Iris self-managed docs: align with the redis-iris global Helm chart release

content/operate/iris/agent-memory/self-managed/_index.md

@@ -32,9 +32,10 @@ documents the self-managed admin endpoints for stores.
 ## What you are deploying
 
 The `redis-agent-memory` chart `1.0.0` deploys the Data Plane, workers, and Control Plane.
-Install the `iris-identity-service` chart `1.2.0` as a separate release first, then connect
+Install the `iris-identity-service` chart `1.0.0` as a separate release first, then connect
 Memory to it. Memory does not deploy Identity Service resources or include it as a subchart.
-A unified Redis Iris chart that installs Memory and Identity Service as one release is planned.
+To install Memory, Identity Service, and the UI as one release, use the
+[`redis-iris` Helm chart](/content/operate/iris/agent-memory/self-managed/deploy.md#install-with-the-redis-iris-suite-chart).
 These pages document the separate releases.
 You provide the Redis databases. Follow [Deploy](/content/operate/iris/agent-memory/self-managed/deploy.md)
 to configure both releases.

content/operate/iris/agent-memory/self-managed/configuration.md

@@ -327,6 +327,9 @@ must reach the issuer's JWKS and trust its CA; see
 [worker identity](/content/operate/iris/agent-memory/self-managed/deploy.md#prepare-worker-identity-for-your-platform).
 Helm replaces lists, so merge these entries with any existing ones.
 
+With the `redis-iris` Helm chart, set `global.iris.extraction.enabled: true` instead. The suite
+derives both entries, and a differing value under `memory:` fails the render.
+
 ## Configure document ingestion {#enable-document-ingestion}
 
 Document ingestion is enabled in self-managed deployments. Configure the server and worker together through chart-rendered values. This example sets explicit processing limits:

content/operate/iris/agent-memory/self-managed/deploy.md

@@ -22,7 +22,7 @@ These steps install Redis Agent Memory with chart-rendered configuration and age
 authentication, and end with one authenticated call to the Data Plane.
 
 Install Identity Service as release `ids`, then Memory as release `redis-agent-memory`.
-These steps use Memory chart `1.0.0` and Identity Service chart `1.2.0` in one namespace.
+These steps use Memory chart `1.0.0` and Identity Service chart `1.0.0` in one namespace.
 You create the shared credentials and Identity Service control token; Memory generates its
 Control Plane admin token. See [Credentials](/content/operate/iris/agent-memory/self-managed/authentication.md#credentials).
 
@@ -162,7 +162,7 @@ tls:
 helm repo add redis-ai https://helm.redis.io/ai
 helm repo update redis-ai
 helm install ids redis-ai/iris-identity-service \
-  --version 1.2.0 \
+  --version 1.0.0 \
   --namespace <namespace-name> \
   -f values-ids.yaml
 ```
@@ -616,6 +616,35 @@ does not migrate existing stores or their vector indexes. After switching, creat
 and agent key using steps 6–7 for local evaluation. Existing stores retain their original
 embedding dimensions and cannot be reused with this example.
 
+## Install with the Redis Iris suite chart
+
+The `redis-iris` Helm chart installs Agent Memory with the Identity Service and the UI in one
+release. Memory is on when `global.iris.products.memory.enabled` is `true`, the default; set the
+`enabled` flag of each product you don't install to `false`. Put Memory's values under the
+`memory:` key, so this guide's `memory.auth` becomes `memory.memory.auth`.
+
+The suite derives these Memory values from `global.iris`. Don't set them under `memory:`: a
+differing value fails the render and names the field.
+
+- The Identity Service connection: `dataplane.identityServiceBaseURL` and `identityService.allowInsecureTransport`.
+- The runtime credential and internal token: `identityService.credential` and `controlplane.internalToken`, generated by the suite or read from `global.iris.secrets`.
+- The tenant and license: `tenantId` and `license.*`, from `global.iris.tenantId` and `global.iris.license`.
+- Worker identity: `workerAuth.enabled`, `memory.dataplane_client`, and `memory.auth.worker_identity`, trusted against `global.iris.workloadIdentity`.
+- OIDC: `auth.oidc.audience` and the Control Plane's `controlplane.configData.auth.oidc`, from `global.iris.auth.oidc` and `global.iris.auth.roleBindings`. Data Plane OIDC stays off unless you set `memory.memory.auth.oidc.enabled: true`; it then takes the same issuer, JWKS URL, role claims, and role mappings.
+
+The suite also fixes `fullnameOverride`, the Service ports, `server.strategy`, and
+`podDisruptionBudget.enabled: true`, and doesn't support the FIPS-oriented posture. The Identity
+Service is named `iris-identity-service`, and the admin token is in Secret `iris-memory-admin-token`.
+
+```bash
+helm install iris redis-ai/redis-iris \
+  --version 1.0.0 \
+  --namespace <namespace-name> \
+  -f iris-values.yaml
+```
+
+The rest of this guide applies to the values under `memory:`.
+
 ## Next steps
 
 - [API examples](/content/operate/iris/agent-memory/self-managed/api-examples.md) for the full API.

content/operate/iris/agent-memory/self-managed/operations.md

@@ -82,7 +82,7 @@ kubectl -n <namespace-name> create secret generic memory-dp-credential \
 RUNTIME_CREDENTIAL_CHECKSUM="$(shasum -a 256 ./memory-dp-token | awk '{print $1}')"
 
 helm upgrade ids redis-ai/iris-identity-service \
-  --version 1.2.0 \
+  --version 1.0.0 \
   --namespace <namespace-name> \
   -f values-ids.yaml \
   --set-string "runtime.serviceCredentials[0].existingSecretChecksum=$RUNTIME_CREDENTIAL_CHECKSUM"
@@ -172,8 +172,8 @@ kubectl -n <namespace-name> rollout restart deployment
 
 ## Updates
 
-Memory and Identity Service have independent release versions. Upgrade each with its own
-values file and verify their shared connection contract afterward. A Memory upgrade does not
+Memory and Identity Service publish at the same version, and a fix release advances both,
+even if one is unchanged. Upgrade each release with its own values file and verify their shared connection contract afterward. A Memory upgrade does not
 upgrade Identity Service. The pair documented here is Memory `1.0.0` and Identity Service `1.0.0`.
 
 For updates within a supported release path:
@@ -294,7 +294,7 @@ helm upgrade redis-agent-memory redis-ai/redis-agent-memory \
   -f redis-agent-memory/values-fips.yaml
 
 helm upgrade ids redis-ai/iris-identity-service \
-  --version 1.2.0 \
+  --version 1.0.0 \
   --namespace <namespace-name> \
   -f values-ids.yaml
 ```

content/operate/iris/agent-memory/self-managed/prerequisites.md

@@ -18,7 +18,7 @@ aliases:
 Redis Agent Memory is distributed as container images on Docker Hub plus a Helm
 chart in the Redis AI Helm repository. The chart deploys the Redis Agent Memory Data
 Plane, Redis Agent Memory workers, and the Redis Agent Memory Control Plane. Install Identity
-Service separately with the `iris-identity-service` chart `1.2.0` before connecting Memory chart `1.0.0`.
+Service separately with the `iris-identity-service` chart `1.0.0` before connecting Memory chart `1.0.0`.
 
 You provide the Redis databases, provider credentials, Kubernetes exposure, and
 license material used by the deployment.
@@ -41,9 +41,9 @@ license material used by the deployment.
 
 | Software | Minimum version | Purpose |
 | -------- | --------------- | ------- |
-| Kubernetes | 1.23+ | Orchestration |
+| Kubernetes | 1.28+ | Orchestration |
 | kubectl | 1.23+ | Kubernetes CLI |
-| Helm | 3.x | Package manager |
+| Helm | 3.10+ (Helm 4 is not supported in this release) | Package manager |
 
 Treat the Redis Agent Memory images as `linux/amd64` unless the release notes for your image
 version declare a multi-architecture manifest. On clusters with ARM64 nodes, schedule Redis Agent
@@ -132,8 +132,8 @@ To supply a complete configuration file in your own Secret instead, see
 ## Release artifacts and image tags
 
 Memory chart `1.0.0` defaults `image.tag` and `controlplane.image.tag` to `1.0.0`.
-Identity Service chart `1.2.0` defaults its image to its own application version, `1.2.0`.
-Set tags explicitly when pinning images or using a mirror. The releases have independent versions.
+Identity Service chart `1.0.0` defaults its image to its own application version, `1.0.0`.
+Set tags explicitly when pinning images or using a mirror. Both charts publish at the same version.
 
 Both charts are published at `https://helm.redis.io/ai` as `redis-ai/redis-agent-memory`
 and `redis-ai/iris-identity-service`. Their standard images are
@@ -156,7 +156,7 @@ Mirror these images into your internal registry:
 
 For this release, `<ram-version>` is `1.0.0` and `<ids-version>` is `1.0.0`.
 Inspect each package with `helm show chart redis-ai/redis-agent-memory --version 1.0.0`
-and `helm show chart redis-ai/iris-identity-service --version 1.2.0`. Memory does not pin
+and `helm show chart redis-ai/iris-identity-service --version 1.0.0`. Memory does not pin
 or install the Identity Service chart.
 
 ```bash
@@ -278,7 +278,8 @@ namespace.
 | API server capacity | `server.resources`, `server.autoscaling.*` | Tuning request capacity or memory footprint. |
 | Worker capacity | `worker.resources`, `worker.autoscaling.*` | Tuning background job throughput. |
 | Scheduling | `server.nodeSelector`, `worker.nodeSelector`, `server.affinity`, `worker.affinity`, `server.tolerations`, `worker.tolerations` | Controlling pod placement. |
-| Networking | `service.type`, `ingress.*` | Exposing Redis Agent Memory outside the cluster. |
+| Networking | `service.type`, `ingress.*` | Exposing Redis Agent Memory outside the cluster. The Ingress sets no controller annotations by default and routes paths without rewriting, so it works on any controller, such as ingress-nginx or Traefik. Set `ingress.className` (default `nginx`) to your controller's class. |
+| Availability | `podDisruptionBudget.enabled`, `server.strategy` | Adding a PodDisruptionBudget (`maxUnavailable: 1`, off by default) to each Deployment that keeps more than one pod, or setting the Data Plane's rollout strategy. |
 | Naming | `fullnameOverride` | Keeping resource names at `redis-agent-memory*`. |
 | Service account | `serviceAccount.*` | Matching customer namespace security policy. |
 | Worker authentication | `workerAuth.*`, `worker.serviceAccount.*`, `worker.serviceAccount.token.*` | Giving Redis Agent Memory workers a Kubernetes projected service-account token for authenticated Data Plane callbacks. |

content/operate/iris/agent-memory/self-managed/reference.md

@@ -53,6 +53,7 @@ CSI-synced Secrets, make sure a Control Plane pod also mounts the corresponding
 | Rendering fails with `requires identityService.credential.existingSecret` | The endpoint is configured but the runtime credential Secret is missing | Name the existing Secret also registered on Identity Service as `memory-dp`. |
 | Rendering fails with `must be https://` or `identityService.allowInsecureTransport=true is refused under the fips security profile` | The runtime endpoint uses HTTP without an allowed exception, or insecure transport is enabled under FIPS | Use an HTTPS endpoint. An HTTP exception requires `identityService.allowInsecureTransport: true` and is refused under FIPS. |
 | Rendering fails with `is chart-owned` for an introspection field | An endpoint, credential, or transport flag was hand-set under `memory.auth` or `shared.auth` | Use `dataplane.identityServiceBaseURL` and `identityService.credential` for chart-rendered configuration; cache settings remain configurable. |
+| Rendering fails with `memory.auth.oidc.issuer and memory.auth.oidc.jwks_uri are required when memory.auth.oidc.enabled is true` | Data Plane OIDC is enabled without its issuer or JWKS URL, which the Data Plane needs to start | Set both under `memory.auth.oidc`, or supply them in your own configuration with `config.existingSecret`. |
 | Rendering or startup refuses `auth.method: none` | Authentication is disabled outside the development profile | Use agent-key authentication. For isolated development only, set both `memory.profile: dev` and `memory.auth.method: none`; supplied configuration files use `profile: dev` and `auth.method: none`. |
 | Docker pull fails for the configured image tag | Image tag is wrong or has not been published to the configured registry | Use the image tag listed for the release on Docker Hub or provided by Redis. |
 | Server and worker pods `CrashLoopBackOff`; log: `license validation failed; refusing to start: invalid license format` | `memory.license.license_path` is not set | See [CL-1](/content/operate/iris/agent-memory/self-managed/deploy.md#cl-1). |
@@ -83,7 +84,7 @@ CSI-synced Secrets, make sure a Control Plane pod also mounts the corresponding
 | Need | Reference |
 | --- | --- |
 | Helm chart values | `values.yaml` at the chart root (`helm pull redis-ai/redis-agent-memory --version 1.0.0 --untar`) |
-| Identity Service chart values | `helm show values redis-ai/iris-identity-service --version 1.2.0` |
+| Identity Service chart values | `helm show values redis-ai/iris-identity-service --version 1.0.0` |
 | FIPS values overlay | `values-fips.yaml` at the chart root |
 | NetworkPolicy reference | `networkpolicy.reference.yaml` at the chart root |
 | Chart README | `README.md` at the chart root |

content/operate/iris/agent-playbook/self-managed/deploy.md

@@ -13,7 +13,7 @@ hideListLinks: true
 
 Follow these steps to install the Agent Playbooks control plane and data plane with the `redis-agent-playbook` Helm chart, connect them to an Identity Service release, and end with one authenticated call to the data plane.
 
-Install Identity Service as release `ids`, then Agent Playbooks as release `playbook`, in one namespace. These steps use Agent Playbooks chart `1.0.0` and Identity Service chart `1.2.0`. You create the two credentials both releases share and the Identity Service control token; Agent Playbooks generates its admin token. See [Credentials](/content/operate/iris/agent-playbook/self-managed/authentication.md#credentials).
+Install Identity Service as release `ids`, then Agent Playbooks as release `playbook`, in one namespace. These steps use Agent Playbooks chart `1.0.0` and Identity Service chart `1.0.0`. You create the two credentials both releases share and the Identity Service control token; Agent Playbooks generates its admin token. See [Credentials](/content/operate/iris/agent-playbook/self-managed/authentication.md#credentials).
 
 
 Before installing, provide two Transport Layer Security (TLS) endpoints through your hosting environment: one forwarding to `ids-iris-identity-service:9200`, and one forwarding to `playbook-controlplane:9200`. Neither chart terminates TLS. Obtain their certificate authority (CA) certificates as a PEM bundle named `ca.crt`. For a network-isolated lab without TLS, see [Isolated lab without TLS](/content/operate/iris/agent-playbook/self-managed/configuration.md#isolated-lab-without-tls).
@@ -92,7 +92,7 @@ If the release also serves Agent Memory, keep its `memory-dp` credential, `memor
 helm repo add redis-ai https://helm.redis.io/ai
 helm repo update redis-ai
 helm install ids redis-ai/iris-identity-service \
-  --version 1.2.0 \
+  --version 1.0.0 \
   --namespace <namespace-name> \
   -f values-ids.yaml
 ```
@@ -184,6 +184,31 @@ curl --fail-with-body -sS \
 
 The response reports `READY` for the playbook and for its metadata Redis, content Redis, embedding provider, and license. A `401` means the key is wrong, expired, or revoked. A `403` means it has no grant on the playbook.
 
+## Install with the Redis Iris suite chart
+
+The `redis-iris` Helm chart installs Agent Playbooks with the Identity Service and the user interface (UI) in one release. Agent Playbooks is on by default (`global.iris.products.playbook.enabled: true`); set `global.iris.products.<product>.enabled: false` for each other product you don't install. Agent Playbooks values go under the `playbook:` key.
+
+The suite sets these Agent Playbooks values itself. Don't set them under `playbook:`: a value that differs fails the render and names the field.
+
+- `tenantId`, from `global.iris.tenantId`.
+- `license.existingSecret` and `license.secretKey`, from `global.iris.license`.
+- `dataplane.identityServiceBaseURL` and `identityService.allowInsecureTransport`, for the suite's own Identity Service.
+- `identityService.credential` and `controlplane.internalToken`, from the credentials the suite generates or that you supply in `global.iris.secrets`. The admin token is in the Secret `iris-playbook-admin-token`.
+- `auth.oidc.audience`, `dataplane.oidc`, and `controlplane.oidc.enabled`, from `global.iris.auth.oidc` and `global.iris.auth.roleBindings`.
+- The extraction connection and worker settings, from `global.iris.extraction.enabled`. See [Configure background FAQ extraction](/content/operate/iris/agent-playbook/self-managed/extraction.md#extraction-with-the-redis-iris-suite-chart).
+- `fullnameOverride` (`redis-agent-playbook`), the Service ports, `dataplane.strategy`, and `podDisruptionBudget.enabled`, which the suite fixes. The suite runs two data-plane replicas by default.
+
+You still set `playbook.storage.existingSecret`, `playbook.inference.models`, and `playbook.inference.existingSecret` (unless every model is `noop`). Then install:
+
+```bash
+helm install iris redis-ai/redis-iris \
+  --version 1.0.0 \
+  --namespace <namespace-name> \
+  -f iris-values.yaml
+```
+
+The rest of this guide applies to the values under `playbook:`.
+
 ## Next steps
 
 - [Publish and retrieve your first FAQ](/content/develop/ai/context-engine/agent-playbooks/quickstart.md).

content/operate/iris/agent-playbook/self-managed/extraction.md

@@ -30,6 +30,10 @@ With release `playbook`, namespace `<namespace-name>`, and `fullnameOverride: pl
 
 If you change the namespace or resource names, change these subjects everywhere.
 
+## Extraction with the Redis Iris suite chart
+
+With the [`redis-iris` Helm chart](/content/operate/iris/agent-playbook/self-managed/deploy.md#install-with-the-redis-iris-suite-chart), set `global.iris.extraction.enabled: true` instead of the `extraction` values on this page. The suite derives the extraction connection, `worker.enabled`, and `worker.sourceURL`, and configures Redis Agent Memory to trust `system:serviceaccount:<namespace-name>:redis-agent-playbook-controlplane` and `system:serviceaccount:<namespace-name>:redis-agent-playbook-worker`, so skip [Configure Redis Agent Memory trust](#configure-redis-agent-memory-trust). You still create the worker Secret and set `playbook.worker.existingSecret` and `playbook.worker.region`. Leave `config.existingSecret` unset on both Redis Agent Memory planes and on the Agent Playbooks control plane.
+
 ## Plan the connection
 
 Prepare these values before you enable extraction: