{
  "schema_version": 2,
  "id": "operate/iris/agent-memory/self-managed/operations",
  "title": "Operations",
  "url": "https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/operations/",
  "summary": "Operate Redis Agent Memory with backups, secret rotation, updates, FIPS posture, and network policy.",
  "aliases": [
    "/develop/ai/context-engine/agent-memory/self-managed/operations/"
  ],
  "tags": [
    "docs",
    "operate",
    "iris"
  ],
  "last_updated": "2026-10-21T18:51:10+03:00",
  "page_type": "content",
  "content_hash": "6b5177c3ee94adeea89999856e5c1353ea0710beb5af9ad3c3b3fb2eca9ad1ec",
  "sections": [
    {
      "id": "backups",
      "title": "Backups",
      "role": "overview",
      "text": "- Back up Metadata Redis. Losing it removes Control Plane store records.\n- Back up the Identity Service Metadata Redis, which may be a separate\n  database. Losing it removes agent-key records.\n- Back up Store Redis according to the customer's memory-retention policy.\n- Back up Job Redis if background job replay or delayed-job preservation is\n  required by the deployment's recovery policy.\n- Back up any external secret manager material used to recreate Kubernetes\n  Secrets.\n- For Job Redis, use persistent storage where supported and a non-volatile /\n  `noeviction` policy. OOM can still lose jobs or leave worker state invalid;\n  capacity alerts and compatibility checks should make that caveat visible.\n- For Metadata Redis and the Identity Service Metadata Redis, use persistent\n  storage and an eviction policy that does not evict store or agent-key records\n  under memory pressure."
    },
    {
      "id": "secret-rotation",
      "title": "Secret rotation",
      "role": "content",
      "text": "Use the [Identity Service port-forward and control token](https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/deploy#7-mint-an-agent-key)\nfrom the deployment procedure to rotate agent keys:\n\n[code example]\n\nThe response contains the new token. Store it immediately; tokens are returned\nonly when a key is minted or rotated.\n\nRotation returns a new `keyId` with the new token. Use the new `keyId` for later\nupdates, rotations, and revocations. The old key stays valid for `graceSeconds`,\nwhich defaults to 3600 and has a chart maximum of 604800\n(`apiKeys.maxRotateGraceSeconds` on the Identity Service release). The response adds\n`oldExpiresAt`, the time the old key stops working. Revoking the old `keyId`\nends its grace period early. For the full request and response, see\n[API examples](https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/api-examples#identity-service-api-examples).\n\nRotate the Control Plane admin token by updating `redis-agent-memory-controlplane-admin-token`.\nThe Control Plane reads the token on use, so changing the token value does not\nrequire a Control Plane redeploy.\n\n[code example]\n\nThe runtime credential and Control Plane internal token are shared by both releases.\nWhen rotating either, keep the values equal in every namespace that mounts them, update the\ncorresponding checksums, and roll the affected workloads on both releases:\n\n| Credential | Memory checksum value | Identity Service checksum value |\n| --- | --- | --- |\n| `memory-dp-credential` | `identityService.credential.existingSecretChecksum` | `existingSecretChecksum` on the matching `runtime.serviceCredentials[]` entry |\n| `memory-internal-token` | `controlplane.internalToken.existingSecretChecksum` | `productValidation.products.memory.credential.existingSecretChecksum` |\n\nFor example, rotate `memory-dp-credential` in the walkthrough's namespace:\n\n[code example]\n\nIn the walkthrough, `memory-dp` is entry `0` in `runtime.serviceCredentials`. With another list,\nupdate the matching entry. Persist the checksum in both values files for later upgrades, and\nverify the affected Deployments are Ready. For the internal token, use the corresponding paths\nin the table. For multiple namespaces, provision the new token value in each namespace.\n\nCoordinate rotation: mismatched runtime credentials reject authentication, and mismatched\ninternal tokens prevent grant validation. Identity Service's operator control token is separate;\nits checksum is `control.existingSecretChecksum` on that release.\n\nRotate the Redis Agent Memory license by updating the license Secret and changing\n`license.existingSecretChecksum` so Helm rolls the Data Plane, worker, and\nControl Plane pods.\nRedis Agent Memory reads and validates the license file during process startup; updating only\nthe Secret data is not sufficient.\n\n[code example]\n\nCalculate the new SHA-256 checksum. This value is used by Helm values to roll\npods after the license Secret changes; it is not used to validate Secret\nintegrity.\n\n**Linux:**\n\n[code example]\n\n**macOS:**\n\n[code example]\n\n\n\n[code example]\n\nApply the updated values and verify the workloads rolled:\n\n[code example]\n\nFor immutable license Secrets, create a new Secret name instead, then update\nboth `license.existingSecret` and `license.existingSecretChecksum`.\n\nConfig that the chart renders from your values rolls the pods on its own when\nyou run `helm upgrade`. If you bring your own config Secrets, rotate the shared\nData Plane config by updating the config Secret and changing\n`config.existingSecretChecksum`, and rotate the Control Plane config by updating\nthe config Secret and changing `controlplane.config.existingSecretChecksum`.\n\nIf you change an overlay Secret (`secrets.*`) in place, restart the\ndeployments, because the chart does not track the Secret contents:\n\n[code example]"
    },
    {
      "id": "updates",
      "title": "Updates",
      "role": "content",
      "text": "Memory and Identity Service have independent release versions. Upgrade each with its own\nvalues file and verify their shared connection contract afterward. A Memory upgrade does not\nupgrade Identity Service. The published pair documented here is Memory `0.8.0` and Identity\nService `0.10.0`.\n\nFor updates within a supported release path:\n\n1. Update chart version and image tags.\n2. Recalculate Secret checksums for changed files.\n3. Run `helm upgrade`.\n4. Verify pod rollout and health endpoints.\n\nExample:\n\n[code example]\n\nOn small clusters, avoid `--atomic` unless the timeout and capacity are known to\nbe sufficient."
    },
    {
      "id": "upgrade-from-a-bundled-identity-service",
      "title": "Upgrade from a bundled Identity Service",
      "role": "content",
      "text": "Direct `helm upgrade` from an earlier chart with bundled Identity Service, including Memory\n`0.7.0`, to `0.8.0` is unsupported. Use a fresh installation. The following manual migration\noutline is untested guidance, not a supported upgrade procedure:\n\n1. Back up store and agent-key metadata. Preserve the existing runtime credential, Control Plane\n   internal token, metadata Redis addresses, and key namespaces.\n2. Provision the shared Secrets with those existing values and configure a standalone Identity\n   Service to use the same agent-key metadata. Do not let two independent releases manage one Secret.\n3. Retain the tenant used by existing stores and keys. Earlier admin-token stores used tenant `1`;\n   set `tenantId` and `runtime.apiKeyTenant.singleTenantID` accordingly, or migrate metadata first.\n4. Plan the replacement of the old Memory release and removal of bundled resources with Redis.\n   Keep backups and retained Secrets until the new installation and existing keys are verified."
    },
    {
      "id": "chart-tests",
      "title": "Chart tests",
      "role": "content",
      "text": "The chart can render optional `helm test` resources when `tests.enabled=true`.\n\nEnable and run the basic chart test:\n\n[code example]\n\nTo run the API smoke test, also provide a configured store ID:\n\n[code example]\n\nUse the smoke test only for auth-disabled Data Plane deployments or for\nenvironments where the in-cluster test path is allowed."
    },
    {
      "id": "fips-oriented-posture",
      "title": "FIPS-oriented posture",
      "role": "content",
      "text": "Both releases support an opt-in Federal Information Processing Standards (FIPS) posture.\nSet `security.profile: fips` or its fallback `global.security.profile: fips` on each release.\nA value passed only to Memory does not configure Identity Service.\n\nIn `ram-values.yaml`:\n\n[code example]\n\nIn `values-ids.yaml`:\n\n[code example]\n\nThe Memory chart refuses `identityService.allowInsecureTransport: true` under FIPS.\nIdentity Service refuses to start with a non-HTTPS product validator URL under FIPS.\nNeither chart terminates Transport Layer Security (TLS). Your hosting environment supplies\nboth endpoints through a service mesh, ingress, or TLS proxy. Memory trusts its runtime\nendpoint through its own `tls.caCertSecret`; Identity Service trusts the validator endpoint\nthrough that release's `tls.caCertSecret`, each in addition to system certificate authorities.\n\nMemory also ships a `values-fips.yaml` overlay. Apply it only to Memory, and configure the\nIdentity Service release's posture separately:\n\n[code example]\n\nBoth charts set `GODEBUG=fips140=on` on their application containers and enable\nFIPS-oriented runtime checks.\n\nThis is not a formal FIPS 140 compliance or validation claim. Treat it as a\ndeployment posture and guardrail that must still be reviewed against the\ncustomer's compliance boundary.\n\nWhen the posture is active, the Data Plane and worker reject config that:\n\n- enables `skip_verify` on outbound HTTP clients;\n- sets `allow_insecure_transport` on any authentication block, even a disabled one; or\n- uses non-`rediss://` URLs for Redis connections covered by the posture.\n\nThe Control Plane runs under the same posture and rejects non-`rediss://`\n`metadata.urls` or `databases.\"1\".urls`.\n\nThe Identity Service sends the Control Plane internal token on every grant validation. Under\nthe posture it refuses to start unless each product validator URL uses `https://`.\nConfigure that URL on the Identity Service release, not under Memory's `identityService`.\n\nThe Redis Agent Memory API listener itself speaks HTTP inside the cluster. Edge TLS termination\nis owned by the hosting environment, such as ingress, service mesh, or external\nload balancer. Outbound TLS to Redis, embedding providers, LLM providers, and\nworker callback endpoints is configured through Redis Agent Memory config and is covered by the\nposture checks.\n\nVerify the runtime posture with:\n\n[code example]\n\nUse the chart-generated Deployment to enable the FIPS-oriented posture. Do not\noverride the container command to configure it."
    },
    {
      "id": "network-policy",
      "title": "Network policy",
      "role": "content",
      "text": "For auth-disabled Data Plane deployments, restrict access to trusted callers.\nFor agent-key deployments behind a gateway, prevent direct bypass paths unless\nthe direct caller also has a valid Redis Agent Memory credential.\n\nThe chart includes `networkpolicy.reference.yaml` at the chart root as a\nreference manifest. Get it with\n`helm pull redis-ai/redis-agent-memory --version 0.8.0 --untar`. It is not templated because allowed callers are\nenvironment-specific.\n\nCustomize the placeholders before applying it:\n\n- `<namespace>`: namespace where Redis Agent Memory is installed.\n- `<release-name>`: Helm release name. This guide uses `redis-agent-memory`.\n  `fullnameOverride` fixes Memory's default resource names to `redis-agent-memory`.\n  Naming overrides change rendered resource names, but the\n  `app.kubernetes.io/instance` selector remains the Helm release name.\n- `<caller-namespace>` and caller pod labels: ingress controller, service mesh\n  gateway, application pod, or approved internal caller allowed to call Redis Agent Memory.\n\nThe reference policy default-denies ingress to Redis Agent Memory chart pods, then allows TCP\ntraffic to server pods on port `9000` from approved callers and the worker\nDeployment. It also includes a Control Plane stanza for port `9100`, which\nalways applies.\n\nThe reference includes Control Plane ingress from the separate Identity Service release.\nSet `<identity-service-namespace>` and `<identity-service-release-name>` to its namespace and\nrelease name (`ids` in the walkthrough). It does not manage ingress for Identity Service itself.\nUnder default-deny, allow Data Plane requests to that release on port `9200`, and Identity\nService requests to the Control Plane on port `9100`. If TLS proxies sit between them, allow\nthe proxy ports and actual source pods too. Add corresponding egress rules when egress is restricted.\n\nReview the manifest against the customer's CNI,\ningress path, and service mesh behavior before production use."
    }
  ],
  "examples": [
    {
      "id": "secret-rotation-ex0",
      "language": "bash",
      "code": "IDS_URL=http://localhost:9200\ncurl -sS -X POST \"$IDS_URL/v1/api-keys/<key-id>/rotate?graceSeconds=3600\" \\\n  -H \"Authorization: Bearer $IDS_CONTROL_TOKEN\"",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex1",
      "language": "bash",
      "code": "kubectl -n <namespace-name> create secret generic redis-agent-memory-controlplane-admin-token \\\n  --from-literal=token='<new-admin-token>' \\\n  --dry-run=client \\\n  -o yaml | kubectl apply -f -",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex2",
      "language": "bash",
      "code": "umask 077\nopenssl rand -hex 32 | tr -d '\\n' > memory-dp-token\nkubectl -n <namespace-name> create secret generic memory-dp-credential \\\n  --from-file=token=./memory-dp-token --save-config --dry-run=client -o yaml | kubectl apply -f -\nRUNTIME_CREDENTIAL_CHECKSUM=\"$(shasum -a 256 ./memory-dp-token | awk '{print $1}')\"\n\nhelm upgrade ids redis-ai/iris-identity-service \\\n  --version 0.10.0 \\\n  --namespace <namespace-name> \\\n  -f values-ids.yaml \\\n  --set-string \"runtime.serviceCredentials[0].existingSecretChecksum=$RUNTIME_CREDENTIAL_CHECKSUM\"\nhelm upgrade redis-agent-memory redis-ai/redis-agent-memory \\\n  --version 0.8.0 \\\n  --namespace <namespace-name> \\\n  -f ram-values.yaml \\\n  --set-string \"identityService.credential.existingSecretChecksum=$RUNTIME_CREDENTIAL_CHECKSUM\"",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex3",
      "language": "bash",
      "code": "kubectl -n <namespace-name> create secret generic ram-license \\\n  --from-file=license=./license \\\n  --dry-run=client \\\n  -o yaml | kubectl apply -f -",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex4",
      "language": "bash",
      "code": "LICENSE_CHECKSUM=\"$(sha256sum ./license | awk '{print $1}')\"",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex5",
      "language": "bash",
      "code": "LICENSE_CHECKSUM=\"$(shasum -a 256 ./license | awk '{print $1}')\"",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex6",
      "language": "yaml",
      "code": "license:\n  existingSecret: ram-license\n  existingSecretChecksum: \"<new-license-checksum>\"",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex7",
      "language": "bash",
      "code": "helm upgrade redis-agent-memory redis-ai/redis-agent-memory \\\n  --version <chart-version> \\\n  --namespace <namespace-name> \\\n  -f ram-values.yaml\n\nkubectl -n <namespace-name> rollout status deploy/redis-agent-memory\nkubectl -n <namespace-name> rollout status deploy/redis-agent-memory-worker\nkubectl -n <namespace-name> rollout status deploy/redis-agent-memory-controlplane",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex8",
      "language": "bash",
      "code": "kubectl -n <namespace-name> rollout restart deployment",
      "section_id": "secret-rotation"
    },
    {
      "id": "updates-ex0",
      "language": "bash",
      "code": "helm upgrade redis-agent-memory redis-ai/redis-agent-memory \\\n  --version <chart-version> \\\n  --namespace <namespace-name> \\\n  -f ram-values.yaml",
      "section_id": "updates"
    },
    {
      "id": "chart-tests-ex0",
      "language": "bash",
      "code": "helm upgrade --install redis-agent-memory redis-ai/redis-agent-memory \\\n  --version <chart-version> \\\n  --namespace <namespace-name> \\\n  -f ram-values.yaml \\\n  --set tests.enabled=true\n\nhelm test redis-agent-memory --namespace <namespace-name>",
      "section_id": "chart-tests"
    },
    {
      "id": "chart-tests-ex1",
      "language": "bash",
      "code": "helm upgrade --install redis-agent-memory redis-ai/redis-agent-memory \\\n  --version <chart-version> \\\n  --namespace <namespace-name> \\\n  -f ram-values.yaml \\\n  --set tests.enabled=true \\\n  --set tests.smoke.enabled=true \\\n  --set tests.smoke.storeId=<store-id>\n\nhelm test redis-agent-memory --namespace <namespace-name> --logs",
      "section_id": "chart-tests"
    },
    {
      "id": "fips-oriented-posture-ex0",
      "language": "yaml",
      "code": "security:\n  profile: fips\ndataplane:\n  identityServiceBaseURL: https://<identity-service-tls-endpoint>\ntls:\n  caCertSecret: ram-ca",
      "section_id": "fips-oriented-posture"
    },
    {
      "id": "fips-oriented-posture-ex1",
      "language": "yaml",
      "code": "security:\n  profile: fips\nproductValidation:\n  products:\n    memory:\n      baseURL: https://<control-plane-tls-endpoint>\n      credential:\n        existingSecret: memory-internal-token\ntls:\n  caCertSecret: ram-ca",
      "section_id": "fips-oriented-posture"
    },
    {
      "id": "fips-oriented-posture-ex2",
      "language": "bash",
      "code": "helm pull redis-ai/redis-agent-memory --version 0.8.0 --untar\nhelm upgrade redis-agent-memory redis-ai/redis-agent-memory \\\n  --version 0.8.0 \\\n  --namespace <namespace-name> \\\n  -f ram-values.yaml \\\n  -f redis-agent-memory/values-fips.yaml\n\nhelm upgrade ids redis-ai/iris-identity-service \\\n  --version 0.10.0 \\\n  --namespace <namespace-name> \\\n  -f values-ids.yaml",
      "section_id": "fips-oriented-posture"
    },
    {
      "id": "fips-oriented-posture-ex3",
      "language": "bash",
      "code": "kubectl -n <namespace-name> get deploy redis-agent-memory \\\n  -o jsonpath='{.spec.template.spec.containers[0].env[?(@.name==\"GODEBUG\")].value}'\n\nkubectl -n <namespace-name> logs deploy/redis-agent-memory | grep -i 'FIPS security profile'",
      "section_id": "fips-oriented-posture"
    }
  ]
}