{
  "schema_version": 2,
  "id": "operate/iris/agent-memory/self-managed/configuration",
  "title": "Configuration",
  "url": "https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/configuration/",
  "summary": "Configure the Redis Agent Memory Data Plane, Control Plane, and Identity Service from Helm values, or bring your own configuration files.",
  "aliases": [
    "/develop/ai/context-engine/agent-memory/self-managed/data-plane-configuration/",
    "/operate/iris/agent-memory/self-managed/data-plane-configuration/"
  ],
  "tags": [
    "docs",
    "operate",
    "iris"
  ],
  "last_updated": "2026-10-21T18:51:10+03:00",
  "page_type": "content",
  "content_hash": "e620c11ae64308f9b1648f8f6f878c5199c3142240b153137ae987094cac1bc9",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "The Memory chart renders Data Plane and Control Plane configuration from Helm values\n(`config.render: true` and `controlplane.config.render: true`). Identity Service uses its own\nrelease and `values-ids.yaml`. Credentials stay in existing Secrets. For a complete\nexample, see the values in [step 3 of Deploy](https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/deploy#3-create-ram-valuesyaml).\n\nTo supply complete configuration files in your own Secrets instead, see\n[Bring-your-own (BYO) configuration](#bring-your-own-byo-configuration)."
    },
    {
      "id": "where-each-setting-goes",
      "title": "Where each setting goes",
      "role": "content",
      "text": "| Values | Configures |\n| --- | --- |\n| `shared` | Settings common to the Data Plane and the Control Plane, such as `databases`. The chart merges them under `memory` and `controlplane.configData`. |\n| `memory` | The Data Plane and worker configuration file. |\n| `controlplane.configData` | The Control Plane configuration file. |\n| `dataplane.identityServiceBaseURL`, `identityService.credential.*`, `identityService.allowInsecureTransport` | Memory's connection to the standalone Identity Service. These values do not configure that service. |\n| Separate `values-ids.yaml` | Identity Service's `metadata`, `control`, `runtime`, `productValidation`, and optional `subjectGrants` values. |\n| Overlay Secret (`secrets.secretName`, key `overlay.yaml`) | `metadata.urls`, `metadata.namespace`, `databases.\"1\".urls`, `background_jobs.redis.urls`, and provider `api_key` values. The Data Plane, the workers, and the Control Plane all read it. |"
    },
    {
      "id": "data-plane-settings",
      "title": "Data Plane settings",
      "role": "content",
      "text": "Data Plane settings go under `memory`, or at the top level of a BYO Data Plane configuration file.\n\n| Setting | Purpose |\n| --- | --- |\n| `metadata.urls` | Required. Metadata Redis, which holds store records. `metadata.namespace` sets the key namespace (default `iris:memory`). |\n| `databases` | Required. Store Redis, as `databases.\"1\".urls`. |\n| `embedding.models.default_embedding_model`, `embedding.models.dimensions` | Required. The embedding model and its vector size. The Control Plane's `embedding.dimensions` must match. |\n| `auth` | Data Plane authentication. Defaults to `agent_key`. |\n| `inference_providers` | Required when any `llm` block is set. Each entry holds a provider's `endpoint`. |\n| `server` | Data Plane bind address and port. |\n| `license.license_path` | Path where the license Secret is mounted. |\n| `request_region` | Region used for background work routing. |\n| `background_jobs.redis` | Job Redis connection used by background workers. |\n| `background_jobs.idempotency` | Enable execution idempotency and extraction serialization for production workers. Requires `enabled: true` and `urls`; it can share Job Redis. |\n| `embedders_connection_details` | Embedding provider endpoint and credentials. |\n| `dataplane_client` | Worker callback client configuration. |\n| `promote_session_memory` | Promotion strategy and LLM connection used by workers. |\n\nAn `llm` block names its provider with `llm.provider`, which must match an `inference_providers`\nentry. The endpoint goes in `inference_providers.<name>.endpoint`, not in the `llm` block.\n\nIn the chart-rendered configuration, the chart writes the agent-key introspection settings for you:\nit owns `auth.agent_keys.introspection.base_url`, `credential`, and `allow_insecure_transport`, and\nrefuses hand-set values in either `memory.auth` or `shared.auth`. Cache tuning under\n`auth.agent_keys.introspection.cache` is still allowed. Set `dataplane.identityServiceBaseURL`\nand `identityService.credential.existingSecret`; optional `secretKey` defaults to `token`, and\n`existingSecretChecksum` triggers a rollout after credential rotation. Set `memory.auth.method: agent_key`\nexplicitly when combining agent keys with worker or other authentication methods.\n\nThe runtime endpoint must use `https://`. An `http://` endpoint is accepted only when\n`identityService.allowInsecureTransport: true` is set and the FIPS profile is not enabled.\nSubjects using the `identity_service` authority also need this connection for grant lookup,\neven when another authentication method is selected."
    },
    {
      "id": "bring-your-own-byo-configuration",
      "title": "Bring-your-own (BYO) configuration",
      "role": "content",
      "text": "With BYO configuration, you supply each complete configuration file in your own Secret, and the\nchart injects nothing into it. Add the keys the chart would otherwise write:\n\n- **Data Plane**: the `auth.agent_keys.introspection` block.\n- **Control Plane**: `auth.internal_token.token_file: /etc/controlplane-onprem/internal/token`\n  and `auth.admin_tenant_id` matching the installation's tenant.\n\nWith `config.existingSecret`, the chart does not inspect the supplied file. Rendering cannot\ncatch missing introspection settings or an invalid development profile in that file; startup\nvalidation still applies. Connection Secrets must still be named in Helm values so they are mounted.\n\nThe Data Plane defaults to `agent_key` whenever no auth method is set. A BYO Data Plane configuration\nwithout `auth` therefore needs the `auth.agent_keys.introspection` block. For development only,\n`auth.method: none` requires exact `profile: dev`.\nThe `MEM_AUTH_METHOD` environment variable overrides the method."
    },
    {
      "id": "data-plane-configuration-file",
      "title": "Data Plane configuration file",
      "role": "content",
      "text": "Create `memory-dataplane.config.yaml`:\n\n[code example]\n\nThe `auth.worker_identity` and `dataplane_client.auth` settings let workers call the Data Plane\nunder agent-key authentication. They need `workerAuth.enabled: true` in the values, and the platform\nsetup in [worker identity](https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/deploy#prepare-worker-identity-for-your-platform).\n\nCreate the Data Plane config Secret with the key `memory-dataplane.config.yaml`:\n\n[code example]"
    },
    {
      "id": "control-plane-configuration-file",
      "title": "Control Plane configuration file",
      "role": "content",
      "text": "Create `controlplane-onprem.config.yaml`:\n\n[code example]\n\nThe Control Plane only needs `embedding.dimensions`, to create each store's vector index. Configure\nthe embedding provider, model, and credentials in the Data Plane configuration.\n\nCreate the Control Plane config Secret:\n\n[code example]"
    },
    {
      "id": "helm-values",
      "title": "Helm values",
      "role": "content",
      "text": "In `ram-values.yaml`, replace `config.render`, `shared`, `memory`, `controlplane.config.render`, and\n`controlplane.configData` with the two Secrets. The chart fails at install time if both\n`config.existingSecret` and `config.render` are set.\n\n[code example]"
    },
    {
      "id": "connect-releases-across-namespaces",
      "title": "Connect releases across namespaces",
      "role": "content",
      "text": "For another namespace, resolve the standalone Service using its full address, such as\n`ids-iris-identity-service.<identity-namespace>.svc:9200`, and the Memory Control Plane as\n`redis-agent-memory-controlplane.<memory-namespace>.svc:9100`. Configure their TLS frontends\nfor the two connection URLs. With a naming override, use the rendered Service name.\n\nPods can mount Secrets only from their own namespace. Provision the same runtime credential\nand internal token values in both namespaces, plus each namespace's trust bundle. Allow Memory\nto reach Identity Service and Identity Service to reach the Control Plane, including any\nTLS proxies. See [Network policy](https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/operations#network-policy)."
    },
    {
      "id": "optional-playbook-extraction",
      "title": "Optional Playbook extraction",
      "role": "parameters",
      "text": "On the Identity Service release, allow Memory subject grants for Playbook extraction:\n\n[code example]\n\nAlso add `subject-grant-lookup` to the `memory-dp` runtime credential's `allowedOperations`\nalongside `api-key-introspect`. These are Identity Service values, not Memory's `identityService`\nvalues. `read_all_owners` is a subject-grant action; do not add it to agent-key grants."
    }
  ],
  "examples": [
    {
      "id": "data-plane-configuration-file-ex0",
      "language": "yaml",
      "code": "server:\n  host: 0.0.0.0\n  port: 9000\n\nlicense:\n  license_path: /etc/redis-agent-memory/license\ndefault_extraction_strategy: instruct\n\nrequest_region:\n  default: eu1\n\nbackground_jobs:\n  idempotency:\n    enabled: true\n    urls:\n      - redis://<job-redis-host>:6379\n  redis:\n    enabled: true\n    queue_prefix: ram\n    urls:\n      - redis://<job-redis-host>:6379\n    worker_regions:\n      - eu1\n\nmetadata:\n  urls:\n    - redis://<metadata-redis-host>:6379\n  namespace: iris:memory\n\ndatabases:\n  \"1\":\n    urls:\n      - redis://<store-redis-host>:6379\n\nauth:\n  method: agent_key\n  agent_keys:\n    introspection:\n      base_url: https://<identity-service-tls-endpoint>\n      product: memory\n      credential:\n        token_file: /etc/identity-service/runtime/memory-dp/token\n  worker_identity:\n    enabled: true\n    issuer: <service-account-issuer>\n    jwks_uri: https://kubernetes.default.svc/openid/v1/jwks\n    audience:\n      - redis-agent-memory\n    subjects:\n      - subject: \"system:serviceaccount:<namespace-name>:redis-agent-memory-worker\"\n        user_id: redis-agent-memory-worker\n        roles:\n          - operator\n        resources:\n          \"mem-store:*\":\n            permissions:\n              - write\n\nembedding:\n  provider: openai\n  models:\n    default_embedding_model: text-embedding-3-large\n    dimensions: 3072\n\nembedders_connection_details:\n  openai:\n    base_url: https://api.openai.com\n    credentials:\n      type: static\n      api_key: \"<embedding-api-key>\"\n\ninference_providers:\n  openai:\n    endpoint:\n      base_url: https://api.openai.com/v1\n      timeout: 30s\n      auth_format: bearer\n\ndataplane_client:\n  base_url: http://redis-agent-memory:9000\n  auth:\n    disabled: false\n    type: service_account_token\n    token_file: /var/run/secrets/redis-agent-memory-worker/token\n\npromote_session_memory:\n  strategies:\n    instruct:\n      llm:\n        provider: openai\n        credentials:\n          type: static\n          api_key: \"<promotion-llm-api-key>\"\n        models:\n          default_chat_model: gpt-4o",
      "section_id": "data-plane-configuration-file"
    },
    {
      "id": "data-plane-configuration-file-ex1",
      "language": "bash",
      "code": "kubectl -n <namespace-name> create secret generic ram-config \\\n  --from-file=memory-dataplane.config.yaml=./memory-dataplane.config.yaml",
      "section_id": "data-plane-configuration-file"
    },
    {
      "id": "control-plane-configuration-file-ex0",
      "language": "yaml",
      "code": "profile: prod\n\nauth:\n  type: admin-token\n  admin_token:\n    token_file: /etc/controlplane-onprem/admin/token\n  internal_token:\n    token_file: /etc/controlplane-onprem/internal/token\n  admin_tenant_id: default\n\nlicense:\n  license_path: /etc/redis-agent-memory/license\n\nmetadata:\n  urls:\n    - redis://<metadata-redis-host>:6379\n  namespace: iris:memory\n\ndatabases:\n  \"1\":\n    urls:\n      - redis://<store-redis-host>:6379\n\nembedding:\n  dimensions: 3072",
      "section_id": "control-plane-configuration-file"
    },
    {
      "id": "control-plane-configuration-file-ex1",
      "language": "bash",
      "code": "kubectl -n <namespace-name> create secret generic ram-controlplane-config \\\n  --from-file=controlplane-onprem.config.yaml=./controlplane-onprem.config.yaml",
      "section_id": "control-plane-configuration-file"
    },
    {
      "id": "helm-values-ex0",
      "language": "yaml",
      "code": "tenantId: default\nconfig:\n  existingSecret: ram-config\nidentityService:\n  credential:\n    existingSecret: memory-dp-credential\ncontrolplane:\n  internalToken:\n    existingSecret: memory-internal-token\n  config:\n    existingSecret: ram-controlplane-config",
      "section_id": "helm-values"
    },
    {
      "id": "optional-playbook-extraction-ex0",
      "language": "yaml",
      "code": "subjectGrants:\n  allowed:\n    - product: memory\n      resourceType: mem-store\n      actions: [read, read_all_owners]",
      "section_id": "optional-playbook-extraction"
    }
  ]
}