Repository navigation
MOD-18825: Correct Iris self-managed docs for RAM 0.7.0 and LangCache 0.0.1 - #4218
Merged
Merged
Conversation
Delete plan-deployment and deploy-static, rename deploy-control-plane to deploy and data-plane-configuration to configuration (MOD-18825, spec "Old -> new page map" and "Pages removed"). - prerequisites carries the surviving plan-deployment content (agent-key Redis role paragraph, release-name sentence) unchanged. - deploy carries the deploy-static /health expected response (S-02); deleting deploy-static resolves RAM:S-01. - Aliases for every removed or renamed URL sit on the receiving page; existing aliases are kept. - In-section links in _index and deploy point at the new paths. No links outside the section reference the moved pages at cb9cb1f. data/page-moves.json is generated at build time and gitignored, so it needs no change.
…he Credentials table Replace the BYO Control Plane walkthrough on deploy with the eight-step chart-rendered path: namespace, Secrets, worker identity per platform (cluster-ca Secret, tls.caCertSecret and the issuer-discovery ClusterRoleBinding as a cluster admin decision), values, install without --create-namespace, health, store, agent key minted on the Identity Service, and one authenticated call. Corrects RAM:D-22, D-23, D1-01, V1-02, D-25, D-26 and V1-03. Add the RAM Credentials table near the top of authentication.
…ence Add "Before you install: check your values" to deploy after step 3: rows CL-1 to CL-6 as check, symptom, fix, with the symptom lines observed in the V1 checklist breaks. Each row has an anchor (cl-1 to cl-6). On reference, add troubleshooting rows RT-1 to RT-6, each linking its CL row (RT-5 folds into the existing ImagePullBackOff row), and correct RAM:R-01 to R-10: the three files the walkthrough creates, the extra chart Secrets, the introspection and removed-metadata-key errors, 401 and the new 503 row, PATCH on the Identity Service for grants, metadata.urls, Identity Service reachability, the product grant and internal token on 400, chart-root reference files, and the Identity Service image.
Add a closing Evaluate locally section (noop embedder plus in-cluster Ollama qwen2.5:3b) and a note beside the step 3 provider values that links to it.
_index: the chart always deploys the Data Plane, workers, Control Plane and Identity Service. Add the Identity Service component row (redis-agent-memory-identity-service:9200), say the Data Plane checks agent keys by calling the Identity Service, split the API surfaces into Control Plane (/v1/stores, /v1/detectors) and Identity Service (/v1/api-keys), and add the namespaces, MCP and health surfaces. Delete "Deployment modes" with no replacement (RAM:I-01 to I-07). The old "Plan a deployment" and "Deploy with static stores" link text goes with it. prerequisites: add redislabs/iris-identity-service:0.7.0 to the image list, mirror commands and air-gap values, with the chart's air-gap error text; list troubleshoot, asynqmon and python as mirrored images; raise Kubernetes and kubectl to 1.23+; replace the static and Control Plane store tables with one overlay-Secret table (databases."1".urls, metadata.urls, metadata.namespace, background_jobs.redis.urls, all required); make the Secrets table the three you create and link the Credentials table; add the Identity Service resources row; state that fullnameOverride fixes resource names; drop controlplane.enabled and add the P-15 values rows (RAM:P-01 to P-15, PD-01 to PD-04).
…YO section Retitle the page Configuration. Replace the static and Control Plane managed examples with a map of where each setting goes (shared, memory, controlplane.configData, identityService.*, overlay Secret keys) and a Data Plane settings table that adds the required metadata.urls, databases, embedding model and dimensions, auth (default agent_key) and inference_providers rows. Delete the "one store mode" rule (RAM:C-01 to C-06). Add "Bring-your-own (BYO) configuration": the keys the chart would otherwise inject (auth.agent_keys.introspection for the Data Plane, auth.internal_token.token_file for the Control Plane), the agent_key default and MEM_AUTH_METHOD, and corrected Data Plane and Control Plane files using metadata.urls, databases."1".urls and inference_providers.<name>.endpoint (RAM:D-21, D-24, A-04, A-05). The BYO Data Plane file carries the worker_identity and dataplane_client blocks from the deploy values, because agent-key auth needs them for worker callbacks. Point reference row R-03 and the prerequisites BYO link at the new section anchor.
Delete the static-to-live migration steps and config shape (RAM:A-02, A-03). State that the Data Plane checks agent keys with the Identity Service using the Data Plane service credential (A-01), that the chart-rendered configuration needs nothing more and BYO needs the introspection block on configuration (A-04, A-05), and that revocation lands within up to 5 minutes with 503 for uncached keys (A-06). Add a tenant-scoped grant example and the full action (A-07). Label auth.method: none once as development and testing only, and point Worker callbacks at the deploy values.
Move the agent-key examples out of the Control Plane section into an Identity Service API examples section using IDS_URL and IDS_CONTROL_TOKEN (RAM:K-01). Use the 0.7.0 grant shape with tenant and product memory, and add tenant, product and expiresAt to the field table (K-02). Show list, get, PATCH, rotate with graceSeconds and revoke, and state that rotate returns a new keyId (V1-01). List every required exclusions field (K-03).
Replace openapi-control-plane.json with the unedited Smithy output for
redis.ai.controlplane.onprem.memory#MemoryService at Iris 7db5d4c0.
Remove the six /v1/api-keys* operations and their schemas (RAM:O-01),
add GET /v1/detectors and longTermMemoryExclusions on create, update
and StoreOutput (O-02), and set info.version to 1.0.0 (O-03).
Regenerated with Smithy CLI 1.61.0:
git -C <iris> archive 7db5d4c0 smithy-build.controlplane-onprem.json \
common/api memory/controlplane-onprem/api | tar -x -C <dir>
cd <dir> && smithy build -c smithy-build.controlplane-onprem.json
cp out/smithy/source/cp-onprem-memory/MemoryService.openapi.json \
content/operate/iris/agent-memory/self-managed/control-plane-api-reference/openapi-control-plane.json
As with the LangCache Control Plane file, the title, description and
security block are the generator's: the hand-added bearerAuth security
scheme and reworded info text from the old file are gone.
…and NetworkPolicy Rotate agent keys through the Identity Service with graceSeconds, and state that rotate returns a new keyId and oldExpiresAt (RAM:X-02, RAM:V1-01). Back up the Identity Service Metadata Redis, here and in the prerequisites durability note (X-01). License rotation also rolls the Control Plane (X-03); overlay Secrets need a rollout restart (X-04). Use helm pull --untar paths for values-fips.yaml and networkpolicy.reference.yaml (X-05, X-08), GODEBUG=fips140=on (X-06), databases."1".urls (X-07), and add the DP to IdS 9200 and IdS to CP 9100 NetworkPolicy rules (X-08).
… table deploy: name the three credentials and link the new Credentials table; drop the image blocks (chart 0.0.1 defaults every tag), pin --version 0.0.1 and drop --create-namespace (LC:C1, LC:C5); add the Identity Service port-forward and control-token read to "Verify the deployment" (LC:W1); add "Before you install: check your values" with rows LC-CL-1 to LC-CL-3 and the symptom lines observed in V1. authentication: replace the three-item list with the five-row Credentials table; correct the admin/internal token sentence (LC:W6), the external Identity Service callback URL and internal-token copy (LC:W3), and add revocation timing (LC:W7). The grant example carries tenant, followed by "Use the same tenant on every grant of a key."
prerequisites: preflight footprint and one release per namespace (LC:C3); tls.caCertSecret/caCertKey and identityService.bundled.runtime.cache.* in the values table (LC:C4); Identity Service metadata in a separate keyspace (LC:C2, also on configuration). api-examples: create the cache with "attributes": ["topic"] (LC:W2); the grant carries tenant plus the same-tenant sentence; rotate gains ?graceSeconds=3600 and links the rotation facts on operations. operations: rotation returns a new keyId, graceSeconds default and maximum, oldExpiresAt, revoking the old keyId ends its grace (LC:W7, LC:V1-01); helm pull before kubectl preflight (LC:C8). reference: 401 row narrowed and a new 503 row (LC:W5); introspection cause and a product_validation mint/update row (LC:W4); unreachable Cache Redis row (LC:U1); NetworkPolicy row reworded (LC:C6); LT-1 to LT-3 link LC-CL-1 to LC-CL-3 on deploy. _index API table unchanged (LC:C7).
The grant examples showed <your-tenant-id> without saying what to put there. Any string is accepted; use 1 when managing caches or stores with the Control Plane admin token.
- RAM authentication: worker-callbacks issuer uses <service-account-issuer> instead of the hard-coded https://kubernetes.default.svc, which fails on kind (CL-6, RAM:V1-02). - RAM operations: admin token Secret is redis-agent-memory-controlplane-admin-token, the name the chart renders (V1 runs), matching deploy and authentication. - RAM Control Plane OpenAPI: restore the published title, info description and bearerAuth scheme; drop internal wording from the detectors descriptions. info.version stays 1.0.0 (O-03). Re-apply after the next Smithy regeneration until the model text is fixed upstream. - RAM index: link Prerequisites and Deploy from the page body. - RAM deploy: Evaluate locally now precedes Next steps; name the CL rows. - LC prerequisites: image tags and the air-gap loop use 0.0.1 (LC:C1). - LC authentication: drop the bundled Identity Service image tag (LC-CL-1); convert the new Operations link to a /content/ path. - LC deploy: name the LC-CL rows.
…mithy text Replaces the hand edit from d0b6002dd with unedited generator output again. Source: Iris 7db5d4c0 (the 0.7.0 model) with the Smithy text fix from redislabsdev/iris 20fb98dca (PR #1648) applied, built with Smithy CLI 1.61.0: smithy build -c smithy-build.controlplane-onprem.json cp out/smithy/source/cp-onprem-memory/MemoryService.openapi.json \ content/operate/iris/agent-memory/self-managed/control-plane-api-reference/openapi-control-plane.json The security scheme is now smithy.api.httpBearerAuth (generated) instead of the hand-written bearerAuth. The service description states that the admin token header and scheme are configurable and Bearer is the default.
Contributor
Contributor
🧠 Redis MemoryFound 5 related items from repository history (5 new this commit):
Memory updated at 64c018f |
|
|
EliShteinman
added a commit
to EliShteinman/docs
that referenced
this pull request
Oct 6, 2026
Updates the Iris self-managed docs for Agent Memory 0.7.0 and LangCache 0.0.1, consolidating the Agent Memory deploy pages into one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ticket: MOD-18825 · Control Plane OpenAPI text: redislabsdev/iris#1648
Summary
The Redis Agent Memory (RAM) and LangCache (LC) self-managed pages now describe the latest published charts (RAM
0.7.0, LC0.0.1): agent keys come from the Identity Service, stores are created through the Control Plane, and configuration is chart-rendered by default.RAM page set (
content/operate/iris/agent-memory/self-managed/), 12 → 10 pages:Removed and renamed pages keep their URLs through aliases.
LC (
content/operate/iris/langcache/self-managed/): same page set, corrected in place: Credentials table, Identity Service access in "Verify the deployment", checklist LC-CL-1..LC-CL-3, chart--version 0.0.1and0.0.1image tags,tenanton grants, rotation and revocation timing.openapi-control-plane.jsonis unedited Smithy output: Iris7db5d4c0(the 0.7.0 model) with the text from iris#1648 applied, Smithy CLI 1.61.0. The commit message has the commands.Evidence
0.7.0fails. They describe static stores and Control Plane key management that the chart no longer has. With the worker identity as drafted, every worker callback gets401and promotion jobs are archived after 3 retries (V1 run, 2026-10-05).After: the walkthrough values match the harness that passed the V1 run on kind for RAM and LC (agent key minted, store created, worker writes memories). Each checklist row's symptom line is the exact text observed when V1 broke that value on purpose.
After: Hugo
0.143.0build exits 0 with no unresolved-link warnings on any iris page. All 10 old RAM URLs redirect toprerequisites,deployorconfiguration. Nothing outsidecontent/operate/irislinks to the removed pages. Re-baseline:helm.redis.io/aistill tops out at RAM0.7.0and LC0.0.1.Not live-verified: the RAM Identity Service list, get and PATCH examples. They follow the Identity Service Smithy model; V1 exercised mint, rotate and revoke.
Merge Danger
Door: two-way
Merging to
mainpublishes to/docs/lateststraight away. A revert restores the old pages, and the aliases keep old URLs working either way.Blast Radius: section
Only
content/operate/iris/{agent-memory,langcache}/self-managed/changes. External bookmarks to the 4 removed or renamed RAM pages land on their replacements through redirects. If iris#1648 changes wording during review, regenerateopenapi-control-plane.jsonto match.Note
Low Risk
Documentation-only changes under
content/operate/iris; no runtime code, but published docs immediately affect how operators configure auth and worker identity.Overview
Redis Agent Memory self-managed docs are rewritten for chart 0.7.0: the Helm chart always ships Data Plane, workers, Control Plane, and Identity Service; static-store and optional Control Plane deployment paths are removed in favor of a single Deploy walkthrough (chart-rendered config, agent-key auth, store via Control Plane, keys via Identity Service on
:9200).Configuration moves to a new
configuration.md(Helmconfig.render, overlay secrets, BYO files withauth.agent_keys.introspection).authentication.mdandapi-examples.mddocument the credentials matrix, introspection/caching behavior, and full Identity Service key lifecycle (includingtenant/producton grants). The landing_index.mdupdates architecture flows and API surfaces (detectors, MCP, health).The bundled Control Plane OpenAPI drops
/v1/api-keys, bumps to 1.0.0, and adds/v1/detectorsplus long-term memory exclusions schemas on stores.operations.mdcovers separate Metadata Redis backups, IDS rotation withgraceSeconds, FIPS (GODEBUG), and NetworkPolicy notes for IDS traffic.Removed pages (
plan-deployment,deploy-static,deploy-control-plane,data-plane-configuration) keep URLs via aliases. LangCache gets a small fix clarifying Identity Service metadata uses key prefixiris:apikeyin a separate keyspace.Reviewed by Cursor Bugbot for commit 64c018f. Bugbot is set up for automated code reviews on this repo. Configure here.