{
  "id": "operations",
  "title": "Operations",
  "url": "https://redis.io/docs/latest/develop/ai/context-engine/agent-memory/self-managed/operations/",
  "summary": "Operate Redis Agent Memory with backups, secret rotation, updates, FIPS posture, and network policy.",
  "tags": [
    "docs",
    "develop",
    "ai"
  ],
  "last_updated": "2026-07-28T14:23:48-07:00",
  "page_type": "content",
  "content_hash": "458d087c02a96d4dcdde4834fbd7e69020491cc04d2239a2973c92c0f614aedb",
  "sections": [
    {
      "id": "backups",
      "title": "Backups",
      "role": "overview",
      "text": "- Back up metadata Redis. Losing metadata removes Control Plane store records\n  and agent-key records.\n- Back up Store Redis according to the customer's memory-retention policy.\n- Back up Job Redis if background job replay or delayed-job preservation is\n  required by the deployment's recovery policy.\n- Back up any external secret manager material used to recreate Kubernetes\n  Secrets.\n- For Job Redis, use persistent storage where supported and a non-volatile /\n  `noeviction` policy. OOM can still lose jobs or leave worker state invalid;\n  capacity alerts and compatibility checks should make that caveat visible.\n- For Metadata Redis, use persistent storage and an eviction policy that does\n  not evict store or agent-key records under memory pressure."
    },
    {
      "id": "secret-rotation",
      "title": "Secret rotation",
      "role": "content",
      "text": "Rotate Agent Memory agent keys through the Control Plane API:\n\n[code example]\n\nThe response contains the new credential. Store it immediately; credentials are\nreturned only when a key is minted or rotated.\n\nRotate the Control Plane admin token by updating `ram-controlplane-admin-token`.\nThe Control Plane reads the token on use, so changing the token value does not\nrequire a Control Plane redeploy.\n\n[code example]\n\nRotate the Agent Memory license by updating the license Secret and changing\n`license.existingSecretChecksum` so Helm rolls the Data Plane and worker pods.\nAgent Memory reads and validates the license file during process startup; updating only\nthe Secret data is not sufficient.\n\n[code example]\n\nCalculate the new SHA-256 checksum. This value is used by Helm values to roll\npods after the license Secret changes; it is not used to validate Secret\nintegrity.\n\n**Linux:**\n\n[code example]\n\n**macOS:**\n\n[code example]\n\n\n\n[code example]\n\nApply the updated values and verify both workloads rolled:\n\n[code example]\n\nFor immutable license Secrets, create a new Secret name instead, then update\nboth `license.existingSecret` and `license.existingSecretChecksum`.\n\nRotate the shared Data Plane config by updating the config Secret and changing\n`config.existingSecretChecksum`. Rotate the Control Plane config by updating the\nconfig Secret and changing `controlplane.config.existingSecretChecksum`."
    },
    {
      "id": "updates",
      "title": "Updates",
      "role": "content",
      "text": "For every update:\n\n1. Update chart version and image tags.\n2. Recalculate Secret checksums for changed files.\n3. Run `helm upgrade`.\n4. Verify pod rollout and health endpoints.\n\nExample:\n\n[code example]\n\nOn small clusters, avoid `--atomic` unless the timeout and capacity are known to\nbe sufficient."
    },
    {
      "id": "chart-tests",
      "title": "Chart tests",
      "role": "content",
      "text": "The chart can render optional `helm test` resources when `tests.enabled=true`.\n\nEnable and run the basic chart test:\n\n[code example]\n\nTo run the API smoke test, also provide a configured store ID:\n\n[code example]\n\nUse the smoke test only for auth-disabled Data Plane deployments or for\nenvironments where the in-cluster test path is allowed."
    },
    {
      "id": "fips-oriented-posture",
      "title": "FIPS-oriented posture",
      "role": "content",
      "text": "The chart supports an opt-in FIPS-oriented posture for regulated environments:\n\n[code example]\n\nYou can also apply the bundled FIPS values overlay with the normal values file:\n\n[code example]\n\nWhen enabled, the chart sets `MEM_SECURITY_PROFILE=fips` on the Data Plane,\nworker, and Control Plane pods and enables FIPS-oriented runtime checks.\n\nThis is not a formal FIPS 140 compliance or validation claim. Treat it as a\ndeployment posture and guardrail that must still be reviewed against the\ncustomer's compliance boundary.\n\nWhen the posture is active, the Data Plane and worker reject config that:\n\n- enables `skip_verify` on outbound HTTP clients; or\n- uses non-`rediss://` URLs for Redis connections covered by the posture.\n\nThe Control Plane runs under the same posture and rejects non-`rediss://`\n`metadata.urls` or `store_db.urls`.\n\nThe Agent Memory API listener itself speaks HTTP inside the cluster. Edge TLS termination\nis owned by the hosting environment, such as ingress, service mesh, or external\nload balancer. Outbound TLS to Redis, embedding providers, LLM providers, and\nworker callback endpoints is configured through Agent Memory config and is covered by the\nposture checks.\n\nVerify the runtime posture with:\n\n[code example]\n\nUse the chart-generated Deployment to enable the FIPS-oriented posture. Do not\noverride the container command to configure it."
    },
    {
      "id": "network-policy",
      "title": "Network policy",
      "role": "content",
      "text": "For auth-disabled Data Plane deployments, restrict access to trusted callers.\nFor agent-key deployments behind a gateway, prevent direct bypass paths unless\nthe direct caller also has a valid Agent Memory credential.\n\nThe chart includes `deployment/redis-agent-memory/networkpolicy.reference.yaml`\nas a reference manifest. It is not templated because allowed callers are\nenvironment-specific.\n\nCustomize the placeholders before applying it:\n\n- `<namespace>`: namespace where Agent Memory is installed.\n- `redis-agent-memory`: Helm release name used in this guide. If you use a\n  different release name, update release-derived service and deployment names.\n  `nameOverride` and `fullnameOverride` change rendered resource names, but the\n  `app.kubernetes.io/instance` selector remains the Helm release name.\n- `<caller-namespace>` and caller pod labels: ingress controller, service mesh\n  gateway, application pod, or approved internal caller allowed to call Agent Memory.\n\nThe reference policy default-denies ingress to Agent Memory chart pods, then allows TCP\ntraffic to server pods on port `9000` from approved callers and the worker\nDeployment. It also includes a Control Plane stanza for port `9100` when\n`controlplane.enabled=true`. Review the manifest against the customer's CNI,\ningress path, and service mesh behavior before production use."
    }
  ],
  "examples": [
    {
      "id": "secret-rotation-ex0",
      "language": "bash",
      "code": "curl -sS -X POST \"$CP_URL/v1/api-keys/<key-id>/rotate\" \\\n  -H \"Authorization: Bearer $RAM_ADMIN_TOKEN\"",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex1",
      "language": "bash",
      "code": "kubectl -n <namespace-name> create secret generic ram-controlplane-admin-token \\\n  --from-literal=token='<new-admin-token>' \\\n  --dry-run=client \\\n  -o yaml | kubectl apply -f -",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex2",
      "language": "bash",
      "code": "kubectl -n <namespace-name> create secret generic ram-license \\\n  --from-file=license=./license \\\n  --dry-run=client \\\n  -o yaml | kubectl apply -f -",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex3",
      "language": "bash",
      "code": "LICENSE_CHECKSUM=\"$(sha256sum ./license | awk '{print $1}')\"",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex4",
      "language": "bash",
      "code": "LICENSE_CHECKSUM=\"$(shasum -a 256 ./license | awk '{print $1}')\"",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex5",
      "language": "yaml",
      "code": "license:\n  existingSecret: ram-license\n  existingSecretChecksum: \"<new-license-checksum>\"",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex6",
      "language": "bash",
      "code": "helm upgrade redis-agent-memory redis-ai/redis-agent-memory \\\n  --version <chart-version> \\\n  --namespace <namespace-name> \\\n  -f ram-values.yaml\n\nkubectl -n <namespace-name> rollout status deploy/redis-agent-memory\nkubectl -n <namespace-name> rollout status deploy/redis-agent-memory-worker",
      "section_id": "secret-rotation"
    },
    {
      "id": "updates-ex0",
      "language": "bash",
      "code": "helm upgrade redis-agent-memory redis-ai/redis-agent-memory \\\n  --version <chart-version> \\\n  --namespace <namespace-name> \\\n  -f ram-values.yaml",
      "section_id": "updates"
    },
    {
      "id": "chart-tests-ex0",
      "language": "bash",
      "code": "helm upgrade --install redis-agent-memory redis-ai/redis-agent-memory \\\n  --version <chart-version> \\\n  --namespace <namespace-name> \\\n  -f ram-values.yaml \\\n  --set tests.enabled=true\n\nhelm test redis-agent-memory --namespace <namespace-name>",
      "section_id": "chart-tests"
    },
    {
      "id": "chart-tests-ex1",
      "language": "bash",
      "code": "helm upgrade --install redis-agent-memory redis-ai/redis-agent-memory \\\n  --version <chart-version> \\\n  --namespace <namespace-name> \\\n  -f ram-values.yaml \\\n  --set tests.enabled=true \\\n  --set tests.smoke.enabled=true \\\n  --set tests.smoke.storeId=<store-id>\n\nhelm test redis-agent-memory --namespace <namespace-name> --logs",
      "section_id": "chart-tests"
    },
    {
      "id": "fips-oriented-posture-ex0",
      "language": "yaml",
      "code": "security:\n  profile: fips",
      "section_id": "fips-oriented-posture"
    },
    {
      "id": "fips-oriented-posture-ex1",
      "language": "bash",
      "code": "helm upgrade --install redis-agent-memory redis-ai/redis-agent-memory \\\n  --version <chart-version> \\\n  --namespace <namespace-name> \\\n  -f ram-values.yaml \\\n  -f deployment/redis-agent-memory/values-fips.yaml",
      "section_id": "fips-oriented-posture"
    },
    {
      "id": "fips-oriented-posture-ex2",
      "language": "bash",
      "code": "kubectl -n <namespace-name> get deploy redis-agent-memory \\\n  -o jsonpath='{.spec.template.spec.containers[0].env[?(@.name==\"MEM_SECURITY_PROFILE\")].value}'\n\nkubectl -n <namespace-name> logs deploy/redis-agent-memory | grep -i 'FIPS security profile'",
      "section_id": "fips-oriented-posture"
    }
  ]
}