From 9d2a8523fc909e0eb95deafed8d48f2ce77a9612 Mon Sep 17 00:00:00 2001 From: Robert Shelton Date: Mon, 2 Nov 2026 07:32:10 -0500 Subject: [PATCH 1/3] Iris docs: align Agent Memory self-managed docs with the operator runbooks Set database.databaseId to the registry key "1" in the create-store examples, correct the agent-key tenant guidance and the Identity Service rotate-grace key, and add the Redis version and image architecture requirements. Co-Authored-By: Claude Opus 5.5 --- .../iris/agent-memory/self-managed/api-examples.md | 12 ++++++++---- .../operate/iris/agent-memory/self-managed/deploy.md | 7 +++---- .../iris/agent-memory/self-managed/prerequisites.md | 7 +++++++ 3 files changed, 18 insertions(+), 8 deletions(-) diff --git a/content/operate/iris/agent-memory/self-managed/api-examples.md b/content/operate/iris/agent-memory/self-managed/api-examples.md index 1db3e8012d..014f3aeafa 100644 --- a/content/operate/iris/agent-memory/self-managed/api-examples.md +++ b/content/operate/iris/agent-memory/self-managed/api-examples.md @@ -47,11 +47,14 @@ curl -sS -X POST "$CP_URL/iris/v1/agent-memory/stores" \ -H "Content-Type: application/json" \ -d '{ "name": "my-store", - "database": { "databaseId": "" } + "database": { "databaseId": "1" } }' ``` - +`database.databaseId` is required on every create request. It names an entry in the +`databases` registry of the Data Plane and Control Plane configuration. The +[deploy walkthrough](/content/operate/iris/agent-memory/self-managed/deploy.md#3-create-ram-valuesyaml) +configures one entry, `"1"`. The response is the full store record. It includes these fields, among others: @@ -95,6 +98,7 @@ curl -sS -X POST "$CP_URL/iris/v1/agent-memory/stores" \ -H "Content-Type: application/json" \ -d '{ "name": "my-store", + "database": { "databaseId": "1" }, "longTermMemoryExclusions": { "enabled": true, "builtInDetectors": { @@ -396,7 +400,7 @@ Agent-key fields: | Endpoint | Use `/v1/api-keys`. | | `name` | Required. | | `grants` | Required. | -| `tenant` | Your tenant ID. Use the same tenant on every grant of a key. Any string is accepted. Use `1` if you manage stores with the Control Plane admin token. | +| `tenant` | The installation's tenant: the same value as Memory's `tenantId` and the Identity Service's `runtime.apiKeyTenant.singleTenantID`, for example `default`. Use the same tenant on every grant of a key. When `singleTenantID` is set, an omitted `tenant` gets that value and any other tenant returns `400`. | | `product` | Use `memory`. | | `resourceType` | Use `mem-store`. | | `resourceId` | Set to the store ID. | @@ -457,7 +461,7 @@ Response: Rotation returns a new `keyId` with the new token. Use the new `keyId` for later updates, rotations, and revocations. The old key stays valid for `graceSeconds`, which defaults to 3600 and -has a chart maximum of 604800 (`identityService.apiKeys.maxRotateGraceSeconds`). `oldExpiresAt` is +has a chart maximum of 604800 (`apiKeys.maxRotateGraceSeconds` on the Identity Service release). `oldExpiresAt` is when the old key stops working. Revoking the old `keyId` ends its grace period early. Revoke an agent key: diff --git a/content/operate/iris/agent-memory/self-managed/deploy.md b/content/operate/iris/agent-memory/self-managed/deploy.md index 869baf3976..5f9d56d0dd 100644 --- a/content/operate/iris/agent-memory/self-managed/deploy.md +++ b/content/operate/iris/agent-memory/self-managed/deploy.md @@ -437,12 +437,11 @@ RAM_ADMIN_TOKEN=$(kubectl -n get secret \ curl -sS -X POST http://localhost:9100/iris/v1/agent-memory/stores \ -H "Authorization: Bearer $RAM_ADMIN_TOKEN" \ -H "Content-Type: application/json" \ - -d '{"name": "my-store", "database": {"databaseId": ""}}' + -d '{"name": "my-store", "database": {"databaseId": "1"}}' ``` -The response carries `storeId`. - - +`database.databaseId` is required. It names an entry in the `databases` registry, here `"1"` from +`shared.databases` in [step 3](#3-create-ram-valuesyaml) and the overlay. The response carries `storeId`. ## 7. Mint an agent key diff --git a/content/operate/iris/agent-memory/self-managed/prerequisites.md b/content/operate/iris/agent-memory/self-managed/prerequisites.md index 1f3323f2a2..fb92b8db9c 100644 --- a/content/operate/iris/agent-memory/self-managed/prerequisites.md +++ b/content/operate/iris/agent-memory/self-managed/prerequisites.md @@ -45,6 +45,10 @@ license material used by the deployment. | kubectl | 1.23+ | Kubernetes CLI | | Helm | 3.x | Package manager | +Treat the Redis Agent Memory images as `linux/amd64` unless the release notes for your image +version declare a multi-architecture manifest. On clusters with ARM64 nodes, schedule Redis Agent +Memory pods onto AMD64 nodes. + ## Redis databases The Helm chart does not deploy Redis databases. Provision the Redis databases @@ -57,6 +61,9 @@ creates JSON and vector search indexes for memory data. Job Redis and Metadata Redis do not need those capabilities when they are deployed as separate Redis databases. +Store Redis must run Redis 7.2.0 through 8.4.x. Job Redis and Metadata Redis must run +Redis 6.2 or later. + {{< table-scrollable >}} | Redis database | Required | Key in the overlay Secret | Purpose | | --- | --- | --- | --- | From eb04babfc7344b1e419d9b2706d0b93c305cc7ad Mon Sep 17 00:00:00 2001 From: Robert Shelton Date: Mon, 2 Nov 2026 07:38:51 -0500 Subject: [PATCH 2/3] Iris docs: fix Identity Service paragraphs on the Intent Router auth page The Intent Router chart deploys no Identity Service. Point the control token, cache TTL and connection values at the separate Identity Service release, and note that Identity Service chart 0.10.2 does not accept the intent product. Co-Authored-By: Claude Opus 5.5 --- .../self-managed/authentication.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/content/operate/iris/intent-router/self-managed/authentication.md b/content/operate/iris/intent-router/self-managed/authentication.md index d0a7f608d5..eb92eaa282 100644 --- a/content/operate/iris/intent-router/self-managed/authentication.md +++ b/content/operate/iris/intent-router/self-managed/authentication.md @@ -21,7 +21,7 @@ This page lists each credential and what it unlocks. It also shows how to load t | --- | --- | --- | --- | --- | | Control-plane admin token | Operator → control plane (`:9400`) | The Secret in `controlplane.adminToken` | Yes, by default | Router administration: `/iris/v1/intent/routers` and `/iris/v1/intent/models` | | Control-plane internal token | Identity Service → control plane | The Secret in `controlplane.internalToken` | Yes, by default | Checking that the Router in a grant exists | -| Identity Service control token | Operator → Identity Service (`:9200`) | The Secret in `identityService.controlToken` | Yes, by default | Creating, listing, rotating, and revoking agent keys | +| Identity Service control token | Operator → Identity Service (`:9200`) | Set on the Identity Service release with `control.*`. That chart generates `-control-token` by default | Yes, by the Identity Service release | Creating, listing, rotating, and revoking agent keys | | Identity Service runtime token | Data plane → Identity Service | The Secret in `identityService.runtimeToken` | Yes, by default | Checking agent keys for `intent` | | Agent key | Application → data plane (`:9401`) | None. Returned once when minted or rotated | No | Authoring and matching on the Routers its grants name | @@ -33,13 +33,13 @@ An agent key gets `401` from the control plane. A key without a grant on a Route Every Router operation needs the admin token in `Authorization: Bearer `, and every agent-key operation needs the Identity Service control token. The health routes need no credential. -Load both from their Secrets before you call the control plane or the Identity Service. With the Secret names from [Deploy](/content/operate/iris/intent-router/self-managed/deploy.md#2-create-secrets): +Load both from their Secrets before you call the control plane or the Identity Service. The admin token uses the Secret name from [Deploy](/content/operate/iris/intent-router/self-managed/deploy.md#2-create-secrets). The control token example assumes an Identity Service release named `iris-identity-service` that generates its control token; with `control.existingSecret`, read that Secret instead: ```bash export IRIS_INTENT_ROUTER_SERVICE_TOKEN="$(kubectl -n get secret \ intent-controlplane-admin -o jsonpath='{.data.token}' | base64 --decode)" export IRIS_IDENTITY_TOKEN="$(kubectl -n get secret \ - intent-identity-control -o jsonpath='{.data.token}' | base64 --decode)" + iris-identity-service-control-token -o jsonpath='{.data.token}' | base64 --decode)" ``` ## Router authorization and grants @@ -62,20 +62,24 @@ An agent key needs a grant on each Router it uses: A grant can't use a wildcard resource ID and can't carry constraints. The Identity Service mints a key only for a Router that exists in the tenant. It asks the control plane to confirm this through the grant-validation callback, authenticated with the internal token. -The data plane checks every key with the Identity Service, which caches the answer. A revoked key stops working within the Identity Service's cache lifetime, `identityService.runtimeCache.hardTTLSeconds`, 300 seconds by default. The [API examples](/content/operate/iris/intent-router/self-managed/api-examples.md#mint-an-agent-key) show the complete request. +The data plane checks every key with the Identity Service, which caches the answer. A revoked key stops working within the Identity Service's cache lifetime, `runtime.cache.hardTtlSeconds` on the Identity Service release, 300 seconds by default. The [API examples](/content/operate/iris/intent-router/self-managed/api-examples.md#mint-an-agent-key) show the complete request. ## Configure the Identity Service -When you deploy the bundled Identity Service, the chart configures it. To use an Identity Service deployed elsewhere, set `identityService.enabled=false`, point `dataplane.identityServiceBaseURL` at it, and set `identityService.runtimeToken.existingSecret` to the runtime token it accepts. Then set these values in that Identity Service's release, so it checks grants and accepts the data plane's runtime token: +The Intent Router chart deploys no Identity Service. Install the Identity Service as its own release, point `dataplane.identityServiceBaseURL` at it, and set `identityService.credential.existingSecret` to the runtime credential it accepts. For an `http://` in-cluster URL, also set `identityService.allowInsecureTransport=true`; the FIPS profile refuses it. Then set these values in the Identity Service release, so it checks grants and accepts the data plane's runtime credential: | Identity Service value | Setting | | --- | --- | -| `runtime.serviceCredentials[]` | An entry for the data plane with a `name` and `subject` (for example `intent-dataplane`), `allowedOperations: [api-key-introspect]`, `allowedProducts: [intent]`, and `existingSecret` set to the same Secret as `identityService.runtimeToken`. | +| `runtime.serviceCredentials[]` | An entry for the data plane with a `name` and `subject` (for example `intent-dp`), `allowedOperations: [api-key-introspect]`, `allowedProducts: [intent]`, and the same `existingSecret` and `secretKey` as `identityService.credential`. | | `productValidation.products.intent.enabled` | `true` | | `productValidation.products.intent.baseURL` | The control-plane Service, for example `http://intent-redis-intent-router-controlplane:9400`. | | `productValidation.products.intent.credential.existingSecret` | The same Secret as `controlplane.internalToken`. | | `runtime.apiKeyTenant.singleTenantID` | The same value as `tenantId`. | +{{< note >}} +Identity Service chart `0.10.2` does not accept the `intent` product in `allowedProducts` or `productValidation.products`. Use an Identity Service release that supports Intent Router. +{{< /note >}} + ## Rotate credentials -To rotate a token, update its Secret and its `existingSecretChecksum` and run `helm upgrade`, so the pods roll. When the Identity Service runs in its own release, rotate the internal token there at the same time, because the two must match. Rotate an agent key with the Identity Service, as shown in [Rotate or revoke agent keys](/content/operate/iris/intent-router/self-managed/api-examples.md#rotate-or-revoke-agent-keys). +To rotate a token, update its Secret and its `existingSecretChecksum` and run `helm upgrade`, so the pods roll. Rotate the internal token on the Identity Service release at the same time, because the two must match. Rotate an agent key with the Identity Service, as shown in [Rotate or revoke agent keys](/content/operate/iris/intent-router/self-managed/api-examples.md#rotate-or-revoke-agent-keys). From f577ee83a1d3c77217ce228d516d40a00aa2d154 Mon Sep 17 00:00:00 2001 From: Robert Shelton Date: Mon, 2 Nov 2026 08:14:11 -0500 Subject: [PATCH 3/3] Iris docs: target Agent Memory and Identity Service chart 1.0.0 Retarget the self-managed pages from 0.10.2 to the 1.0.0 charts, document ownership enforcement as off by default, add agent-key user binding, replace the Playbook extraction subject-grant setup with static workload trust, and say Identity Service 1.0.0 accepts the intent product. Co-Authored-By: Claude Opus 5.5 --- .../iris/agent-memory/self-managed/_index.md | 6 ++- .../agent-memory/self-managed/api-examples.md | 1 + .../self-managed/authentication.md | 8 +-- .../self-managed/configuration.md | 54 +++++++++++++++---- .../iris/agent-memory/self-managed/deploy.md | 16 +++--- .../agent-memory/self-managed/operations.md | 15 +++--- .../self-managed/prerequisites.md | 20 +++---- .../agent-memory/self-managed/reference.md | 4 +- .../self-managed/authentication.md | 2 +- 9 files changed, 81 insertions(+), 45 deletions(-) diff --git a/content/operate/iris/agent-memory/self-managed/_index.md b/content/operate/iris/agent-memory/self-managed/_index.md index fc9196351f..fffdb88fa3 100644 --- a/content/operate/iris/agent-memory/self-managed/_index.md +++ b/content/operate/iris/agent-memory/self-managed/_index.md @@ -31,9 +31,11 @@ documents the self-managed admin endpoints for stores. ## What you are deploying -The `redis-agent-memory` chart `0.10.2` deploys the Data Plane, workers, and Control Plane. -Install the `iris-identity-service` chart `0.10.2` as a separate release first, then connect +The `redis-agent-memory` chart `1.0.0` deploys the Data Plane, workers, and Control Plane. +Install the `iris-identity-service` chart `1.0.0` as a separate release first, then connect Memory to it. Memory does not deploy Identity Service resources or include it as a subchart. +A unified Redis Iris chart that installs Memory and Identity Service as one release is planned. +These pages document the separate releases. You provide the Redis databases. Follow [Deploy](/content/operate/iris/agent-memory/self-managed/deploy.md) to configure both releases. diff --git a/content/operate/iris/agent-memory/self-managed/api-examples.md b/content/operate/iris/agent-memory/self-managed/api-examples.md index 014f3aeafa..72e3f88c04 100644 --- a/content/operate/iris/agent-memory/self-managed/api-examples.md +++ b/content/operate/iris/agent-memory/self-managed/api-examples.md @@ -406,6 +406,7 @@ Agent-key fields: | `resourceId` | Set to the store ID. | | `actions` | Use `read`, `write`, or both. | | `expiresAt` | Optional. Unix seconds after which the key stops authenticating. `0` or omitted means never. | +| `userId` | Optional. The user that owns the key. Requires `apiKeys.userBinding.enabled: true` on the Identity Service release. | | Token | Returned only when you mint or rotate a key. Store it immediately. | List agent keys: diff --git a/content/operate/iris/agent-memory/self-managed/authentication.md b/content/operate/iris/agent-memory/self-managed/authentication.md index 75d3fe2c7d..4d261b2f15 100644 --- a/content/operate/iris/agent-memory/self-managed/authentication.md +++ b/content/operate/iris/agent-memory/self-managed/authentication.md @@ -154,7 +154,7 @@ Operation mapping: Store grants authorize access to a store. Ownership enforcement adds a check within that store: ordinary callers can access their own personal records and shared records. -This section applies to on-prem deployments. Release 0.10.2 enables ownership enforcement by default in the on-prem server, worker, and chart. +This section applies to on-prem deployments. Ownership enforcement is off by default in the on-prem server, worker, and chart. Turn it on with `memory.ownership.enabled: true` after you configure a user identity; see [Enable or change ownership enforcement](#enable-or-change-ownership-enforcement). | Setting | Personal access | Shared access | | --- | --- | --- | @@ -176,13 +176,13 @@ With enforcement on: - A personal namespace child inherits its root's owner. - A caller without a user ID can access shared records within its grants, but cannot claim a named personal owner. Ownerless private records are hidden. -Ordinary agent keys created by `POST /v1/api-keys` do not contain a user binding. The API does not accept one or copy the key creator's identity. Use delegation for personal access. Configuring an OpenID Connect (OIDC) claim alone does not bind a key. +Agent keys created by `POST /v1/api-keys` have no user binding by default, and a key never copies its creator's identity. To bind a key to one user, set `apiKeys.userBinding.enabled: true` on the Identity Service release (default `false`) and send `userId` when you mint the key. The control token and a `suite_admin` can set any user ID; other callers can set only their own. The Data Plane then uses that user ID for the key's requests. For an application that acts for many users, use delegation instead. Configuring an OpenID Connect (OIDC) claim alone does not bind a key. An unbound key can pass store health checks and access allowed shared data while personal creation returns `403`. A successful health check does not establish a user identity. ### Delegate a user with an agent key -Delegation lets an application use its agent key for store permissions and a user's access token for personal identity. This path is supported in on-prem release 0.10.2. It does not add the user's store grants to the key. +Delegation lets an application use its agent key for store permissions and a user's access token for personal identity. This path is supported in on-prem release 1.0.0. It does not add the user's store grants to the key. 1. Configure your identity provider to issue signed access tokens with an issuer, a compatible user ID claim, and the intended audience. Obtain the user's token through your application's login process. 1. Configure the Data Plane to trust that issuer and its JSON Web Key Set (JWKS). Use the same tenant as the agent key and store. @@ -294,7 +294,7 @@ A missing or invalid primary credential, an invalid or expired user token, or a ### Enable or change ownership enforcement -For a new deployment, configure the user-identity path before writing personal data. If your application does not use a trusted identity provider, explicitly disable enforcement and apply [backend authorization](/content/develop/ai/context-engine/agent-memory/developer-guide.md#authorize-every-memory-request). +For a new deployment that enables enforcement, configure the user-identity path before writing personal data. If your application does not use a trusted identity provider, leave enforcement off and apply [backend authorization](/content/develop/ai/context-engine/agent-memory/developer-guide.md#authorize-every-memory-request). Before upgrading an existing deployment: diff --git a/content/operate/iris/agent-memory/self-managed/configuration.md b/content/operate/iris/agent-memory/self-managed/configuration.md index a3b152a2b5..fb59bb2c97 100644 --- a/content/operate/iris/agent-memory/self-managed/configuration.md +++ b/content/operate/iris/agent-memory/self-managed/configuration.md @@ -43,7 +43,7 @@ Data Plane settings go under `memory`, or at the top level of a BYO Data Plane c | `databases` | Required. Store Redis, as `databases."1".urls`. | | `embedding.models.default_embedding_model`, `embedding.models.dimensions` | Required. The embedding model and its vector size. The Control Plane's `embedding.dimensions` must match. | | `auth` | Data Plane authentication. Defaults to `agent_key`. | -| `ownership.enabled` | Restricts personal records to their authenticated owner while allowing shared records. Defaults to `true` in on-prem release 0.10.2. Requires a matching authenticated user ID for personal access; use an agent key with a delegated user token, or explicitly disable enforcement and authorize requests in your backend. See [Server-side ownership enforcement](/content/operate/iris/agent-memory/self-managed/authentication.md#server-side-ownership-enforcement) before enabling it. | +| `ownership.enabled` | Restricts personal records to their authenticated owner while allowing shared records. Defaults to `false`. When enabled, personal access requires a matching authenticated user ID, such as an agent key with a delegated user token. With it off, authorize requests in your backend. See [Server-side ownership enforcement](/content/operate/iris/agent-memory/self-managed/authentication.md#server-side-ownership-enforcement) before enabling it. | | `inference_providers` | Required when any `llm` block is set. Each entry holds a provider's `endpoint`. | | `server` | Data Plane bind address and port. | | `license.license_path` | Path where the license Secret is mounted. | @@ -279,19 +279,53 @@ TLS proxies. See [Network policy](/content/operate/iris/agent-memory/self-manage ## Optional Agent Playbooks extraction -On the Identity Service release, allow Memory subject grants for Agent Playbooks extraction: +Agent Playbooks extraction needs no Identity Service subject grants or extra runtime +operations. Memory trusts the Agent Playbooks workloads through their projected service +account tokens instead. + +On the Data Plane, trust the Agent Playbooks extraction worker as a static read-only subject. +Add the entry to `memory.auth.jwt_subjects` next to your existing authentication settings; +keep agent-key authentication and the Memory worker identity: + +```yaml +memory: + auth: + method: agent_key + jwt_subjects: + - issuer: + jwks_uri: https://kubernetes.default.svc/openid/v1/jwks + audience: [api://memory-dp] + subjects: + - subject: system:serviceaccount::-worker + authority: static + roles: [viewer] + resources: + "mem-store:*": {permissions: [read]} +``` + +On the Control Plane, trust the Agent Playbooks control plane as a viewer in one tenant, so it +can list and read source stores. Use the same tenant as the Agent Playbooks `tenantId`. Don't +give it `suite_admin`, which bypasses Memory's ownership checks: ```yaml -subjectGrants: - allowed: - - product: memory - resourceType: mem-store - actions: [read, read_all_owners] +controlplane: + configData: + auth: + workload_identity: + enabled: true + issuer: + jwks_uri: https://kubernetes.default.svc/openid/v1/jwks + audience: [api://memory-cp] + subjects: + - subject: system:serviceaccount::-controlplane + tenant: "" + roles: [viewer] ``` -Also add `subject-grant-lookup` to the `memory-dp` runtime credential's `allowedOperations` -alongside `api-key-introspect`. These are Identity Service values, not Memory's `identityService` -values. `read_all_owners` is a subject-grant action; do not add it to agent-key grants. +`` is the Agent Playbooks release's resource name prefix. Both Memory planes +must reach the issuer's JWKS and trust its CA; see +[worker identity](/content/operate/iris/agent-memory/self-managed/deploy.md#prepare-worker-identity-for-your-platform). +Helm replaces lists, so merge these entries with any existing ones. ## Configure document ingestion {#enable-document-ingestion} diff --git a/content/operate/iris/agent-memory/self-managed/deploy.md b/content/operate/iris/agent-memory/self-managed/deploy.md index 5f9d56d0dd..37ac03161c 100644 --- a/content/operate/iris/agent-memory/self-managed/deploy.md +++ b/content/operate/iris/agent-memory/self-managed/deploy.md @@ -22,7 +22,7 @@ These steps install Redis Agent Memory with chart-rendered configuration and age authentication, and end with one authenticated call to the Data Plane. Install Identity Service as release `ids`, then Memory as release `redis-agent-memory`. -These steps use Memory chart `0.10.2` and Identity Service chart `0.10.2` in one namespace. +These steps use Memory chart `1.0.0` and Identity Service chart `1.0.0` in one namespace. You create the shared credentials and Identity Service control token; Memory generates its Control Plane admin token. See [Credentials](/content/operate/iris/agent-memory/self-managed/authentication.md#credentials). @@ -33,7 +33,7 @@ placeholders with addresses reachable from the calling pods. Obtain their certif (CA) certificates as a PEM bundle named `service-ca.crt`; use your organization's trust bundle if the endpoints use public certificates. -Ownership enforcement is on by default. Before using an agent key with personal memories, [configure delegated user identity](/content/operate/iris/agent-memory/self-managed/authentication.md#delegate-a-user-with-an-agent-key). Applications that authorize users entirely in their backend must explicitly disable ownership enforcement in their Helm values. +Ownership enforcement is off by default, so your backend must authorize each user's access to personal memories. To have the server enforce owners, [configure delegated user identity](/content/operate/iris/agent-memory/self-managed/authentication.md#delegate-a-user-with-an-agent-key) and set `memory.ownership.enabled: true`. Before you begin, review the [prerequisites](/content/operate/iris/agent-memory/self-managed/prerequisites.md). @@ -160,7 +160,7 @@ tls: helm repo add redis-ai https://helm.redis.io/ai helm repo update redis-ai helm install ids redis-ai/iris-identity-service \ - --version 0.10.2 \ + --version 1.0.0 \ --namespace \ -f values-ids.yaml ``` @@ -307,12 +307,12 @@ memory: session_summarisation: enabled: false image: - tag: "0.10.2" + tag: "1.0.0" controlplane: internalToken: existingSecret: memory-internal-token image: - tag: "0.10.2" + tag: "1.0.0" config: render: true configData: @@ -347,7 +347,7 @@ tls: `/etc/identity-service/runtime/memory-dp/token`. Do not hand-set the introspection endpoint or credential under `memory.auth` or `shared.auth`. - `tenantId: default` matches `runtime.apiKeyTenant.singleTenantID` in `values-ids.yaml`. The Control Plane creates admin-token stores in this tenant. -- Both charts use application version `0.10.2`. The example pins Memory's Data Plane +- Both charts use application version `1.0.0`. The example pins Memory's Data Plane and Control Plane images to that version. {{< note >}} @@ -376,7 +376,7 @@ its row. The rows are checklist items CL-1 to CL-6. helm repo add redis-ai https://helm.redis.io/ai helm repo update redis-ai helm install redis-agent-memory redis-ai/redis-agent-memory \ - --version 0.10.2 \ + --version 1.0.0 \ --namespace \ -f ram-values.yaml kubectl -n get pods -w @@ -388,7 +388,7 @@ If you want Helm to wait, set an explicit timeout that matches the environment: ```bash helm install redis-agent-memory redis-ai/redis-agent-memory \ - --version 0.10.2 \ + --version 1.0.0 \ --namespace \ -f ram-values.yaml \ --wait \ diff --git a/content/operate/iris/agent-memory/self-managed/operations.md b/content/operate/iris/agent-memory/self-managed/operations.md index ee6380f736..5318f81f24 100644 --- a/content/operate/iris/agent-memory/self-managed/operations.md +++ b/content/operate/iris/agent-memory/self-managed/operations.md @@ -82,12 +82,12 @@ kubectl -n create secret generic memory-dp-credential \ RUNTIME_CREDENTIAL_CHECKSUM="$(shasum -a 256 ./memory-dp-token | awk '{print $1}')" helm upgrade ids redis-ai/iris-identity-service \ - --version 0.10.2 \ + --version 1.0.0 \ --namespace \ -f values-ids.yaml \ --set-string "runtime.serviceCredentials[0].existingSecretChecksum=$RUNTIME_CREDENTIAL_CHECKSUM" helm upgrade redis-agent-memory redis-ai/redis-agent-memory \ - --version 0.10.2 \ + --version 1.0.0 \ --namespace \ -f ram-values.yaml \ --set-string "identityService.credential.existingSecretChecksum=$RUNTIME_CREDENTIAL_CHECKSUM" @@ -174,8 +174,7 @@ kubectl -n rollout restart deployment Memory and Identity Service have independent release versions. Upgrade each with its own values file and verify their shared connection contract afterward. A Memory upgrade does not -upgrade Identity Service. The published pair documented here is Memory `0.10.2` and Identity -Service `0.10.2`. +upgrade Identity Service. The pair documented here is Memory `1.0.0` and Identity Service `1.0.0`. For updates within a supported release path: @@ -287,15 +286,15 @@ Memory also ships a `values-fips.yaml` overlay. Apply it only to Memory, and con Identity Service release's posture separately: ```bash -helm pull redis-ai/redis-agent-memory --version 0.10.2 --untar +helm pull redis-ai/redis-agent-memory --version 1.0.0 --untar helm upgrade redis-agent-memory redis-ai/redis-agent-memory \ - --version 0.10.2 \ + --version 1.0.0 \ --namespace \ -f ram-values.yaml \ -f redis-agent-memory/values-fips.yaml helm upgrade ids redis-ai/iris-identity-service \ - --version 0.10.2 \ + --version 1.0.0 \ --namespace \ -f values-ids.yaml ``` @@ -346,7 +345,7 @@ the direct caller also has a valid Redis Agent Memory credential. The chart includes `networkpolicy.reference.yaml` at the chart root as a reference manifest. Get it with -`helm pull redis-ai/redis-agent-memory --version 0.10.2 --untar`. It is not templated because allowed callers are +`helm pull redis-ai/redis-agent-memory --version 1.0.0 --untar`. It is not templated because allowed callers are environment-specific. Customize the placeholders before applying it: diff --git a/content/operate/iris/agent-memory/self-managed/prerequisites.md b/content/operate/iris/agent-memory/self-managed/prerequisites.md index fb92b8db9c..6bfd167cc6 100644 --- a/content/operate/iris/agent-memory/self-managed/prerequisites.md +++ b/content/operate/iris/agent-memory/self-managed/prerequisites.md @@ -18,7 +18,7 @@ aliases: Redis Agent Memory is distributed as container images on Docker Hub plus a Helm chart in the Redis AI Helm repository. The chart deploys the Redis Agent Memory Data Plane, Redis Agent Memory workers, and the Redis Agent Memory Control Plane. Install Identity -Service separately with the `iris-identity-service` chart `0.10.2` before connecting Memory chart `0.10.2`. +Service separately with the `iris-identity-service` chart `1.0.0` before connecting Memory chart `1.0.0`. You provide the Redis databases, provider credentials, Kubernetes exposure, and license material used by the deployment. @@ -32,7 +32,7 @@ license material used by the deployment. | Item | Where it comes from | | ---- | ------------------- | | Container images | Docker Hub: `redislabs/agent-memory`, `redislabs/agent-memory-control-plane`, and `redislabs/iris-identity-service` | -| Helm charts | `redis-agent-memory` `0.10.2` and `iris-identity-service` `0.10.2` in the Redis AI Helm repository | +| Helm charts | `redis-agent-memory` `1.0.0` and `iris-identity-service` `1.0.0` in the Redis AI Helm repository | | Redis databases | You provide Store Redis, Job Redis, and Metadata Redis | | License key | Contact your Redis representative or [contact sales](https://redis.io/contact/). | | Provider credentials | You provide embedding provider credentials and, when worker features are enabled, promotion or summarization LLM credentials | @@ -131,14 +131,14 @@ To supply a complete configuration file in your own Secret instead, see ## Release artifacts and image tags -The published Memory chart `0.10.2` defaults `image.tag` and `controlplane.image.tag` to `0.10.2`. -Identity Service chart `0.10.2` defaults its image to its own application version, `0.10.2`. +Memory chart `1.0.0` defaults `image.tag` and `controlplane.image.tag` to `1.0.0`. +Identity Service chart `1.0.0` defaults its image to its own application version, `1.0.0`. Set tags explicitly when pinning images or using a mirror. The releases have independent versions. Both charts are published at `https://helm.redis.io/ai` as `redis-ai/redis-agent-memory` and `redis-ai/iris-identity-service`. Their standard images are -`redislabs/agent-memory:0.10.2`, `redislabs/agent-memory-control-plane:0.10.2`, and -`redislabs/iris-identity-service:0.10.2`. +`redislabs/agent-memory:1.0.0`, `redislabs/agent-memory-control-plane:1.0.0`, and +`redislabs/iris-identity-service:1.0.0`. ## Air-gapped and private registry installs @@ -154,9 +154,9 @@ Mirror these images into your internal registry: | `python:3.13-alpine` | Optional, with `tests.smoke` | | `curlimages/curl:8.17.0` | Optional, for `helm test` on the Identity Service release (`tests.image` in `values-ids.yaml`) | -For this release, `` is `0.10.2` and `` is `0.10.2`. -Inspect each package with `helm show chart redis-ai/redis-agent-memory --version 0.10.2` -and `helm show chart redis-ai/iris-identity-service --version 0.10.2`. Memory does not pin +For this release, `` is `1.0.0` and `` is `1.0.0`. +Inspect each package with `helm show chart redis-ai/redis-agent-memory --version 1.0.0` +and `helm show chart redis-ai/iris-identity-service --version 1.0.0`. Memory does not pin or install the Identity Service chart. ```bash @@ -205,7 +205,7 @@ Configure the separate Identity Service release in `values-ids.yaml`: ```yaml image: repository: registry.example.com/redislabs/iris-identity-service - tag: "0.10.2" + tag: "1.0.0" tests: image: registry.example.com/curlimages/curl:8.17.0 global: diff --git a/content/operate/iris/agent-memory/self-managed/reference.md b/content/operate/iris/agent-memory/self-managed/reference.md index b8706001c2..f2fd6ad8d0 100644 --- a/content/operate/iris/agent-memory/self-managed/reference.md +++ b/content/operate/iris/agent-memory/self-managed/reference.md @@ -82,8 +82,8 @@ CSI-synced Secrets, make sure a Control Plane pod also mounts the corresponding | Need | Reference | | --- | --- | -| Helm chart values | `values.yaml` at the chart root (`helm pull redis-ai/redis-agent-memory --version 0.10.2 --untar`) | -| Identity Service chart values | `helm show values redis-ai/iris-identity-service --version 0.10.2` | +| Helm chart values | `values.yaml` at the chart root (`helm pull redis-ai/redis-agent-memory --version 1.0.0 --untar`) | +| Identity Service chart values | `helm show values redis-ai/iris-identity-service --version 1.0.0` | | FIPS values overlay | `values-fips.yaml` at the chart root | | NetworkPolicy reference | `networkpolicy.reference.yaml` at the chart root | | Chart README | `README.md` at the chart root | diff --git a/content/operate/iris/intent-router/self-managed/authentication.md b/content/operate/iris/intent-router/self-managed/authentication.md index eb92eaa282..76eda08ece 100644 --- a/content/operate/iris/intent-router/self-managed/authentication.md +++ b/content/operate/iris/intent-router/self-managed/authentication.md @@ -77,7 +77,7 @@ The Intent Router chart deploys no Identity Service. Install the Identity Servic | `runtime.apiKeyTenant.singleTenantID` | The same value as `tenantId`. | {{< note >}} -Identity Service chart `0.10.2` does not accept the `intent` product in `allowedProducts` or `productValidation.products`. Use an Identity Service release that supports Intent Router. +Use Identity Service chart `1.0.0` or later. Earlier releases don't accept the `intent` product in `allowedProducts` or `productValidation.products`. {{< /note >}} ## Rotate credentials