Iris docs: Identity Service self-managed guide for the redis-iris suite chart

content/operate/iris/agent-playbook/self-managed/authentication.md

@@ -140,4 +140,4 @@ The planes cache the JWKS for 10 minutes and allow 5 minutes of clock skew. If a
 
 ## OIDC access to agent-key administration
 
-The Identity Service has its own OIDC policy for its control API, configured on the Identity Service release with `controlAuth.oidc` and `controlAuth.roleBindings`. Configure it when operators must manage agent keys without the Identity Service control token. The control token remains available as a deployment-administration credential. See [operator sign-in with your identity provider](/content/operate/iris/identity-service/authentication.md#operator-sign-in-with-your-identity-provider) in the Identity Service guide.
+The Identity Service control API accepts the same IdP access tokens, configured once for the suite with `global.iris.auth.oidc` and `global.iris.auth.roleBindings`. Configure it when operators must manage agent keys without the Identity Service control token. The control token remains available as a deployment-administration credential. See [operator sign-in with your identity provider](/content/operate/iris/identity-service/self-managed/authentication.md#operator-sign-in-with-your-identity-provider) in the Identity Service guide.

content/operate/iris/context-gateway/self-managed/authentication.md

@@ -20,7 +20,7 @@ hideListLinks: true
 | Data Plane runtime token | Data Plane → Identity Service | The Secret in `dataplane.runtimeToken` / `token` | No | Checking agent keys for `context-gateway` |
 | Identity Service control token | Operator → Identity Service (`:9200`) | Set on the Identity Service release. By default the Identity Service chart generates it (`control.autoGenerate: true`), so read it from the Secret the chart generates | Yes, by default | Creating, listing, rotating, and revoking agent keys |
 | Agent key | Agent → Data Plane (`:8083`) | None. Returned once when minted or rotated | No | Listing and calling tools on the Gateways its grants name |
-| Identity provider access token | Agent → Data Plane (`:8083`) | None. Issued by your identity provider | No | The Gateways its role or subject grants name |
+| Identity provider access token | Agent → Data Plane (`:8083`) | None. Issued by your identity provider | No | With the `gateway_user` role, every Gateway in the tenant. Without it, none |
 
 The admin, internal, and runtime tokens must be distinct. An agent key gets `401` from the Control Plane. No credential that an agent presents is sent to an Upstream.
 
@@ -86,12 +86,9 @@ MCP clients then need to sign in again to receive tokens for the new audience.
 
 ### Grant signed-in users access
 
-Grant signed-in users access in either way:
+Map an IdP group to the `gateway_user` role in `role_mappings`. The role grants `use` on every Gateway in the tenant.
 
-- Map an IdP group to the `gateway_user` role. The role grants `use` on every Gateway in the tenant.
-- Assign Identity Service subject grants to individual users for selected Gateways, with `POST /v1/subject-grants/apply` on the Identity Service. See [subject grants](/content/operate/iris/identity-service/authentication.md#subject-grants) for the request. A subject grant names the IdP's issuer, the user's `user_id_claim` value, and the same product, resource type, Gateway ID, and `use` action as an agent-key grant.
-
-A specific subject grant cannot narrow the all-Gateway role, and removing a subject grant does not remove access that a role gives. To restrict a user to selected Gateways, don't map them to `gateway_user`.
+In a `redis-iris` installation the Data Plane can't read Identity Service [subject grants](/content/operate/iris/identity-service/self-managed/authentication.md#subject-grants), so they have no effect. Signed-in users can't be limited to selected Gateways, and a signed-in user without `gateway_user` can't use any Gateway. To give an agent access to selected Gateways only, give it an agent key with a grant for each one.
 
 <!-- TODO: Add the tested settings for Okta, Microsoft Entra ID, Auth0, and Keycloak. -->
 

content/operate/iris/context-gateway/self-managed/deploy.md

@@ -30,13 +30,13 @@ kubectl create namespace <namespace-name>
 
 ### Configure the Identity Service release first
 
-For every Identity Service setting, and for running one release that serves several products, see the [Identity Service guide](/content/operate/iris/identity-service/_index.md).
+These values apply to a standalone Identity Service release. The [`redis-iris` suite chart](/content/operate/iris/self-managed/_index.md) sets them for you, and fails the render if a value you set differs from the one it derives. See [What the chart sets for you](/content/operate/iris/identity-service/self-managed/deploy.md#what-the-chart-sets-for-you).
 
 Set these values on the Identity Service release so that it checks Gateway grants and accepts the Data Plane's runtime token:
 
 | Identity Service value | Setting |
 | --- | --- |
-| `runtime.serviceCredentials[]` | A credential for the Data Plane, `name: context-gateway-dp` and `subject: context-gateway-dataplane`, with `allowedOperations: [api-key-introspect]` and `allowedProducts: [context-gateway]`, from the same Secret as `dataplane.runtimeToken`. With Data Plane sign-in on, add `subject-grant-lookup` to `allowedOperations`. |
+| `runtime.serviceCredentials[]` | A credential for the Data Plane, `name: context-gateway-dp` and `subject: context-gateway-dataplane`, with `allowedOperations: [api-key-introspect]` and `allowedProducts: [context-gateway]`, from the same Secret as `dataplane.runtimeToken`. The `redis-iris` suite sets this credential and fails the render if you set it. |
 | `productValidation.products.context-gateway.baseURL` | The Control Plane Service, for example `http://gateway-redis-context-gateway-controlplane:9100`. |
 | `productValidation.products.context-gateway.credential` | The same Secret as `controlplane.internalToken`. |
 | `productValidation.products.context-gateway.enabled` | `true` |

content/operate/iris/identity-service/_index.md

@@ -1,6 +1,6 @@
 ---
 title: Identity Service
-description: Deploy and operate the Identity Service, which issues and checks agent keys for self-managed Redis Iris services.
+description: Issue and check the agent keys that applications and agents present to Redis Iris services.
 linkTitle: Identity Service
 alwaysopen: false
 categories:
@@ -11,16 +11,7 @@ weight: 29
 hideListLinks: true
 ---
 
-> [!NOTE]
-> The [`redis-iris` suite chart](/content/operate/iris/self-managed/_index.md), the supported self-managed install, always installs the Identity Service and registers each service with it. Installing the `iris-identity-service` chart on its own isn't a supported install path. These guides document its values, which you set under the suite chart's `identityService:` key.
-
-The Identity Service issues the agent keys that applications and agents present to self-managed Redis Iris services, and checks those keys for each service's data plane. Every self-managed Iris service connects to it, and one Identity Service release can serve all of them.
-
-This guide is for the platform administrator who installs the Identity Service, registers each service with it, and manages agent keys and operator access.
-
-> [!NOTE]
-> The Identity Service needs no license key of its own. Each Iris service you connect to it needs a license. Contact your Redis representative or
-> [contact sales](https://redis.io/contact/).
+The Identity Service issues the agent keys that applications and agents present to Redis Iris services, and checks those keys for each service's data plane. It keeps the keys and their grants, and no service data.
 
 ## Deployment options
 
@@ -30,58 +21,6 @@ On Redis Cloud, agent keys are managed for you: there is no Identity Service to
 
 ### Self-managed
 
-Deploy the Identity Service on Kubernetes to run it on your own infrastructure, before or alongside the services that use it.
-
-[Start with the deployment guide](/content/operate/iris/identity-service/deploy.md).
-
-## Which services use it
-
-Each of these services' self-managed guides installs the Identity Service as a separate release before the service:
-
-| Service | `product` in grants | `resourceType` in grants | Guide |
-| --- | --- | --- | --- |
-| Agent Memory | `memory` | `mem-store` | [Self-managed Agent Memory](/content/operate/iris/agent-memory/self-managed/_index.md) |
-| Agent Playbooks | `playbook` | `playbook` | [Self-managed Agent Playbooks](/content/operate/iris/agent-playbook/self-managed/_index.md) |
-| Context Gateway | `context-gateway` | `gateway` | [Self-managed Context Gateway](/content/operate/iris/context-gateway/self-managed/_index.md) |
-| Intent Router | `intent` | `intent-router` | [Self-managed Intent Router](/content/operate/iris/intent-router/self-managed/_index.md) |
-| Lens | `lens` | `lens-instance` | [Self-managed Lens](/content/operate/iris/lens/self-managed/_index.md) |
-
-If you already run an Identity Service release for one service, register the next service on that release instead of installing a second one. See [Register services](/content/operate/iris/identity-service/configuration.md#register-services).
-
-## What you deploy
-
-The `iris-identity-service` Helm chart deploys one Deployment and one ClusterIP Service on port `9200`. The guides install it as release `ids`, so its Service is `ids-iris-identity-service`.
-
-| Component | Purpose | Provided by |
-| --- | --- | --- |
-| Identity Service | Issues, lists, rotates, and revokes agent keys, and checks them for the service data planes. | The chart |
-| Control token Secret | The rescue credential for the Identity Service control API. | The chart generates it, or you supply it |
-| Metadata Redis | Stores the hashed agent keys, their grants, and subject grants. | You |
-| Runtime credentials and internal tokens | Shared Secrets between the Identity Service and each service. | You |
-
-The chart deploys no Redis, no service, no Ingress, and no NetworkPolicy. The Identity Service has no TLS listener: terminate Transport Layer Security (TLS) in your ingress, service mesh, or load balancer.
-
-## How it fits with the services
-
-The Identity Service listens on one port and serves three groups of routes. Each group accepts a different credential, sent as `Authorization: Bearer <value>`.
-
-| Route group | Routes | Caller | Credential |
-| --- | --- | --- | --- |
-| Control | `/v1/api-keys`, `/v1/products`, `/v1/subject-grants` | Operators and automation | The control token, or an operator's identity provider (IdP) access token |
-| Runtime | `/v1/auth/*` | Service data planes | The service's runtime credential |
-| Operational | `/health/liveness`, `/health/readiness` | Kubernetes probes and monitoring | None |
-
-1. An operator creates a resource in a service's control plane, such as an Agent Memory store or a Router in Intent Router.
-1. The operator mints an agent key for that resource through the Identity Service control API.
-1. Before it stores the key, the Identity Service asks the service's control plane to confirm that the resource exists and that the actions are valid. This step is called grant validation. It uses the control plane's internal token.
-1. The Identity Service returns the key once. It stores only a hash of the key.
-1. The agent sends the key to the service's data plane. The data plane checks it with the Identity Service, using its runtime credential, and caches the answer.
-
-The Identity Service keeps no service data.
-
-## Pages in this guide
+The [`redis-iris` suite chart](/content/operate/iris/self-managed/_index.md) always installs the Identity Service, and registers each service you enable with it.
 
-- [Deploy](/content/operate/iris/identity-service/deploy.md): prerequisites, install, and verification.
-- [Configuration](/content/operate/iris/identity-service/configuration.md): the metadata Redis, the tenant, service registration, and the other Helm values.
-- [Authentication and authorization](/content/operate/iris/identity-service/authentication.md): credentials, roles, operator sign-in with your IdP, and subject grants.
-- [Operations](/content/operate/iris/identity-service/operations.md): the agent-key lifecycle, credential rotation, upgrades, backups, and troubleshooting.
+[Start with the self-managed guide](/content/operate/iris/identity-service/self-managed/_index.md).