{
  "schema_version": 2,
  "id": "operate/iris/agent-memory/self-managed/prerequisites",
  "title": "Self-managed Redis Agent Memory prerequisites",
  "url": "https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/prerequisites/",
  "summary": "Review software, Redis, network, Secret, image, and sizing prerequisites for self-managed Redis Agent Memory.",
  "aliases": [
    "/develop/ai/context-engine/agent-memory/self-managed/prerequisites/",
    "/develop/ai/context-engine/agent-memory/self-managed/plan-deployment/",
    "/operate/iris/agent-memory/self-managed/plan-deployment/"
  ],
  "tags": [
    "docs",
    "operate",
    "iris"
  ],
  "last_updated": "2026-10-21T18:51:10+03:00",
  "page_type": "content",
  "content_hash": "c1ca077d103e68fa18acc6368869c27d4880504171f447ef8c74564ce104e9d0",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "Redis Agent Memory is distributed as container images on Docker Hub plus a Helm\nchart in the Redis AI Helm repository. The chart deploys the Redis Agent Memory Data\nPlane, Redis Agent Memory workers, and the Redis Agent Memory Control Plane. Install Identity\nService separately with the `iris-identity-service` chart `0.10.0` before connecting Memory chart `0.8.0`.\n\nYou provide the Redis databases, provider credentials, Kubernetes exposure, and\nlicense material used by the deployment.\n\n> [!NOTE]\n> This guide is for system administrators deploying Redis Agent Memory on a self-managed\n> Kubernetes cluster."
    },
    {
      "id": "what-you-need",
      "title": "What you need",
      "role": "content",
      "text": "| Item | Where it comes from |\n| ---- | ------------------- |\n| Container images | Docker Hub: `redislabs/agent-memory`, `redislabs/agent-memory-control-plane`, and `redislabs/iris-identity-service` |\n| Helm charts | `redis-agent-memory` `0.8.0` and `iris-identity-service` `0.10.0` in the Redis AI Helm repository |\n| Redis databases | You provide Store Redis, Job Redis, and Metadata Redis |\n| License key | Contact your Redis representative or [contact sales](https://redis.io/contact/). |\n| Provider credentials | You provide embedding provider credentials and, when worker features are enabled, promotion or summarization LLM credentials |"
    },
    {
      "id": "required-software",
      "title": "Required software",
      "role": "content",
      "text": "| Software | Minimum version | Purpose |\n| -------- | --------------- | ------- |\n| Kubernetes | 1.23+ | Orchestration |\n| kubectl | 1.23+ | Kubernetes CLI |\n| Helm | 3.x | Package manager |"
    },
    {
      "id": "redis-databases",
      "title": "Redis databases",
      "role": "content",
      "text": "The Helm chart does not deploy Redis databases. Provision the Redis databases\noutside the Redis Agent Memory chart and pass their URLs in the overlay Secret.\nThe Data Plane and the Control Plane both read the overlay, so they use the same\nMetadata Redis and Store Redis.\n\nStore Redis must support Search and JSON capabilities because Redis Agent Memory\ncreates JSON and vector search indexes for memory data. Job Redis and Metadata\nRedis do not need those capabilities when they are deployed as separate Redis\ndatabases.\n\n| Redis database | Required | Key in the overlay Secret | Purpose |\n| --- | --- | --- | --- |\n| Store Redis | Always | `databases.\"1\".urls` | Session memory JSON, long-term memory hashes, RediSearch indexes, vectors, and TTL-managed data. |\n| Metadata Redis | Always | `metadata.urls`, and optionally `metadata.namespace` (default `iris:memory`) | Store records. |\n| Job Redis | Always | `background_jobs.redis.urls` and, when execution idempotency is enabled, `background_jobs.idempotency.urls` | Background work, retry state, delayed jobs, and execution markers. The two settings can use the same Redis. |\n\nThe Identity Service reads its Metadata Redis from `metadata.urls` in its own metadata Secret and\nkeeps agent-key records there. The Data Plane checks agent keys by calling the Identity Service.\n\nFor a lab deployment, the Redis roles can point to the same Redis endpoint if it has the required\nmodules and capacity. For production, separate Store Redis, Job Redis, and Metadata Redis when\npossible so memory data, background work, and control metadata can be scaled, backed up, and\noperated independently.\n\nFor Job Redis, use a non-evicting policy such as `noeviction` or\n`volatile-ttl`."
    },
    {
      "id": "metadata-redis-durability",
      "title": "Metadata Redis durability",
      "role": "content",
      "text": "Metadata Redis is small compared with Store Redis, but it is operationally\ncritical. Use persistent storage, Redis authentication, network isolation, and\nTLS where required.\n\nIn FIPS-oriented deployments, Redis URLs covered by the posture must use\n`rediss://`. The Identity Service and Control Plane also need `https://`\nendpoints that your hosting environment provides. See\n[FIPS-oriented posture](https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/operations#fips-oriented-posture). Avoid eviction of metadata keys. Losing Metadata Redis removes Control\nPlane store records, and losing the Identity Service Metadata Redis removes agent-key records."
    },
    {
      "id": "network-access",
      "title": "Network access",
      "role": "content",
      "text": "- **Connected install:** the cluster must be able to pull images from\n  `docker.io` and reach the Redis AI Helm repository.\n- **Air-gapped install:** mirror the images into an internal registry and use a\n  chart package or locally downloaded chart.\n- **Runtime access:** Redis Agent Memory pods must reach the Redis databases and any\n  embedding or LLM provider endpoints used by the deployment.\n- **Identity Service:** the Data Plane must reach its runtime endpoint. Identity Service must\n  reach the Memory Control Plane's grant validator and its own Metadata Redis. Provide TLS\n  endpoints and trust for both service hops; see [Deploy](https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/deploy).\n- **Data Plane exposure:** use NetworkPolicy, ingress, gateway, service mesh,\n  private load balancer, or equivalent controls to restrict API access."
    },
    {
      "id": "credentials-and-secrets",
      "title": "Credentials and Secrets",
      "role": "content",
      "text": "When `config.render: true` is set, as in the walkthrough, the chart renders configuration from\nHelm values. This option defaults to `false`. Credentials stay in an overlay Secret. Create the following Secrets for the\n[two-release installation](https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/deploy#2-create-secrets):\n\n| Secret | Default key | Holds |\n| --- | --- | --- |\n| License Secret | `license` | The Redis Agent Memory license key. |\n| Overlay Secret | `overlay.yaml` | Redis URLs and provider credentials. |\n| Identity Service metadata Secret | `metadata.yaml` | The Identity Service's Metadata Redis URL. |\n\nAlso create `memory-dp-credential` and `memory-internal-token`, shared by both releases,\nand `ids-control-token`, read only by Identity Service. The walkthrough supplies a `ram-ca`\ncertificate bundle for service trust. Memory generates its Control Plane admin token unless\nyou provide one. See [Credentials](https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/authentication#credentials).\n\nTo supply a complete configuration file in your own Secret instead, see\n[Bring-your-own (BYO) configuration](https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/configuration#bring-your-own-byo-configuration)."
    },
    {
      "id": "release-artifacts-and-image-tags",
      "title": "Release artifacts and image tags",
      "role": "content",
      "text": "The published Memory chart `0.8.0` defaults `image.tag` and `controlplane.image.tag` to `0.8.0`.\nIdentity Service chart `0.10.0` defaults its image to its own application version, `0.10.0`.\nSet tags explicitly when pinning images or using a mirror. The releases have independent versions.\n\nBoth charts are published at `https://helm.redis.io/ai` as `redis-ai/redis-agent-memory`\nand `redis-ai/iris-identity-service`. Their standard images are\n`redislabs/agent-memory:0.8.0`, `redislabs/agent-memory-control-plane:0.8.0`, and\n`redislabs/iris-identity-service:0.10.0`."
    },
    {
      "id": "air-gapped-and-private-registry-installs",
      "title": "Air-gapped and private registry installs",
      "role": "content",
      "text": "Mirror these images into your internal registry:\n\n| Image | Needed |\n| --- | --- |\n| `redislabs/agent-memory:<ram-version>` | Always (Data Plane and workers) |\n| `redislabs/agent-memory-control-plane:<ram-version>` | Always |\n| `redislabs/iris-identity-service:<ids-version>` | On the separate Identity Service release, required for default agent-key authentication |\n| `replicated/troubleshoot:0.131.0` | Support-bundle health checks, on by default (`supportPackage.*`) |\n| `hibiken/asynqmon:0.7.2` | Optional, with `controlplane.queueMonitor` |\n| `python:3.13-alpine` | Optional, with `tests.smoke` |\n| `curlimages/curl:8.17.0` | Optional, for `helm test` on the Identity Service release (`tests.image` in `values-ids.yaml`) |\n\nFor this release, `<ram-version>` is `0.8.0` and `<ids-version>` is `0.10.0`.\nInspect each package with `helm show chart redis-ai/redis-agent-memory --version 0.8.0`\nand `helm show chart redis-ai/iris-identity-service --version 0.10.0`. Memory does not pin\nor install the Identity Service chart.\n\n[code example]\n\nIf the registry requires authentication, create an image pull Secret:\n\n[code example]\n\nAdd the registry settings to `ram-values.yaml`:\n\n[code example]\n\nConfigure the separate Identity Service release in `values-ids.yaml`:\n\n[code example]\n\nEach release reads its own `imagePullSecrets`, falling back to `global.imagePullSecrets`.\nValues passed to Memory do not configure Identity Service. Omit pull Secrets if the registry\ndoes not require authentication.\n\nFor air-gapped deployments, also set:\n\n[code example]\n\nMemory's `airgap.enabled: true` checks Memory's own image repositories. It does not validate\nthe separate Identity Service release. Mirror that release's image and chart dependencies\nseparately, and confirm that every configured repository is reachable from the cluster."
    },
    {
      "id": "system-requirements",
      "title": "System requirements",
      "role": "content",
      "text": "Default values for Memory and the separate Identity Service chart:\n\n| Component | Default | Purpose |\n| --------- | ------- | ------- |\n| Redis Agent Memory server | 2 replicas with autoscaling enabled and a minimum of 2 | Data Plane API traffic |\n| Redis Agent Memory worker | 2 replicas with autoscaling enabled and a minimum of 2 | Background promotion, summarization, and forgetting jobs |\n| Redis Agent Memory Control Plane | 1 replica | Admin API for stores |\n| Identity Service | 1 replica; requests `100m` CPU and `128Mi` memory, limits `500m` CPU and `512Mi` memory | Agent-key minting, rotation, revocation, and checks |\n\nDuring a rolling update, Kubernetes may temporarily run old and new pods at the\nsame time. A small two-node test cluster can run out of CPU during install or\nupgrade.\n\nFor realistic validation, use at least three nodes or enough CPU headroom for\nthe maximum rolling-update overlap.\n\nFor a constrained lab cluster, reduce replicas and autoscaling explicitly:\n\n[code example]\n\nDo not use reduced replica counts as the production HA recommendation."
    },
    {
      "id": "helm-values-to-review",
      "title": "Helm values to review",
      "role": "content",
      "text": "The walkthroughs use `redis-agent-memory` as the Helm release name. Resource names are fixed to\n`redis-agent-memory*` by `fullnameOverride`, whatever the release name, so install one release per\nnamespace.\n\n| Area | Values | Use when |\n| --- | --- | --- |\n| Image | `image.repository`, `image.tag`, `imagePullSecrets` | Selecting a release, private registry, or mirrored image. |\n| Air-gapped installs | `airgap.enabled` | Validating a disconnected or private-registry install. |\n| Chart-rendered configuration | `config.render`, `shared`, `memory`, `controlplane.configData` | Setting the Data Plane and Control Plane configuration from Helm values. |\n| Credentials overlay | `secrets.*` | Naming the overlay Secret and its key, or layering more overlay Secrets. |\n| API server capacity | `server.resources`, `server.autoscaling.*` | Tuning request capacity or memory footprint. |\n| Worker capacity | `worker.resources`, `worker.autoscaling.*` | Tuning background job throughput. |\n| Scheduling | `server.nodeSelector`, `worker.nodeSelector`, `server.affinity`, `worker.affinity`, `server.tolerations`, `worker.tolerations` | Controlling pod placement. |\n| Networking | `service.type`, `ingress.*` | Exposing Redis Agent Memory outside the cluster. |\n| Naming | `fullnameOverride` | Keeping resource names at `redis-agent-memory*`. |\n| Service account | `serviceAccount.*` | Matching customer namespace security policy. |\n| Worker authentication | `workerAuth.*`, `worker.serviceAccount.*`, `worker.serviceAccount.token.*` | Giving Redis Agent Memory workers a Kubernetes projected service-account token for authenticated Data Plane callbacks. |\n| Private certificate authority (CA) | `tls.caCertSecret` | Trusting a private CA for outbound connections, such as the cluster CA for [worker identity](https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/deploy#prepare-worker-identity-for-your-platform). |\n| Secret rollouts | `license.existingSecretChecksum`, `config.existingSecretChecksum`, `controlplane.config.existingSecretChecksum` | Rolling pods after externally managed Secret changes. |\n| Control Plane | `controlplane.image.*`, `controlplane.configData`, `controlplane.adminToken.*` | Mirroring the Control Plane image, setting its configuration, or bringing your own admin token. |\n| Control Plane internal token | `controlplane.internalToken.*` | Bringing your own token for Identity Service checks against the Control Plane. |\n| Identity Service connection | `dataplane.identityServiceBaseURL`, `identityService.credential.*`, `identityService.allowInsecureTransport` | Connecting to the separately installed runtime endpoint. The credential Secret is registered on that release. |\n| Identity Service configuration | Separate `values-ids.yaml`: `metadata`, `control`, `runtime`, `productValidation`, `subjectGrants` | Configuring the Identity Service release, not Memory. |\n| Shared fallbacks | `global.security.profile`, `global.imagePullSecrets`, `global.tls.caCertSecret` | Providing fallback values within each release. Pass shared values to both releases; local values take precedence. |\n| Security profile | `security.profile` or `global.security.profile` | Selecting the [FIPS-oriented posture](https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/operations#fips-oriented-posture); configure it separately on each release. |\n| Support bundles | `supportPackage.*` | Configuring support-bundle collection and its health checks. |\n| Preflight checks | `preflight.*` | Rendering the preflight checks spec as a ConfigMap. |\n| Helm tests | `tests.*` | Running [chart tests](https://redis.io/docs/latest/operate/iris/agent-memory/self-managed/operations#chart-tests) with `helm test`. |\n\nDo not use floating image tags in production."
    }
  ],
  "examples": [
    {
      "id": "air-gapped-and-private-registry-installs-ex0",
      "language": "bash",
      "code": "docker pull redislabs/agent-memory:<ram-version>\ndocker tag redislabs/agent-memory:<ram-version> \\\n  registry.example.com/redislabs/agent-memory:<ram-version>\ndocker push registry.example.com/redislabs/agent-memory:<ram-version>\n\ndocker pull redislabs/agent-memory-control-plane:<ram-version>\ndocker tag redislabs/agent-memory-control-plane:<ram-version> \\\n  registry.example.com/redislabs/agent-memory-control-plane:<ram-version>\ndocker push registry.example.com/redislabs/agent-memory-control-plane:<ram-version>\n\ndocker pull redislabs/iris-identity-service:<ids-version>\ndocker tag redislabs/iris-identity-service:<ids-version> \\\n  registry.example.com/redislabs/iris-identity-service:<ids-version>\ndocker push registry.example.com/redislabs/iris-identity-service:<ids-version>",
      "section_id": "air-gapped-and-private-registry-installs"
    },
    {
      "id": "air-gapped-and-private-registry-installs-ex1",
      "language": "bash",
      "code": "kubectl -n <namespace-name> create secret docker-registry ram-registry \\\n  --docker-server=registry.example.com \\\n  --docker-username=<username> \\\n  --docker-password=<password>",
      "section_id": "air-gapped-and-private-registry-installs"
    },
    {
      "id": "air-gapped-and-private-registry-installs-ex2",
      "language": "yaml",
      "code": "image:\n  repository: registry.example.com/redislabs/agent-memory\n\ncontrolplane:\n  image:\n    repository: registry.example.com/redislabs/agent-memory-control-plane\n\nglobal:\n  imagePullSecrets:\n    - name: ram-registry",
      "section_id": "air-gapped-and-private-registry-installs"
    },
    {
      "id": "air-gapped-and-private-registry-installs-ex3",
      "language": "yaml",
      "code": "image:\n  repository: registry.example.com/redislabs/iris-identity-service\n  tag: \"0.10.0\"\ntests:\n  image: registry.example.com/curlimages/curl:8.17.0\nglobal:\n  imagePullSecrets:\n    - name: ram-registry",
      "section_id": "air-gapped-and-private-registry-installs"
    },
    {
      "id": "air-gapped-and-private-registry-installs-ex4",
      "language": "yaml",
      "code": "airgap:\n  enabled: true",
      "section_id": "air-gapped-and-private-registry-installs"
    },
    {
      "id": "system-requirements-ex0",
      "language": "yaml",
      "code": "server:\n  replicaCount: 1\n  autoscaling:\n    enabled: false\n\nworker:\n  replicaCount: 1\n  autoscaling:\n    enabled: false",
      "section_id": "system-requirements"
    }
  ]
}