Configuration

Configure the Redis Agent Memory Data Plane, Control Plane, and Identity Service from Helm values, or bring your own configuration files.

The Memory chart renders Data Plane and Control Plane configuration from Helm values (config.render: true and controlplane.config.render: true). Identity Service uses its own release and values-ids.yaml. Credentials stay in existing Secrets. For a complete example, see the values in step 3 of Deploy.

To supply complete configuration files in your own Secrets instead, see Bring-your-own (BYO) configuration.

Where each setting goes

Data Plane settings

Data Plane settings go under memory, or at the top level of a BYO Data Plane configuration file.

An llm block names its provider with llm.provider, which must match an inference_providers entry. The endpoint goes in inference_providers.<name>.endpoint, not in the llm block.

In the chart-rendered configuration, the chart writes the agent-key introspection settings for you: it owns auth.agent_keys.introspection.base_url, credential, and allow_insecure_transport, and refuses hand-set values in either memory.auth or shared.auth. Cache tuning under auth.agent_keys.introspection.cache is still allowed. Set dataplane.identityServiceBaseURL and identityService.credential.existingSecret; optional secretKey defaults to token, and existingSecretChecksum triggers a rollout after credential rotation. Set memory.auth.method: agent_key explicitly when combining agent keys with worker or other authentication methods.

The runtime endpoint must use https://. An http:// endpoint is accepted only when identityService.allowInsecureTransport: true is set and the FIPS profile is not enabled. Subjects using the identity_service authority also need this connection for grant lookup, even when another authentication method is selected.

Bring-your-own (BYO) configuration

With BYO configuration, you supply each complete configuration file in your own Secret, and the chart injects nothing into it. Add the keys the chart would otherwise write:

• Data Plane: the auth.agent_keys.introspection block.
• Control Plane: auth.internal_token.token_file: /etc/controlplane-onprem/internal/token and auth.admin_tenant_id matching the installation's tenant.

With config.existingSecret, the chart does not inspect the supplied file. Rendering cannot catch missing introspection settings or an invalid development profile in that file; startup validation still applies. Connection Secrets must still be named in Helm values so they are mounted.

The Data Plane defaults to agent_key whenever no auth method is set. A BYO Data Plane configuration without auth therefore needs the auth.agent_keys.introspection block. For development only, auth.method: none requires exact profile: dev. The MEM_AUTH_METHOD environment variable overrides the method.

Data Plane configuration file

Create memory-dataplane.config.yaml:

server:
  host: 0.0.0.0
  port: 9000

license:
  license_path: /etc/redis-agent-memory/license
default_extraction_strategy: instruct

request_region:
  default: eu1

background_jobs:
  idempotency:
    enabled: true
    urls:
      - redis://<job-redis-host>:6379
  redis:
    enabled: true
    queue_prefix: ram
    urls:
      - redis://<job-redis-host>:6379
    worker_regions:
      - eu1

metadata:
  urls:
    - redis://<metadata-redis-host>:6379
  namespace: iris:memory

databases:
  "1":
    urls:
      - redis://<store-redis-host>:6379

auth:
  method: agent_key
  agent_keys:
    introspection:
      base_url: https://<identity-service-tls-endpoint>
      product: memory
      credential:
        token_file: /etc/identity-service/runtime/memory-dp/token
  worker_identity:
    enabled: true
    issuer: <service-account-issuer>
    jwks_uri: https://kubernetes.default.svc/openid/v1/jwks
    audience:
      - redis-agent-memory
    subjects:
      - subject: "system:serviceaccount:<namespace-name>:redis-agent-memory-worker"
        user_id: redis-agent-memory-worker
        roles:
          - operator
        resources:
          "mem-store:*":
            permissions:
              - write

embedding:
  provider: openai
  models:
    default_embedding_model: text-embedding-3-large
    dimensions: 3072

embedders_connection_details:
  openai:
    base_url: https://api.openai.com
    credentials:
      type: static
      api_key: "<embedding-api-key>"

inference_providers:
  openai:
    endpoint:
      base_url: https://api.openai.com/v1
      timeout: 30s
      auth_format: bearer

dataplane_client:
  base_url: http://redis-agent-memory:9000
  auth:
    disabled: false
    type: service_account_token
    token_file: /var/run/secrets/redis-agent-memory-worker/token

promote_session_memory:
  strategies:
    instruct:
      llm:
        provider: openai
        credentials:
          type: static
          api_key: "<promotion-llm-api-key>"
        models:
          default_chat_model: gpt-4o

The auth.worker_identity and dataplane_client.auth settings let workers call the Data Plane under agent-key authentication. They need workerAuth.enabled: true in the values, and the platform setup in worker identity.

Create the Data Plane config Secret with the key memory-dataplane.config.yaml:

kubectl -n <namespace-name> create secret generic ram-config \
  --from-file=memory-dataplane.config.yaml=./memory-dataplane.config.yaml

Control Plane configuration file

Create controlplane-onprem.config.yaml:

profile: prod

auth:
  type: admin-token
  admin_token:
    token_file: /etc/controlplane-onprem/admin/token
  internal_token:
    token_file: /etc/controlplane-onprem/internal/token
  admin_tenant_id: default

license:
  license_path: /etc/redis-agent-memory/license

metadata:
  urls:
    - redis://<metadata-redis-host>:6379
  namespace: iris:memory

databases:
  "1":
    urls:
      - redis://<store-redis-host>:6379

embedding:
  dimensions: 3072

The Control Plane only needs embedding.dimensions, to create each store's vector index. Configure the embedding provider, model, and credentials in the Data Plane configuration.

Create the Control Plane config Secret:

kubectl -n <namespace-name> create secret generic ram-controlplane-config \
  --from-file=controlplane-onprem.config.yaml=./controlplane-onprem.config.yaml

Helm values

In ram-values.yaml, replace config.render, shared, memory, controlplane.config.render, and controlplane.configData with the two Secrets. The chart fails at install time if both config.existingSecret and config.render are set.

tenantId: default
config:
  existingSecret: ram-config
identityService:
  credential:
    existingSecret: memory-dp-credential
controlplane:
  internalToken:
    existingSecret: memory-internal-token
  config:
    existingSecret: ram-controlplane-config

Connect releases across namespaces

For another namespace, resolve the standalone Service using its full address, such as ids-iris-identity-service.<identity-namespace>.svc:9200, and the Memory Control Plane as redis-agent-memory-controlplane.<memory-namespace>.svc:9100. Configure their TLS frontends for the two connection URLs. With a naming override, use the rendered Service name.

Pods can mount Secrets only from their own namespace. Provision the same runtime credential and internal token values in both namespaces, plus each namespace's trust bundle. Allow Memory to reach Identity Service and Identity Service to reach the Control Plane, including any TLS proxies. See Network policy.

Optional Playbook extraction

On the Identity Service release, allow Memory subject grants for Playbook extraction:

subjectGrants:
  allowed:
    - product: memory
      resourceType: mem-store
      actions: [read, read_all_owners]

Also add subject-grant-lookup to the memory-dp runtime credential's allowedOperations alongside api-key-introspect. These are Identity Service values, not Memory's identityService values. read_all_owners is a subject-grant action; do not add it to agent-key grants.