Self-managed Redis Agent Memory prerequisites

Review software, Redis, network, Secret, image, and sizing prerequisites for self-managed Redis Agent Memory.

Redis Agent Memory is distributed as container images on Docker Hub plus a Helm chart in the Redis AI Helm repository. The chart deploys the Redis Agent Memory Data Plane, Redis Agent Memory workers, the Redis Agent Memory Control Plane, and the Identity Service.

You provide the Redis databases, provider credentials, Kubernetes exposure, and license material used by the deployment.

What you need

Required software

Redis databases

The Helm chart does not deploy Redis databases. Provision the Redis databases outside the Redis Agent Memory chart and pass their URLs in the overlay Secret. The Data Plane and the Control Plane both read the overlay, so they use the same Metadata Redis and Store Redis.

Store Redis must support Search and JSON capabilities because Redis Agent Memory creates JSON and vector search indexes for memory data. Job Redis and Metadata Redis do not need those capabilities when they are deployed as separate Redis databases.

The Identity Service reads its Metadata Redis from metadata.urls in its own metadata Secret and keeps agent-key records there. The Data Plane checks agent keys by calling the Identity Service.

For a lab deployment, the Redis roles can point to the same Redis endpoint if it has the required modules and capacity. For production, separate Store Redis, Job Redis, and Metadata Redis when possible so memory data, background work, and control metadata can be scaled, backed up, and operated independently.

For Job Redis, use a non-evicting policy such as noeviction or volatile-ttl.

Metadata Redis durability

Metadata Redis is small compared with Store Redis, but it is operationally critical. Use persistent storage, Redis authentication, network isolation, and TLS where required.

In FIPS-oriented deployments, Redis URLs covered by the posture must use rediss://. Avoid eviction of metadata keys. Losing Metadata Redis removes Control Plane store records, and losing the Identity Service Metadata Redis removes agent-key records.

Network access

• Connected install: the cluster must be able to pull images from docker.io and reach the Redis AI Helm repository.
• Air-gapped install: mirror the images into an internal registry and use a chart package or locally downloaded chart.
• Runtime access: Redis Agent Memory pods must reach the Redis databases and any embedding or LLM provider endpoints used by the deployment.
• Data Plane exposure: use NetworkPolicy, ingress, gateway, service mesh, private load balancer, or equivalent controls to restrict API access.

Credentials and Secrets

The chart renders the configuration from Helm values (config.render: true). Credentials stay out of the values: you put them in an overlay Secret. You create three Secrets:

The chart generates four more Secrets for the tokens and service credentials listed in Credentials.

To supply a complete configuration file in your own Secret instead, see Bring-your-own (BYO) configuration.

Release artifacts and image tags

Chart 0.7.0 defaults every image tag to 0.7.0. Set an image tag only to pin a mirrored image.

Use the chart version supplied by Redis for the release. The published chart is redis-ai/redis-agent-memory from https://helm.redis.io/ai.

Standard customer installs use the public Docker Hub images published by the Redis Agent Memory self-managed release: docker.io/redislabs/agent-memory:0.7.0, docker.io/redislabs/agent-memory-control-plane:0.7.0, and docker.io/redislabs/iris-identity-service:0.7.0.

Air-gapped and private registry installs

Mirror these images into your internal registry:

docker pull redislabs/agent-memory:0.7.0
docker tag redislabs/agent-memory:0.7.0 \
  registry.example.com/redislabs/agent-memory:0.7.0
docker push registry.example.com/redislabs/agent-memory:0.7.0

docker pull redislabs/agent-memory-control-plane:0.7.0
docker tag redislabs/agent-memory-control-plane:0.7.0 \
  registry.example.com/redislabs/agent-memory-control-plane:0.7.0
docker push registry.example.com/redislabs/agent-memory-control-plane:0.7.0

docker pull redislabs/iris-identity-service:0.7.0
docker tag redislabs/iris-identity-service:0.7.0 \
  registry.example.com/redislabs/iris-identity-service:0.7.0
docker push registry.example.com/redislabs/iris-identity-service:0.7.0

If the registry requires authentication, create an image pull Secret:

kubectl -n <namespace-name> create secret docker-registry ram-registry \
  --docker-server=registry.example.com \
  --docker-username=<username> \
  --docker-password=<password>

Add the registry settings to ram-values.yaml:

image:
  repository: registry.example.com/redislabs/agent-memory

controlplane:
  image:
    repository: registry.example.com/redislabs/agent-memory-control-plane

identityService:
  image:
    repository: registry.example.com/redislabs/iris-identity-service

imagePullSecrets:
  - name: ram-registry

Omit imagePullSecrets if the internal registry does not require authentication.

For air-gapped deployments, also set:

airgap:
  enabled: true

With airgap.enabled: true, the chart fails if a repository still points at Docker Hub. For the Identity Service, the error is:

airgap.enabled=true requires identityService.image.repository to point to a mirrored registry reachable from the cluster

System requirements

Default chart values:

During a rolling update, Kubernetes may temporarily run old and new pods at the same time. A small two-node test cluster can run out of CPU during install or upgrade.

For realistic validation, use at least three nodes or enough CPU headroom for the maximum rolling-update overlap.

For a constrained lab cluster, reduce replicas and autoscaling explicitly:

server:
  replicaCount: 1
  autoscaling:
    enabled: false

worker:
  replicaCount: 1
  autoscaling:
    enabled: false

Do not use reduced replica counts as the production HA recommendation.

Helm values to review

The walkthroughs use redis-agent-memory as the Helm release name. Resource names are fixed to redis-agent-memory* by fullnameOverride, whatever the release name, so install one release per namespace.

Do not use floating image tags in production.