true
 ---
 
-Self-managed Intent Router uses two kinds of credentials. Service tokens authenticate operators and the Intent Router components to each other, and the chart generates them for you by default. Agent keys authenticate applications to the data plane, and each key's grants control which Routers it can use and what it can do on them.
+Self-managed Intent Router uses two kinds of credentials. Service tokens authenticate operators and the Intent Router components to each other. The chart generates the control-plane tokens for you by default. Agent keys authenticate applications to the data plane, and each key's grants control which Routers it can use and what it can do on them.
 
 This page lists each credential and what it unlocks. It also shows how to load the administration tokens and how grants authorize agent keys. It then covers connecting an Identity Service deployed outside this chart and rotating credentials.
 
@@ -25,7 +25,7 @@ This page lists each credential and what it unlocks. It also shows how to load t
 | Identity Service runtime token | Data plane → Identity Service | The Secret in `identityService.runtimeToken` | Yes, by default | Checking agent keys for `intent` |
 | Agent key | Application → data plane (`:9401`) | None. Returned once when minted or rotated | No | Authoring and matching on the Routers its grants name |
 
-Every token defaults to `autoGenerate: true`: without `existingSecret`, the chart creates a random Secret named `<release>-redis-intent-router-<component>-token`, with the key `token`, keeps it across upgrades, and never rotates it. For a release named `intent`, the admin token is in `intent-redis-intent-router-controlplane-admin-token`. Set `existingSecret` to supply your own, and set the matching `existingSecretChecksum` so the pods roll when the Secret changes. Two credentials can't reference the same Secret key, and rendering fails if they do.
+`controlplane.adminToken` and `controlplane.internalToken` default to `autoGenerate: true`: without `existingSecret`, the chart creates a random Secret named `<release>-redis-intent-router-controlplane-admin-token` or `-internal-token`, with the key `token`, keeps it across upgrades, and never rotates it. For a release named `intent`, the admin token is in `intent-redis-intent-router-controlplane-admin-token`. The chart never generates `identityService.credential`. Set `existingSecret` to supply your own, and set the matching `existingSecretChecksum` so the pods roll when the Secret changes. Two credentials can't reference the same Secret key, and rendering fails if they do.
 
 An agent key gets `401` from the control plane. A key without a grant on a Router, or without the action an operation needs, gets `403` from the data plane. The data plane holds no credential for the control plane: the planes never call each other.
 

content/operate/iris/intent-router/self-managed/configuration.md

@@ -25,9 +25,11 @@ Set these values for every install:
 | `storage.existingSecret` | The Secret that holds the Redis connection overlays. Required. |
 | `license.existingSecret` | The Secret that holds the license. Required. |
 | `inference.models` | The embedding model the deployment offers. Required. |
-| `controlplane.image`, `dataplane.image`, `identityService.image` | An explicit `tag` for each image. The repositories default to `redislabs/iris-intent-router-control`, `redislabs/iris-intent-router-data`, and `redislabs/iris-identity-service`. |
+| `controlplane.image`, `dataplane.image` | An explicit `tag` for each image. The repositories default to `redislabs/iris-intent-router-control` and `redislabs/iris-intent-router-data`. |
 | `controlplane.adminToken`, `controlplane.internalToken` | The control plane's tokens. |
-| `identityService.controlToken`, `identityService.runtimeToken` | The Identity Service's tokens. |
+| `dataplane.identityServiceBaseURL` | The URL of your Identity Service release. The data plane checks agent keys there. Required. |
+| `identityService.credential` | The data plane's runtime credential, registered on the Identity Service release. Required. |
+| `identityService.allowInsecureTransport` | `true` to accept an `http://` Identity Service URL. Default `false`. |
 
 A minimal values file looks like this:
 
@@ -44,19 +46,15 @@ controlplane:
     existingSecret: intent-controlplane-internal
 
 dataplane:
-  allowInsecureIdentityService: true
   image:
     repository: redislabs/iris-intent-router-data
     tag: <tag>
+  identityServiceBaseURL: http://iris-identity-service:9200
 
 identityService:
-  image:
-    repository: redislabs/iris-identity-service
-    tag: <tag>
-  controlToken:
-    existingSecret: intent-identity-control
-  runtimeToken:
-    existingSecret: intent-identity-runtime
+  allowInsecureTransport: true
+  credential:
+    existingSecret: intent-dp-credential
 
 license:
   existingSecret: intent-license
@@ -74,7 +72,7 @@ inference:
 
 To let the chart generate a token instead, delete its `existingSecret` line. See [Credentials](/content/operate/iris/intent-router/self-managed/authentication.md#credentials).
 
-The bundled Identity Service speaks plain Hypertext Transfer Protocol (HTTP) inside the cluster, and the data plane rejects an `http://` introspection URL. Rendering fails until you choose: set `dataplane.identityServiceBaseURL` to an `https://` endpoint, or set `dataplane.allowInsecureIdentityService=true` to accept cleartext introspection on the pod network.
+The `identityService` block holds only `allowInsecureTransport` and `credential`. The chart deploys no Identity Service. An in-cluster Identity Service Service speaks plain Hypertext Transfer Protocol (HTTP), and the chart rejects an `http://` Identity Service URL by default. Rendering fails until you choose: set `dataplane.identityServiceBaseURL` to an `https://` endpoint, or set `identityService.allowInsecureTransport=true` to accept cleartext introspection on the pod network. The FIPS profile refuses `allowInsecureTransport`.
 
 ## Storage Secret
 
@@ -84,7 +82,6 @@ One Secret holds a YAML overlay for each service, merged over the rendered confi
 | --- | --- | --- |
 | `intent-controlplane-storage.yaml` | `storage.controlplaneKey` | `storage.metadata.urls`: Router records. |
 | `intent-dataplane-storage.yaml` | `storage.dataplaneKey` | `storage.redis.urls`: intents, examples, and the per-Router vector indexes. `runtime.redis.urls`: the mailbox Redis, which is the control plane's metadata Redis. |
-| `identity-service-metadata.yaml` | `storage.identityServiceKey` | `metadata.urls`: agent-key records. |
 
 `intent-controlplane-storage.yaml`:
 
@@ -108,13 +105,7 @@ runtime:
       - rediss://<metadata-user>:<metadata-password>@<metadata-host>:6379
 ```
 
-`identity-service-metadata.yaml`:
-
-```yaml
-metadata:
-  urls:
-    - rediss://<identity-user>:<identity-password>@<metadata-host>:6379
-```
+The Identity Service's metadata Redis belongs to the Identity Service release, not to this Secret.
 
 In the mailbox Redis, the data plane reads and writes only the mailbox keys under `storage.keyPrefix`. Nothing else of the control plane's data is touched. Keep real URLs and passwords in the Secret, not in values files.
 
@@ -129,6 +120,7 @@ embedders_connection_details:
   openai:
     base_url: https://api.openai.com/v1
     credentials:
+      type: static
       api_key: <openai-api-key>
 ```
 
@@ -178,6 +170,7 @@ Tune `dataplane.search` for index recall and memory: `hnsw.m`, `hnsw.ef_construc
 | `controlplane.reconcile.interval` | `5s` | How often the control plane reconciles Routers with the data plane's status. |
 | `controlplane.reconcile.provisioningDeadline` | `10m` | How long a new Router can stay `PROVISIONING` before it fails. |
 | `dataplane.pollInterval` | `2s` | How often the data plane reads the mailbox for Router changes. |
+| `dataplane.startupBudget` | `20s` | How long the data plane's first convergence pass can run before it opens its listener. At most `40s`, because the liveness probe restarts the pod 50 seconds after start. Routers the pass doesn't reach are picked up by later passes. |
 
 A Router change reaches the data plane within about one poll interval.
 
@@ -187,10 +180,10 @@ Set `tls.caCertSecret` to a Secret that holds additional certificate authority (
 
 ## FIPS and tracing
 
-Set `security.profile: fips` to select the FIPS runtime. Rendering rejects a FIPS release without explicit HTTP Secure (HTTPS) peers: `dataplane.identityServiceBaseURL` and, with the bundled Identity Service, `identityService.controlPlaneBaseURL`. Use `rediss://` URLs in the storage Secret, including `runtime.redis.urls` and any customer databases: each service checks them when it starts and refuses to run without them. FIPS never allows cleartext Identity Service transport.
+Set `security.profile: fips` to select the FIPS runtime. Rendering rejects a FIPS release unless `dataplane.identityServiceBaseURL` is an explicit HTTP Secure (HTTPS) endpoint, and refuses `identityService.allowInsecureTransport`. Set the FIPS profile and an `https://` grant-validation URL on the Identity Service release too. Use `rediss://` URLs in the storage Secret, including `runtime.redis.urls` and any customer databases. Rendering can't check them, because they live in the Secret, and the data plane refuses to start in the FIPS profile if any of them isn't `rediss://`.
 
 Set `tracing.enabled` and `tracing.otlpGRPCEndpoint` to send spans to your OpenTelemetry collector over the OpenTelemetry Protocol (OTLP). The exporter uses plaintext gRPC, so use a trusted local hop.
 
 ## Scale and schedule the planes
 
-The control plane, data plane, and Identity Service scale independently. Set `replicaCount`, `resources`, `nodeSelector`, `tolerations`, and `affinity` for each in the chart values. The data plane carries the matching load, so scale it first.
+The control plane and data plane scale independently. Set `replicaCount`, `resources`, `nodeSelector`, `tolerations`, and `affinity` for each in the chart values. Scale the Identity Service in its own release. The data plane carries the matching load, so scale it first.