From 5b12643f190ca53370bc806e7118197ffa213297 Mon Sep 17 00:00:00 2001 From: Ivo Bardarov Date: Wed, 4 Nov 2026 01:09:56 +0200 Subject: [PATCH] Iris self-managed docs: align with the redis-iris global Helm chart release Pin every product chart and the Identity Service at the lockstep 1.0.0 release, state the Kubernetes 1.28 and Helm 3.10 floor (Helm 4 not supported at GA), document the new PodDisruptionBudget and rollout-strategy values, and add an "Install with the Redis Iris suite chart" section to each product's deploy guide listing the values the suite derives from global.iris. Context Gateway gains its Data Plane Ingress values, Memory its controller-agnostic Ingress note and the data-plane OIDC render failure, Playbook its suite extraction path, Intent Router its air-gapped image list, and Lens loses two answered TODOs. --- .../iris/agent-memory/self-managed/_index.md | 5 ++- .../self-managed/configuration.md | 3 ++ .../iris/agent-memory/self-managed/deploy.md | 33 ++++++++++++++- .../agent-memory/self-managed/operations.md | 8 ++-- .../self-managed/prerequisites.md | 15 +++---- .../agent-memory/self-managed/reference.md | 3 +- .../agent-playbook/self-managed/deploy.md | 29 +++++++++++++- .../agent-playbook/self-managed/extraction.md | 4 ++ .../self-managed/prerequisites.md | 12 +++--- .../agent-playbook/self-managed/reference.md | 3 ++ .../context-gateway/self-managed/_index.md | 2 +- .../self-managed/configuration.md | 3 ++ .../context-gateway/self-managed/deploy.md | 40 ++++++++++++++++++- .../self-managed/operations.md | 2 +- .../self-managed/prerequisites.md | 10 ++--- .../iris/intent-router/self-managed/_index.md | 2 +- .../self-managed/authentication.md | 2 +- .../self-managed/configuration.md | 2 + .../iris/intent-router/self-managed/deploy.md | 38 +++++++++++++++++- .../intent-router/self-managed/operations.md | 2 +- .../self-managed/prerequisites.md | 6 +-- .../operate/iris/lens/self-managed/_index.md | 5 +-- .../iris/lens/self-managed/authentication.md | 2 +- .../iris/lens/self-managed/configuration.md | 10 ++--- .../operate/iris/lens/self-managed/deploy.md | 35 ++++++++++++++-- .../iris/lens/self-managed/operations.md | 4 +- .../iris/lens/self-managed/prerequisites.md | 8 ++-- 27 files changed, 229 insertions(+), 59 deletions(-) diff --git a/content/operate/iris/agent-memory/self-managed/_index.md b/content/operate/iris/agent-memory/self-managed/_index.md index 3ba8743d73..e15e233a9e 100644 --- a/content/operate/iris/agent-memory/self-managed/_index.md +++ b/content/operate/iris/agent-memory/self-managed/_index.md @@ -32,9 +32,10 @@ documents the self-managed admin endpoints for stores. ## What you are deploying The `redis-agent-memory` chart `1.0.0` deploys the Data Plane, workers, and Control Plane. -Install the `iris-identity-service` chart `1.2.0` as a separate release first, then connect +Install the `iris-identity-service` chart `1.0.0` as a separate release first, then connect Memory to it. Memory does not deploy Identity Service resources or include it as a subchart. -A unified Redis Iris chart that installs Memory and Identity Service as one release is planned. +To install Memory, Identity Service, and the UI as one release, use the +[`redis-iris` Helm chart](/content/operate/iris/agent-memory/self-managed/deploy.md#install-with-the-redis-iris-suite-chart). These pages document the separate releases. You provide the Redis databases. Follow [Deploy](/content/operate/iris/agent-memory/self-managed/deploy.md) to configure both releases. diff --git a/content/operate/iris/agent-memory/self-managed/configuration.md b/content/operate/iris/agent-memory/self-managed/configuration.md index fb59bb2c97..4c73c04f74 100644 --- a/content/operate/iris/agent-memory/self-managed/configuration.md +++ b/content/operate/iris/agent-memory/self-managed/configuration.md @@ -327,6 +327,9 @@ must reach the issuer's JWKS and trust its CA; see [worker identity](/content/operate/iris/agent-memory/self-managed/deploy.md#prepare-worker-identity-for-your-platform). Helm replaces lists, so merge these entries with any existing ones. +With the `redis-iris` Helm chart, set `global.iris.extraction.enabled: true` instead. The suite +derives both entries, and a differing value under `memory:` fails the render. + ## Configure document ingestion {#enable-document-ingestion} Document ingestion is enabled in self-managed deployments. Configure the server and worker together through chart-rendered values. This example sets explicit processing limits: diff --git a/content/operate/iris/agent-memory/self-managed/deploy.md b/content/operate/iris/agent-memory/self-managed/deploy.md index a2e36a3e25..4592ad9f20 100644 --- a/content/operate/iris/agent-memory/self-managed/deploy.md +++ b/content/operate/iris/agent-memory/self-managed/deploy.md @@ -22,7 +22,7 @@ These steps install Redis Agent Memory with chart-rendered configuration and age authentication, and end with one authenticated call to the Data Plane. Install Identity Service as release `ids`, then Memory as release `redis-agent-memory`. -These steps use Memory chart `1.0.0` and Identity Service chart `1.2.0` in one namespace. +These steps use Memory chart `1.0.0` and Identity Service chart `1.0.0` in one namespace. You create the shared credentials and Identity Service control token; Memory generates its Control Plane admin token. See [Credentials](/content/operate/iris/agent-memory/self-managed/authentication.md#credentials). @@ -162,7 +162,7 @@ tls: helm repo add redis-ai https://helm.redis.io/ai helm repo update redis-ai helm install ids redis-ai/iris-identity-service \ - --version 1.2.0 \ + --version 1.0.0 \ --namespace \ -f values-ids.yaml ``` @@ -616,6 +616,35 @@ does not migrate existing stores or their vector indexes. After switching, creat and agent key using steps 6–7 for local evaluation. Existing stores retain their original embedding dimensions and cannot be reused with this example. +## Install with the Redis Iris suite chart + +The `redis-iris` Helm chart installs Agent Memory with the Identity Service and the UI in one +release. Memory is on when `global.iris.products.memory.enabled` is `true`, the default; set the +`enabled` flag of each product you don't install to `false`. Put Memory's values under the +`memory:` key, so this guide's `memory.auth` becomes `memory.memory.auth`. + +The suite derives these Memory values from `global.iris`. Don't set them under `memory:`: a +differing value fails the render and names the field. + +- The Identity Service connection: `dataplane.identityServiceBaseURL` and `identityService.allowInsecureTransport`. +- The runtime credential and internal token: `identityService.credential` and `controlplane.internalToken`, generated by the suite or read from `global.iris.secrets`. +- The tenant and license: `tenantId` and `license.*`, from `global.iris.tenantId` and `global.iris.license`. +- Worker identity: `workerAuth.enabled`, `memory.dataplane_client`, and `memory.auth.worker_identity`, trusted against `global.iris.workloadIdentity`. +- OIDC: `auth.oidc.audience` and the Control Plane's `controlplane.configData.auth.oidc`, from `global.iris.auth.oidc` and `global.iris.auth.roleBindings`. Data Plane OIDC stays off unless you set `memory.memory.auth.oidc.enabled: true`; it then takes the same issuer, JWKS URL, role claims, and role mappings. + +The suite also fixes `fullnameOverride`, the Service ports, `server.strategy`, and +`podDisruptionBudget.enabled: true`, and doesn't support the FIPS-oriented posture. The Identity +Service is named `iris-identity-service`, and the admin token is in Secret `iris-memory-admin-token`. + +```bash +helm install iris redis-ai/redis-iris \ + --version 1.0.0 \ + --namespace \ + -f iris-values.yaml +``` + +The rest of this guide applies to the values under `memory:`. + ## Next steps - [API examples](/content/operate/iris/agent-memory/self-managed/api-examples.md) for the full API. diff --git a/content/operate/iris/agent-memory/self-managed/operations.md b/content/operate/iris/agent-memory/self-managed/operations.md index 947953b3eb..16ff83f97c 100644 --- a/content/operate/iris/agent-memory/self-managed/operations.md +++ b/content/operate/iris/agent-memory/self-managed/operations.md @@ -82,7 +82,7 @@ kubectl -n create secret generic memory-dp-credential \ RUNTIME_CREDENTIAL_CHECKSUM="$(shasum -a 256 ./memory-dp-token | awk '{print $1}')" helm upgrade ids redis-ai/iris-identity-service \ - --version 1.2.0 \ + --version 1.0.0 \ --namespace \ -f values-ids.yaml \ --set-string "runtime.serviceCredentials[0].existingSecretChecksum=$RUNTIME_CREDENTIAL_CHECKSUM" @@ -172,8 +172,8 @@ kubectl -n rollout restart deployment ## Updates -Memory and Identity Service have independent release versions. Upgrade each with its own -values file and verify their shared connection contract afterward. A Memory upgrade does not +Memory and Identity Service publish at the same version, and a fix release advances both, +even if one is unchanged. Upgrade each release with its own values file and verify their shared connection contract afterward. A Memory upgrade does not upgrade Identity Service. The pair documented here is Memory `1.0.0` and Identity Service `1.0.0`. For updates within a supported release path: @@ -294,7 +294,7 @@ helm upgrade redis-agent-memory redis-ai/redis-agent-memory \ -f redis-agent-memory/values-fips.yaml helm upgrade ids redis-ai/iris-identity-service \ - --version 1.2.0 \ + --version 1.0.0 \ --namespace \ -f values-ids.yaml ``` diff --git a/content/operate/iris/agent-memory/self-managed/prerequisites.md b/content/operate/iris/agent-memory/self-managed/prerequisites.md index ee29d972fe..809d1622bc 100644 --- a/content/operate/iris/agent-memory/self-managed/prerequisites.md +++ b/content/operate/iris/agent-memory/self-managed/prerequisites.md @@ -18,7 +18,7 @@ aliases: Redis Agent Memory is distributed as container images on Docker Hub plus a Helm chart in the Redis AI Helm repository. The chart deploys the Redis Agent Memory Data Plane, Redis Agent Memory workers, and the Redis Agent Memory Control Plane. Install Identity -Service separately with the `iris-identity-service` chart `1.2.0` before connecting Memory chart `1.0.0`. +Service separately with the `iris-identity-service` chart `1.0.0` before connecting Memory chart `1.0.0`. You provide the Redis databases, provider credentials, Kubernetes exposure, and license material used by the deployment. @@ -41,9 +41,9 @@ license material used by the deployment. | Software | Minimum version | Purpose | | -------- | --------------- | ------- | -| Kubernetes | 1.23+ | Orchestration | +| Kubernetes | 1.28+ | Orchestration | | kubectl | 1.23+ | Kubernetes CLI | -| Helm | 3.x | Package manager | +| Helm | 3.10+ (Helm 4 is not supported in this release) | Package manager | Treat the Redis Agent Memory images as `linux/amd64` unless the release notes for your image version declare a multi-architecture manifest. On clusters with ARM64 nodes, schedule Redis Agent @@ -132,8 +132,8 @@ To supply a complete configuration file in your own Secret instead, see ## Release artifacts and image tags Memory chart `1.0.0` defaults `image.tag` and `controlplane.image.tag` to `1.0.0`. -Identity Service chart `1.2.0` defaults its image to its own application version, `1.2.0`. -Set tags explicitly when pinning images or using a mirror. The releases have independent versions. +Identity Service chart `1.0.0` defaults its image to its own application version, `1.0.0`. +Set tags explicitly when pinning images or using a mirror. Both charts publish at the same version. Both charts are published at `https://helm.redis.io/ai` as `redis-ai/redis-agent-memory` and `redis-ai/iris-identity-service`. Their standard images are @@ -156,7 +156,7 @@ Mirror these images into your internal registry: For this release, `` is `1.0.0` and `` is `1.0.0`. Inspect each package with `helm show chart redis-ai/redis-agent-memory --version 1.0.0` -and `helm show chart redis-ai/iris-identity-service --version 1.2.0`. Memory does not pin +and `helm show chart redis-ai/iris-identity-service --version 1.0.0`. Memory does not pin or install the Identity Service chart. ```bash @@ -278,7 +278,8 @@ namespace. | API server capacity | `server.resources`, `server.autoscaling.*` | Tuning request capacity or memory footprint. | | Worker capacity | `worker.resources`, `worker.autoscaling.*` | Tuning background job throughput. | | Scheduling | `server.nodeSelector`, `worker.nodeSelector`, `server.affinity`, `worker.affinity`, `server.tolerations`, `worker.tolerations` | Controlling pod placement. | -| Networking | `service.type`, `ingress.*` | Exposing Redis Agent Memory outside the cluster. | +| Networking | `service.type`, `ingress.*` | Exposing Redis Agent Memory outside the cluster. The Ingress sets no controller annotations by default and routes paths without rewriting, so it works on any controller, such as ingress-nginx or Traefik. Set `ingress.className` (default `nginx`) to your controller's class. | +| Availability | `podDisruptionBudget.enabled`, `server.strategy` | Adding a PodDisruptionBudget (`maxUnavailable: 1`, off by default) to each Deployment that keeps more than one pod, or setting the Data Plane's rollout strategy. | | Naming | `fullnameOverride` | Keeping resource names at `redis-agent-memory*`. | | Service account | `serviceAccount.*` | Matching customer namespace security policy. | | Worker authentication | `workerAuth.*`, `worker.serviceAccount.*`, `worker.serviceAccount.token.*` | Giving Redis Agent Memory workers a Kubernetes projected service-account token for authenticated Data Plane callbacks. | diff --git a/content/operate/iris/agent-memory/self-managed/reference.md b/content/operate/iris/agent-memory/self-managed/reference.md index 4a7fe8efea..56638d9509 100644 --- a/content/operate/iris/agent-memory/self-managed/reference.md +++ b/content/operate/iris/agent-memory/self-managed/reference.md @@ -53,6 +53,7 @@ CSI-synced Secrets, make sure a Control Plane pod also mounts the corresponding | Rendering fails with `requires identityService.credential.existingSecret` | The endpoint is configured but the runtime credential Secret is missing | Name the existing Secret also registered on Identity Service as `memory-dp`. | | Rendering fails with `must be https://` or `identityService.allowInsecureTransport=true is refused under the fips security profile` | The runtime endpoint uses HTTP without an allowed exception, or insecure transport is enabled under FIPS | Use an HTTPS endpoint. An HTTP exception requires `identityService.allowInsecureTransport: true` and is refused under FIPS. | | Rendering fails with `is chart-owned` for an introspection field | An endpoint, credential, or transport flag was hand-set under `memory.auth` or `shared.auth` | Use `dataplane.identityServiceBaseURL` and `identityService.credential` for chart-rendered configuration; cache settings remain configurable. | +| Rendering fails with `memory.auth.oidc.issuer and memory.auth.oidc.jwks_uri are required when memory.auth.oidc.enabled is true` | Data Plane OIDC is enabled without its issuer or JWKS URL, which the Data Plane needs to start | Set both under `memory.auth.oidc`, or supply them in your own configuration with `config.existingSecret`. | | Rendering or startup refuses `auth.method: none` | Authentication is disabled outside the development profile | Use agent-key authentication. For isolated development only, set both `memory.profile: dev` and `memory.auth.method: none`; supplied configuration files use `profile: dev` and `auth.method: none`. | | Docker pull fails for the configured image tag | Image tag is wrong or has not been published to the configured registry | Use the image tag listed for the release on Docker Hub or provided by Redis. | | Server and worker pods `CrashLoopBackOff`; log: `license validation failed; refusing to start: invalid license format` | `memory.license.license_path` is not set | See [CL-1](/content/operate/iris/agent-memory/self-managed/deploy.md#cl-1). | @@ -83,7 +84,7 @@ CSI-synced Secrets, make sure a Control Plane pod also mounts the corresponding | Need | Reference | | --- | --- | | Helm chart values | `values.yaml` at the chart root (`helm pull redis-ai/redis-agent-memory --version 1.0.0 --untar`) | -| Identity Service chart values | `helm show values redis-ai/iris-identity-service --version 1.2.0` | +| Identity Service chart values | `helm show values redis-ai/iris-identity-service --version 1.0.0` | | FIPS values overlay | `values-fips.yaml` at the chart root | | NetworkPolicy reference | `networkpolicy.reference.yaml` at the chart root | | Chart README | `README.md` at the chart root | diff --git a/content/operate/iris/agent-playbook/self-managed/deploy.md b/content/operate/iris/agent-playbook/self-managed/deploy.md index 7f6b1c402f..7b8f5d274e 100644 --- a/content/operate/iris/agent-playbook/self-managed/deploy.md +++ b/content/operate/iris/agent-playbook/self-managed/deploy.md @@ -13,7 +13,7 @@ hideListLinks: true Follow these steps to install the Agent Playbooks control plane and data plane with the `redis-agent-playbook` Helm chart, connect them to an Identity Service release, and end with one authenticated call to the data plane. -Install Identity Service as release `ids`, then Agent Playbooks as release `playbook`, in one namespace. These steps use Agent Playbooks chart `1.0.0` and Identity Service chart `1.2.0`. You create the two credentials both releases share and the Identity Service control token; Agent Playbooks generates its admin token. See [Credentials](/content/operate/iris/agent-playbook/self-managed/authentication.md#credentials). +Install Identity Service as release `ids`, then Agent Playbooks as release `playbook`, in one namespace. These steps use Agent Playbooks chart `1.0.0` and Identity Service chart `1.0.0`. You create the two credentials both releases share and the Identity Service control token; Agent Playbooks generates its admin token. See [Credentials](/content/operate/iris/agent-playbook/self-managed/authentication.md#credentials). Before installing, provide two Transport Layer Security (TLS) endpoints through your hosting environment: one forwarding to `ids-iris-identity-service:9200`, and one forwarding to `playbook-controlplane:9200`. Neither chart terminates TLS. Obtain their certificate authority (CA) certificates as a PEM bundle named `ca.crt`. For a network-isolated lab without TLS, see [Isolated lab without TLS](/content/operate/iris/agent-playbook/self-managed/configuration.md#isolated-lab-without-tls). @@ -92,7 +92,7 @@ If the release also serves Agent Memory, keep its `memory-dp` credential, `memor helm repo add redis-ai https://helm.redis.io/ai helm repo update redis-ai helm install ids redis-ai/iris-identity-service \ - --version 1.2.0 \ + --version 1.0.0 \ --namespace \ -f values-ids.yaml ``` @@ -184,6 +184,31 @@ curl --fail-with-body -sS \ The response reports `READY` for the playbook and for its metadata Redis, content Redis, embedding provider, and license. A `401` means the key is wrong, expired, or revoked. A `403` means it has no grant on the playbook. +## Install with the Redis Iris suite chart + +The `redis-iris` Helm chart installs Agent Playbooks with the Identity Service and the user interface (UI) in one release. Agent Playbooks is on by default (`global.iris.products.playbook.enabled: true`); set `global.iris.products..enabled: false` for each other product you don't install. Agent Playbooks values go under the `playbook:` key. + +The suite sets these Agent Playbooks values itself. Don't set them under `playbook:`: a value that differs fails the render and names the field. + +- `tenantId`, from `global.iris.tenantId`. +- `license.existingSecret` and `license.secretKey`, from `global.iris.license`. +- `dataplane.identityServiceBaseURL` and `identityService.allowInsecureTransport`, for the suite's own Identity Service. +- `identityService.credential` and `controlplane.internalToken`, from the credentials the suite generates or that you supply in `global.iris.secrets`. The admin token is in the Secret `iris-playbook-admin-token`. +- `auth.oidc.audience`, `dataplane.oidc`, and `controlplane.oidc.enabled`, from `global.iris.auth.oidc` and `global.iris.auth.roleBindings`. +- The extraction connection and worker settings, from `global.iris.extraction.enabled`. See [Configure background FAQ extraction](/content/operate/iris/agent-playbook/self-managed/extraction.md#extraction-with-the-redis-iris-suite-chart). +- `fullnameOverride` (`redis-agent-playbook`), the Service ports, `dataplane.strategy`, and `podDisruptionBudget.enabled`, which the suite fixes. The suite runs two data-plane replicas by default. + +You still set `playbook.storage.existingSecret`, `playbook.inference.models`, and `playbook.inference.existingSecret` (unless every model is `noop`). Then install: + +```bash +helm install iris redis-ai/redis-iris \ + --version 1.0.0 \ + --namespace \ + -f iris-values.yaml +``` + +The rest of this guide applies to the values under `playbook:`. + ## Next steps - [Publish and retrieve your first FAQ](/content/develop/ai/context-engine/agent-playbooks/quickstart.md). diff --git a/content/operate/iris/agent-playbook/self-managed/extraction.md b/content/operate/iris/agent-playbook/self-managed/extraction.md index 72ad193a9b..b146ee1674 100644 --- a/content/operate/iris/agent-playbook/self-managed/extraction.md +++ b/content/operate/iris/agent-playbook/self-managed/extraction.md @@ -30,6 +30,10 @@ With release `playbook`, namespace ``, and `fullnameOverride: pl If you change the namespace or resource names, change these subjects everywhere. +## Extraction with the Redis Iris suite chart + +With the [`redis-iris` Helm chart](/content/operate/iris/agent-playbook/self-managed/deploy.md#install-with-the-redis-iris-suite-chart), set `global.iris.extraction.enabled: true` instead of the `extraction` values on this page. The suite derives the extraction connection, `worker.enabled`, and `worker.sourceURL`, and configures Redis Agent Memory to trust `system:serviceaccount::redis-agent-playbook-controlplane` and `system:serviceaccount::redis-agent-playbook-worker`, so skip [Configure Redis Agent Memory trust](#configure-redis-agent-memory-trust). You still create the worker Secret and set `playbook.worker.existingSecret` and `playbook.worker.region`. Leave `config.existingSecret` unset on both Redis Agent Memory planes and on the Agent Playbooks control plane. + ## Plan the connection Prepare these values before you enable extraction: diff --git a/content/operate/iris/agent-playbook/self-managed/prerequisites.md b/content/operate/iris/agent-playbook/self-managed/prerequisites.md index 23d51d2732..bbee9d0460 100644 --- a/content/operate/iris/agent-playbook/self-managed/prerequisites.md +++ b/content/operate/iris/agent-playbook/self-managed/prerequisites.md @@ -23,14 +23,14 @@ You provide the Identity Service release, the Redis databases, the embedding pro | Requirement | Purpose | | --- | --- | -| Kubernetes cluster and `kubectl` | Run the services and create Secrets in the deployment namespace. | -| [Helm 3](https://helm.sh/docs/intro/install/) | Install `redis-ai/redis-agent-playbook` and `redis-ai/iris-identity-service` from `https://helm.redis.io/ai`. | +| Kubernetes 1.28 or later and `kubectl` | Run the services and create Secrets in the deployment namespace. | +| [Helm 3](https://helm.sh/docs/intro/install/), version 3.10 or later | Install `redis-ai/redis-agent-playbook` and `redis-ai/iris-identity-service` from `https://helm.redis.io/ai`. Helm 4 isn't supported. | | Bash, curl, jq, and OpenSSL | Generate tokens and run the administrative API examples. Use a curl version that supports `--fail-with-body`. | | License key | Contact your Redis representative or [contact sales](https://redis.io/contact/). An Agent Playbooks license or an Iris suite license that includes Agent Playbooks. | | Embedding provider | A provider and model the data plane can reach, with its credentials. | -| Identity Service | An `iris-identity-service` release, chart `1.2.0` or later, with the Agent Playbooks entries registered. See [Deploy](/content/operate/iris/agent-playbook/self-managed/deploy.md#3-install-identity-service-first). | +| Identity Service | An `iris-identity-service` release, chart `1.0.0`, with the Agent Playbooks entries registered. See [Deploy](/content/operate/iris/agent-playbook/self-managed/deploy.md#3-install-identity-service-first). | - + ## Deployment decisions @@ -62,7 +62,7 @@ Exposing a whole Identity Service also exposes its administration routes. Expose ### Plan capacity and recovery -The chart starts one replica of each service and leaves `resources` unset for the control plane and data plane. These defaults are not a production sizing recommendation. Set resource requests and limits, and leave capacity for old and new pods during upgrades. +The chart starts one replica of each service and leaves `resources` unset for the control plane and data plane. These defaults are not a production sizing recommendation. Set resource requests and limits, and leave capacity for old and new pods during upgrades. To keep a service available during node drains, run two or more replicas and set `podDisruptionBudget.enabled: true`, which adds a PodDisruptionBudget with `maxUnavailable: 1` for each Deployment that has more than one replica. Plan coordinated storage backups in [Operations](/content/operate/iris/agent-playbook/self-managed/operations.md#back-up-the-deployment). @@ -93,8 +93,6 @@ The chart requires an explicit image tag for each plane. | Data plane and extraction worker | `redislabs/iris-agent-playbook-data:1.0.0` | | Identity Service | The image that its own chart pins. | - - Allow chart downloads, image pulls, Redis connections, and data-plane access to the embedding provider. The data plane and control plane must reach the Identity Service, and the Identity Service must reach the control plane on port `9200`. For a disconnected installation, mirror the images, use a downloaded chart package, and set the image repositories and `imagePullSecrets` in your Helm values. ## Secrets diff --git a/content/operate/iris/agent-playbook/self-managed/reference.md b/content/operate/iris/agent-playbook/self-managed/reference.md index 28db44bda1..d7899d334a 100644 --- a/content/operate/iris/agent-playbook/self-managed/reference.md +++ b/content/operate/iris/agent-playbook/self-managed/reference.md @@ -34,6 +34,9 @@ This page is a lookup reference for self-managed Agent Playbooks. It lists the m | `controlplane.image.tag`, `dataplane.image.tag` | None | The image tags. Required. | | `controlplane.service.port` | `9200` | The control-plane Service port. | | `dataplane.service.port` | `9201` | The data-plane Service port, for REST and MCP. | +| `controlplane.replicaCount`, `dataplane.replicaCount`, `worker.replicaCount` | `1` | Replicas of each Deployment. | +| `dataplane.strategy` | `{}` | The data-plane Deployment's rollout `strategy`, rendered as given. | +| `podDisruptionBudget.enabled` | `false` | Add a PodDisruptionBudget with `maxUnavailable: 1` for each Deployment that has more than one replica. | | `controlplane.adminToken.autoGenerate` | `true` | Generate the admin token when `existingSecret` is empty. | | `controlplane.internalToken.existingSecret` | None | The internal token shared with the Identity Service. | | `controlplane.config.existingSecret` | None | Bring your own control-plane configuration instead of the chart's rendering. | diff --git a/content/operate/iris/context-gateway/self-managed/_index.md b/content/operate/iris/context-gateway/self-managed/_index.md index ad08446e8e..95bd9384bc 100644 --- a/content/operate/iris/context-gateway/self-managed/_index.md +++ b/content/operate/iris/context-gateway/self-managed/_index.md @@ -17,7 +17,7 @@ The `redis-context-gateway` Helm chart deploys one tenant's Context Gateway Cont Agents call the Data Plane's Model Context Protocol (MCP) endpoint, described in the [MCP API Reference](/content/develop/ai/context-engine/context-gateway/api-reference.md). The [Control Plane API Reference](/content/operate/iris/context-gateway/self-managed/control-plane-api-reference.md) documents the self-managed administration endpoints for Gateways and Upstreams. -These guides use `redis-context-gateway` chart `0.2.0`. Each chart release pins its matching Control Plane and Data Plane images by default. +These guides use `redis-context-gateway` chart `1.0.0`. Each chart release pins its matching Control Plane and Data Plane images by default. ## What you deploy diff --git a/content/operate/iris/context-gateway/self-managed/configuration.md b/content/operate/iris/context-gateway/self-managed/configuration.md index 2fc7fc9b06..e6712762fd 100644 --- a/content/operate/iris/context-gateway/self-managed/configuration.md +++ b/content/operate/iris/context-gateway/self-managed/configuration.md @@ -19,6 +19,7 @@ The chart reads non-secret settings from Helm values and every credential from a | --- | --- | | `tenantId` | The deployment's tenant. Must equal the Identity Service's single tenant ID. | | `publicBaseURL` | The Data Plane's public origin, used in every Gateway's `mcpEndpoint`. | +| `dataplane.ingress` | An optional Ingress for the Data Plane, off by default. When on, `hosts` must include the `publicBaseURL` host and route `/` with `pathType: Prefix`, `annotations` must not rewrite paths, and for an `https://` origin a `tls` entry with a `secretName` must cover that host. Otherwise rendering fails. | | `identityService.baseURL` | The Identity Service runtime API that checks agent keys. | | `identityService.allowInsecureTransport` | `true` for an in-cluster `http://` Identity Service URL. Default `false`. | | `profile` | `prod` (default) or `dev` logging. | @@ -239,6 +240,8 @@ Both planes serve Prometheus metrics at `/metrics`. Set `shared.config.opentelem Each plane starts one replica. Set `replicaCount`, or turn on `autoscaling`, with `resources`, `nodeSelector`, `tolerations`, and `affinity` under `controlplane` and `dataplane`. Autoscaling is off by default, needs Metrics Server, and needs `resources.requests.cpu` or `resources.requests.memory` for each target it uses. Leave headroom for old and new pods during upgrades. +Set `podDisruptionBudget.enabled: true` to give each plane that keeps more than one pod a PodDisruptionBudget with `maxUnavailable: 1`. `dataplane.strategy` sets the Data Plane Deployment's rollout strategy. + The `startupProbe`, `livenessProbe`, and `readinessProbe` of each plane use `/health/liveness` and `/health/readiness` by default, and accept native Kubernetes probe fields. Set a probe to `null` to turn it off. The default startup probe allows 150 seconds before liveness checks begin. diff --git a/content/operate/iris/context-gateway/self-managed/deploy.md b/content/operate/iris/context-gateway/self-managed/deploy.md index c05eca996d..0cf55dc5fa 100644 --- a/content/operate/iris/context-gateway/self-managed/deploy.md +++ b/content/operate/iris/context-gateway/self-managed/deploy.md @@ -140,7 +140,7 @@ Check each value in `gateway-values.yaml` before you install. If one is wrong, y helm repo add redis-ai https://helm.redis.io/ai helm repo update redis-ai helm install gateway redis-ai/redis-context-gateway \ - --version 0.2.0 \ + --version 1.0.0 \ --namespace \ -f gateway-values.yaml \ --wait --timeout 5m @@ -235,6 +235,44 @@ curl --fail-with-body --silent --show-error "$MCP_ENDPOINT" \ The Gateway is stateless, so no session ID needs to be retained between these requests. A new full-mode Gateway with no Upstreams and compression off returns an empty tool list. Save the key in your secret manager, then remove `agent-key.json`. +## Install with the Redis Iris suite chart + +The `redis-iris` Helm chart installs Context Gateway with the Identity Service and the user interface (UI) in one release. Context Gateway is on by default, and `global.iris.products.contextGateway.enabled: false` leaves it out. Put the Context Gateway values under the `contextGateway:` key. + +The suite derives these values from `global.iris` and registers Context Gateway with its Identity Service. Leave them unset under `contextGateway:`, because a value that differs fails the render: + +- `tenantId` and `license` +- `identityService.baseURL` and `identityService.allowInsecureTransport` +- `dataplane.runtimeToken` and `controlplane.internalToken`, which the suite supplies as Kubernetes Secrets +- `controlplane.config.auth.oidc`, when `global.iris.auth.oidc` sets an issuer + +The suite also fixes `fullnameOverride`, both `service.port` values, `dataplane.strategy`, and `podDisruptionBudget.enabled`. `tls.caBundle` defaults to `global.tls.caCertSecret`. The Data Plane defaults to two replicas, and `controlplane.adminToken` reads the `iris-context-gateway-admin-token` Secret, which the suite generates by default. + +You set `publicBaseURL`, which must be an `https://` origin with no path, the metadata and credential storage references, and either `dataplane.ingress` or your own routing to `redis-context-gateway-dataplane:8083`: + +```yaml +contextGateway: + publicBaseURL: https://mcp.example.com + metadataDB: + existingSecret: gateway-metadata + credentialStorage: + provider: redis + redis: + connection: + existingSecret: gateway-credential-redis + keyring: + existingSecret: gateway-keyring +``` + +```bash +helm install iris redis-ai/redis-iris \ + --version 1.0.0 \ + --namespace \ + -f iris-values.yaml +``` + +The rest of this guide applies to the values under `contextGateway:`, except the Identity Service settings in step 2, which the suite configures. In the `kubectl` commands, use the suite's fixed names: `redis-context-gateway-controlplane`, `redis-context-gateway-dataplane`, and `iris-identity-service`. + ## Next steps - [API examples](/content/operate/iris/context-gateway/self-managed/api-examples.md) to register an Upstream and hand off to a developer. diff --git a/content/operate/iris/context-gateway/self-managed/operations.md b/content/operate/iris/context-gateway/self-managed/operations.md index 13c9942f11..5203739e01 100644 --- a/content/operate/iris/context-gateway/self-managed/operations.md +++ b/content/operate/iris/context-gateway/self-managed/operations.md @@ -92,7 +92,7 @@ Back up Metadata Redis and credential storage together. A Gateway record without Upgrade both planes together and roll forward, not back. An older Data Plane cannot read tool policy members that a newer Control Plane wrote, and serves those tools uncached. `helm rollback` restores the release's Kubernetes resources only. It does not undo database writes or restore external Secrets. -Chart 0.2.0 renamed the `dataplane.config` blocks `result_cache` to `cache` and `result_handles` to `compression`. Every nested key keeps its name. Move these settings before you upgrade: the values schema rejects the old blocks, and a Data Plane ignores them. Upgrade the chart and images together, because an older image ignores the new keys and leaves both features off. The same release renamed the Gateway fields `resultCache` and `resultHandles` to `cache` and `compression`. Gateways stored under the old names lose their settings and tool policies, so set them again. +Chart 1.0.0 renamed the `dataplane.config` blocks `result_cache` to `cache` and `result_handles` to `compression`. Every nested key keeps its name. Move these settings before you upgrade: the values schema rejects the old blocks, and a Data Plane ignores them. Upgrade the chart and images together, because an older image ignores the new keys and leaves both features off. The same release renamed the Gateway fields `resultCache` and `resultHandles` to `cache` and `compression`. Gateways stored under the old names lose their settings and tool policies, so set them again. After an upgrade, refresh an Upstream's catalog when the release notes ask for it. diff --git a/content/operate/iris/context-gateway/self-managed/prerequisites.md b/content/operate/iris/context-gateway/self-managed/prerequisites.md index 0f11801a57..7e55850710 100644 --- a/content/operate/iris/context-gateway/self-managed/prerequisites.md +++ b/content/operate/iris/context-gateway/self-managed/prerequisites.md @@ -26,11 +26,11 @@ hideListLinks: true | Software | Purpose | | --- | --- | -| Kubernetes cluster and `kubectl` | Run both planes and create Secrets in the installation namespace. | -| [Helm v3.10.3 or later, or Helm 4](https://docs.helm.sh/docs/v3/intro/install/) | Install the chart. | +| Kubernetes 1.28 or later, and `kubectl` | Run both planes and create Secrets in the installation namespace. | +| [Helm 3, v3.10.3 or later](https://docs.helm.sh/docs/v3/intro/install/) | Install the chart. | | Bash, curl, and jq | Run the API examples. | - + ## Redis databases @@ -89,7 +89,7 @@ On an OSS Redis Cluster, also grant `+cluster|slots` to both users. Search comma | Identity Service | Control Plane | Grant validation. | | Operators | Control Plane and Identity Service | Administration. Keep both private. | -The chart creates `ClusterIP` services. Your platform owns ingress, network policy, and TLS termination. +The chart creates `ClusterIP` services. It can also create an Ingress for the Data Plane with `dataplane.ingress`, which is off by default. See [Helm values](/content/operate/iris/context-gateway/self-managed/configuration.md#helm-values). Your platform owns the ingress controller, network policy, Domain Name System (DNS) records, and Transport Layer Security (TLS) certificates. Configure the ingress for Streamable HTTP: @@ -110,7 +110,7 @@ Redis URLs, tokens, keyrings, and the license belong in Kubernetes Secrets or Se The chart defaults to these repositories and pins the image tags that match its chart version. Leave `image.repository` and `image.tag` unset for a public install, and override them only to pull from a mirror. -Chart `0.2.0` pins both images to tag `0.1.0`. +Chart `1.0.0` pins both images to tag `1.0.0`. ## Air-gapped and private registry installs diff --git a/content/operate/iris/intent-router/self-managed/_index.md b/content/operate/iris/intent-router/self-managed/_index.md index 31091f2b58..5e062dd582 100644 --- a/content/operate/iris/intent-router/self-managed/_index.md +++ b/content/operate/iris/intent-router/self-managed/_index.md @@ -19,7 +19,7 @@ The `redis-intent-router` Helm chart deploys one tenant's Intent Router control Applications call the data plane to author intents and match queries, as described in the [data-plane API reference](/content/develop/ai/context-engine/intent-router/api-reference.md). The [control-plane API reference](/content/operate/iris/intent-router/self-managed/control-plane-api-reference.md) documents the administration endpoints for Routers. -These guides use `redis-intent-router` chart `0.1.0`. Set the image tags from the release manifest for your deployment. +These guides use `redis-intent-router` chart `1.0.0`. Its images are tagged with the chart version, `1.0.0`. ## What you deploy diff --git a/content/operate/iris/intent-router/self-managed/authentication.md b/content/operate/iris/intent-router/self-managed/authentication.md index 668cac998a..0be8786380 100644 --- a/content/operate/iris/intent-router/self-managed/authentication.md +++ b/content/operate/iris/intent-router/self-managed/authentication.md @@ -77,7 +77,7 @@ The Intent Router chart deploys no Identity Service. Install the Identity Servic | `runtime.apiKeyTenant.singleTenantID` | The same value as `tenantId`. | {{< note >}} -Use Identity Service chart `1.0.0` or later. Earlier releases don't accept the `intent` product in `allowedProducts` or `productValidation.products`. +Use the Identity Service chart with the same version as this chart, such as `1.0.0`. Releases before `1.0.0` don't accept the `intent` product in `allowedProducts` or `productValidation.products`. {{< /note >}} ## Rotate credentials diff --git a/content/operate/iris/intent-router/self-managed/configuration.md b/content/operate/iris/intent-router/self-managed/configuration.md index c66f67b3fd..596ce79edf 100644 --- a/content/operate/iris/intent-router/self-managed/configuration.md +++ b/content/operate/iris/intent-router/self-managed/configuration.md @@ -187,3 +187,5 @@ Set `tracing.enabled` and `tracing.otlpGRPCEndpoint` to send spans to your OpenT ## Scale and schedule the planes The control plane and data plane scale independently. Set `replicaCount`, `resources`, `nodeSelector`, `tolerations`, and `affinity` for each in the chart values. Scale the Identity Service in its own release. The data plane carries the matching load, so scale it first. + +Each plane runs one replica by default. Set `podDisruptionBudget.enabled=true` to add a PodDisruptionBudget with `maxUnavailable: 1` for each plane that runs more than one replica. `dataplane.strategy` sets the data-plane Deployment's rollout strategy, for example `RollingUpdate` with `maxUnavailable: 0` and `maxSurge: 1`. diff --git a/content/operate/iris/intent-router/self-managed/deploy.md b/content/operate/iris/intent-router/self-managed/deploy.md index 113f158a4a..c3fe47576f 100644 --- a/content/operate/iris/intent-router/self-managed/deploy.md +++ b/content/operate/iris/intent-router/self-managed/deploy.md @@ -96,7 +96,7 @@ Check each value before you install. If one is wrong, you see the symptom in its helm repo add redis-ai https://helm.redis.io/ai helm repo update redis-ai helm install intent redis-ai/redis-intent-router \ - --version 0.1.0 \ + --version 1.0.0 \ --namespace \ -f intent-values.yaml \ --wait --timeout 5m @@ -164,6 +164,42 @@ curl -sS -X POST "$IRIS_INTENT_ROUTER_URL/iris/data/v1/intent/routers/$IRIS_INTE A Router with no intents returns `200` and `{"items": []}`. A `401` means the key is wrong, and a `403` means it lacks a grant on the Router. A `409` means the Router isn't `READY` yet. +## Install with the Redis Iris suite chart + +The `redis-iris` Helm chart installs Intent Router with the Identity Service and the UI in one release. `global.iris.products.intent.enabled` turns Intent Router on, and is `true` by default. The other products are on by default too, so set `global.iris.products..enabled: false` for each one you don't install. Put this chart's values under the `intent:` key. + +The suite derives these values from `global.iris`. Don't set them under `intent:`: a value that differs fails the render and names the field. + +- `tenantId` and `license.*`, from `global.iris.tenantId` and `global.iris.license`. +- `dataplane.identityServiceBaseURL` and `identityService.allowInsecureTransport`, which point at the suite's Identity Service. +- `identityService.credential` and `controlplane.internalToken`, which the suite generates or reads from `global.iris.secrets`. The suite registers them and the tenant on its Identity Service, so skip [Configure the Identity Service release first](/content/operate/iris/intent-router/self-managed/deploy.md#configure-the-identity-service-release-first). +- `auth.oidc.audience`, `dataplane.oidc`, and `controlplane.oidc.enabled`, from `global.iris.auth`. + +The suite also fixes `fullnameOverride`, the Service ports, `dataplane.strategy`, and `podDisruptionBudget.enabled`, and runs two data-plane replicas by default. Its Services are `redis-intent-router-controlplane`, `redis-intent-router-dataplane`, and `iris-identity-service`. By default it generates the admin token in the Secret `iris-intent-admin-token`. The suite chart doesn't support the FIPS profile. + +You still set the storage Secret and the embedding model: + +```yaml +intent: + storage: + existingSecret: intent-storage + inference: + existingSecret: intent-inference + models: + - provider: openai + model: text-embedding-3-small + dimensions: 1536 +``` + +```bash +helm install iris redis-ai/redis-iris \ + --version 1.0.0 \ + --namespace \ + -f iris-values.yaml +``` + +The rest of this guide applies to the values under `intent:`. + ## Next steps - [Define intents and match queries](/content/develop/ai/context-engine/intent-router/quickstart.md). diff --git a/content/operate/iris/intent-router/self-managed/operations.md b/content/operate/iris/intent-router/self-managed/operations.md index f24c720a84..b71e0b1f07 100644 --- a/content/operate/iris/intent-router/self-managed/operations.md +++ b/content/operate/iris/intent-router/self-managed/operations.md @@ -67,7 +67,7 @@ helm upgrade intent redis-ai/redis-intent-router \ --wait --timeout 5m ``` -Set the image tags from the release manifest for the new chart version. Check readiness on every service afterward. +Set the image tags to the new chart version. Check readiness on every service afterward. ## Uninstall the chart diff --git a/content/operate/iris/intent-router/self-managed/prerequisites.md b/content/operate/iris/intent-router/self-managed/prerequisites.md index 4fb261fdf9..0e336e0a57 100644 --- a/content/operate/iris/intent-router/self-managed/prerequisites.md +++ b/content/operate/iris/intent-router/self-managed/prerequisites.md @@ -26,8 +26,8 @@ Self-managed Intent Router runs on your Kubernetes cluster and depends on Redis | Software | Requirement | | --- | --- | -| Kubernetes | A cluster that can run the chart's Deployments, Services, and Secrets. | -| Helm | Helm 3. | +| Kubernetes | Kubernetes 1.28 or later. | +| Helm | Helm 3.10 or later. Helm 4 isn't supported. | | `kubectl` | Configured for the cluster and namespace. | | `jq` and `curl` | For the administration examples. | @@ -78,7 +78,7 @@ Create these Secrets before you install: the storage Secret that holds the Redis ## Release artifacts and image tags -The chart requires an explicit `tag` for each image. Rendering fails with a named message when one is missing. Use the image tags from the release manifest for the chart version you install. +The chart uses two images, `redislabs/iris-intent-router-control` and `redislabs/iris-intent-router-data`, tagged with the chart version, such as `1.0.0`. Rendering fails with a named message when a `tag` is empty. To install from a private registry, mirror both images, then set `controlplane.image.repository`, `dataplane.image.repository`, and `imagePullSecrets`. ## Helm values to review diff --git a/content/operate/iris/lens/self-managed/_index.md b/content/operate/iris/lens/self-managed/_index.md index 3c5cf5d801..e03117dfa5 100644 --- a/content/operate/iris/lens/self-managed/_index.md +++ b/content/operate/iris/lens/self-managed/_index.md @@ -13,14 +13,13 @@ hideListLinks: true Lens traces your AI agent turns, so developers can see what each source returned, what entered the prompt, and how each step went. Before developers can send turns, a platform administrator deploys Lens, connects it to an Identity Service, and gives each application an endpoint and API keys. -This guide is for that administrator. It covers deploying Lens on your own Kubernetes cluster with the `redis-lens` Helm chart, then configuring, securing, and operating it. To install, start with the [prerequisites](/content/operate/iris/lens/self-managed/prerequisites.md). +This guide is for that administrator. It covers deploying Lens on your own Kubernetes cluster with the `redis-lens` Helm chart, then configuring, securing, and operating it. To install, start with the [prerequisites](/content/operate/iris/lens/self-managed/prerequisites.md). To install Lens with the Identity Service and the Iris console in one release, see [Install with the Redis Iris suite chart](/content/operate/iris/lens/self-managed/deploy.md#install-with-the-redis-iris-suite-chart). > [!NOTE] > You need a license key to deploy self-managed Lens. Contact your Redis representative or > [contact sales](https://redis.io/contact/). -These guides use `redis-lens` chart `0.2.1`. - +These guides use `redis-lens` chart `1.0.0`. ## What you deploy diff --git a/content/operate/iris/lens/self-managed/authentication.md b/content/operate/iris/lens/self-managed/authentication.md index d6595d0cf3..f200f351f2 100644 --- a/content/operate/iris/lens/self-managed/authentication.md +++ b/content/operate/iris/lens/self-managed/authentication.md @@ -113,7 +113,7 @@ controlplane: | Value | Purpose | | --- | --- | -| `auth.oidc.audience` | The audience the IdP puts in the token's `aud`. Use the same Iris API audience in every Iris chart. On Microsoft Entra ID v2, it's the API's Application (client) ID. Empty and wildcard values are refused. | +| `auth.oidc.audience` | The audience the IdP puts in the token's `aud`. Use the same Iris API audience in every Iris chart. On Microsoft Entra ID v2, it's the API's Application (client) ID. Empty uses `api://redis-iris`. A wildcard is refused. | | `dataplane.oidc.issuer` | Compared with the token's `iss`, and never fetched, so `http://` is allowed. On Active Directory Federation Services (AD FS), use the discovery document's `access_token_issuer`. | | `dataplane.oidc.jwksURI` | Fetched for signing keys. Must be `https://` unless `dataplane.oidc.allowInsecureTransport=true`. | | `dataplane.oidc.tenantIDClaim` | The claim that names the tenant. Empty treats every token as `tenantId`'s. | diff --git a/content/operate/iris/lens/self-managed/configuration.md b/content/operate/iris/lens/self-managed/configuration.md index cebab06748..a6dc682834 100644 --- a/content/operate/iris/lens/self-managed/configuration.md +++ b/content/operate/iris/lens/self-managed/configuration.md @@ -61,22 +61,22 @@ tests: | `storage.existingSecret` | `""` | Required. The [storage Secret](#storage-secret). | | `storage.keyPrefix` | `iris:lens` | The prefix of every key Lens writes. | | `license.existingSecret` | `""` | Required. The license Secret, with the key `license`. | -| `dataplane.image.repository`, `dataplane.image.tag` | `redislabs/iris-lens-data` | The data-plane and worker image. | -| `controlplane.image.repository`, `controlplane.image.tag` | `redislabs/iris-lens-control` | The control-plane image. | +| `dataplane.image.repository`, `dataplane.image.tag` | `redislabs/iris-lens-data`, the chart version | The data-plane and worker image. | +| `controlplane.image.repository`, `controlplane.image.tag` | `redislabs/iris-lens-control`, the chart version | The control-plane image. | | `dataplane.identityServiceBaseURL` | `""` | Required. The Identity Service release's URL. Must be `https://` unless `identityService.allowInsecureTransport=true`. | | `identityService.allowInsecureTransport` | `false` | Accept an `http://` Identity Service URL, such as the in-cluster Service. | | `identityService.credential.existingSecret` | `""` | Required. The data plane's runtime credential, key `token`. | | `controlplane.internalToken.existingSecret` | `""` | The control plane's internal token, key `token`. Set it, because the Identity Service release must mount the same Secret. | | `controlplane.adminToken.existingSecret` | `""` | Supply your own admin token. Empty, the chart generates one. | | `dataplane.server.replicaCount`, `dataplane.worker.replicaCount`, `controlplane.replicaCount` | `1` | Replicas for each workload. | +| `podDisruptionBudget.enabled` | `false` | Add a PodDisruptionBudget (`maxUnavailable: 1`) for each Deployment with more than one replica. | +| `dataplane.server.strategy` | `{}` | The data-plane Deployment's `spec.strategy`, rendered as given. | | `tls.caCertSecret` | `""` | A certificate authority (CA) bundle every workload trusts. See [TLS trust](#tls-trust). | | `security.profile` | `""` | `fips` runs the Federal Information Processing Standards (FIPS) profile. | | `imagePullSecrets` | `[]` | Pull Secrets for a private registry. | | `tests.enabled` | `false` | Add `helm test` readiness checks. | -To pull images from a mirror, set each `repository` to your registry and each `tag` to the chart's version. - - +To pull images from a mirror, set each `repository` to your registry. Keep each `tag` at the chart's version. Every Secret value also has an `existingSecretChecksum`. Set it when you change the Secret's content, so the pods roll. See [Rotate credentials](/content/operate/iris/lens/self-managed/authentication.md#rotate-credentials). diff --git a/content/operate/iris/lens/self-managed/deploy.md b/content/operate/iris/lens/self-managed/deploy.md index 9ebe190c5e..aa6e8648ec 100644 --- a/content/operate/iris/lens/self-managed/deploy.md +++ b/content/operate/iris/lens/self-managed/deploy.md @@ -89,12 +89,12 @@ productValidation: helm repo add redis-ai https://helm.redis.io/ai helm repo update redis-ai helm install ids redis-ai/iris-identity-service \ - --version 1.2.0 \ + --version 1.0.0 \ --namespace \ -f values-ids.yaml ``` -Use version `1.2.0` or later. The Lens control plane doesn't exist yet. Wait until Lens is running before you create keys, because the Identity Service calls the control plane to validate each grant. +Use the same version as the Lens chart, `1.0.0`. The Lens control plane doesn't exist yet. Wait until Lens is running before you create keys, because the Identity Service calls the control plane to validate each grant. ## 4. Install Lens @@ -102,7 +102,7 @@ Write `lens-values.yaml` from [Helm values](/content/operate/iris/lens/self-mana ```bash helm install lens redis-ai/redis-lens \ - --version 0.2.1 \ + --version 1.0.0 \ --namespace \ -f lens-values.yaml \ --wait --timeout 5m @@ -200,6 +200,35 @@ Give each agent its own ingest key, so one agent's key can't read other agents' Developers can then [trace their first turn](/content/develop/ai/context-engine/lens/quickstart.md). +## Install with the Redis Iris suite chart + +The `redis-iris` Helm chart installs Lens with the Identity Service and the Iris console in one release. Lens is on by default (`global.iris.products.lens.enabled`), and its values go under the `lens:` key. The chart also installs the other Iris products by default, so set `global.iris.products..enabled: false` for each one you don't deploy: `memory`, `playbook`, `contextGateway`, or `intent`. + +The suite derives these values from `global.iris`. Don't set them under `lens:`: a value that differs fails the render and names the field. + +- `tenantId`, from `global.iris.tenantId`. +- `license.existingSecret` and `license.secretKey`, from `global.iris.license`. +- `dataplane.identityServiceBaseURL` and `identityService.allowInsecureTransport`, for the suite's Identity Service. +- `identityService.credential` and `controlplane.internalToken`, the runtime credential and internal token. +- `auth.oidc.audience`, `dataplane.oidc`, and `controlplane.oidc.enabled`, from `global.iris.auth.oidc` and `global.iris.auth.roleBindings`. + +The suite also fixes `fullnameOverride` (`redis-lens`), the Service ports, `instance.id` (`default`), the data-plane rollout strategy, and `podDisruptionBudget.enabled` (`true`), and runs two data-plane replicas by default. The Services are `redis-lens-dataplane` and `redis-lens-controlplane`, the admin token is in the Secret `iris-lens-admin-token`, and the suite adds the console's Lens route. Save the Lens values in `iris-values.yaml`: + +```yaml +lens: + storage: + existingSecret: lens-storage +``` + +```bash +helm install iris redis-ai/redis-iris \ + --version 1.0.0 \ + --namespace \ + -f iris-values.yaml +``` + +The rest of this guide applies to the values under `lens:`. + ## Next steps - [Create, rotate, and revoke API keys](/content/operate/iris/lens/self-managed/authentication.md). diff --git a/content/operate/iris/lens/self-managed/operations.md b/content/operate/iris/lens/self-managed/operations.md index ac1cc71360..0be7a3c3eb 100644 --- a/content/operate/iris/lens/self-managed/operations.md +++ b/content/operate/iris/lens/self-managed/operations.md @@ -51,9 +51,7 @@ Retention lives in two places, so change both together: -d '{"retention":{"streamTrimSeconds":86400,"contentTtlSeconds":259200,"indexRetentionSeconds":1209600}}' ``` -The windows must satisfy `streamTrimSeconds` < `contentTtlSeconds` ≤ `indexRetentionSeconds`. After the first start, a `PATCH` wins for what the instance record reports. - - +The windows must satisfy `streamTrimSeconds` < `contentTtlSeconds` ≤ `indexRetentionSeconds`. The control plane records `instance.retention` only when it creates the instance, so `helm upgrade` never changes what the instance record reports. ## Connect the console diff --git a/content/operate/iris/lens/self-managed/prerequisites.md b/content/operate/iris/lens/self-managed/prerequisites.md index e6819eb6a4..3c0dce15cb 100644 --- a/content/operate/iris/lens/self-managed/prerequisites.md +++ b/content/operate/iris/lens/self-managed/prerequisites.md @@ -17,13 +17,13 @@ Self-managed Lens runs on your Kubernetes cluster and depends on Redis databases | Requirement | Detail | | --- | --- | -| Kubernetes | A cluster and a namespace for the release. | -| Helm | Helm 3. | +| Kubernetes | Kubernetes 1.28 or later, and a namespace for the release. | +| Helm | Helm 3.10 or later. Helm 4 isn't supported. | | `kubectl`, `curl`, and `jq` | For the install and administration examples. | -| Identity Service | The `iris-identity-service` chart, `1.2.0` or later, installed as its own release. | +| Identity Service | The `iris-identity-service` chart at the same version as the Lens chart, `1.0.0`, installed as its own release. | | Redis databases | A records database, a content database, and a metadata Redis, as described in [Redis databases](#redis-databases). | | Container images | Docker Hub: `redislabs/iris-lens-data` (data plane and worker) and `redislabs/iris-lens-control` (control plane). | -| Helm chart | `redis-lens` chart `0.2.1` in the Redis AI Helm repository, `https://helm.redis.io/ai`. | +| Helm chart | `redis-lens` chart `1.0.0` in the Redis AI Helm repository, `https://helm.redis.io/ai`. | | License key | Contact your Redis representative or [contact sales](https://redis.io/contact/). | ## Redis databases