# Deploy Redis Agent Playbooks ```json metadata { "schema_version": 2, "title": "Deploy Redis Agent Playbooks", "description": "Install the Identity Service and Redis Agent Playbooks, then create a playbook, mint an agent key, and make one authenticated call.", "categories": ["docs","operate","iris"], "tableOfContents": {"sections":[{"id":"1-create-the-namespace","title":"1. Create the namespace"},{"id":"2-create-secrets","title":"2. Create Secrets"},{"id":"3-install-identity-service-first","title":"3. Install Identity Service first"},{"id":"4-create-playbook-valuesyaml","title":"4. Create playbook-values.yaml"},{"id":"before-you-install-check-your-values","title":"Before you install: check your values"},{"id":"5-install","title":"5. Install"},{"id":"6-verify-pods-and-health","title":"6. Verify pods and health"},{"id":"7-create-a-playbook","title":"7. Create a playbook"},{"id":"8-mint-an-agent-key","title":"8. Mint an agent key"},{"id":"9-make-one-authenticated-call","title":"9. Make one authenticated call"},{"id":"install-with-the-redis-iris-suite-chart","title":"Install with the Redis Iris suite chart"},{"id":"next-steps","title":"Next steps"}]} , "codeExamples": [] } ``` > [!NOTE] > For a supported install, see [Install with the Redis Iris suite chart](#install-with-the-redis-iris-suite-chart). The standalone steps on this page show what each value does. Follow these steps to install the Agent Playbooks control plane and data plane with the `redis-agent-playbook` Helm chart, connect them to an Identity Service release, and end with one authenticated call to the data plane. Install Identity Service as release `ids`, then Agent Playbooks as release `playbook`, in one namespace. These steps use Agent Playbooks chart `1.0.0` and Identity Service chart `1.0.0`. You create the two credentials both releases share and the Identity Service control token; Agent Playbooks generates its admin token. See [Credentials](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/authentication#credentials). Before installing, provide two Transport Layer Security (TLS) endpoints through your hosting environment: one forwarding to `ids-iris-identity-service:9200`, and one forwarding to `playbook-controlplane:9200`. Neither chart terminates TLS. Obtain their certificate authority (CA) certificates as a PEM bundle named `ca.crt`. For a network-isolated lab without TLS, see [Isolated lab without TLS](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/configuration#isolated-lab-without-tls). If an Identity Service release already serves Redis Agent Memory in this namespace, use it: add the Agent Playbooks entries from [step 3](#3-install-identity-service-first) to its values and upgrade it instead of installing a second release. Both products must use the same tenant. Before you begin, review the [prerequisites](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/prerequisites). ## 1. Create the namespace ```bash kubectl create namespace ``` ## 2. Create Secrets Prepare `playbook-storage.yaml`, `ids-metadata.yaml`, and `inference.yaml` as shown in [Configuration](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/configuration), and save your license as `license`. Then create the Secrets: ```bash kubectl -n create secret generic playbook-storage \ --from-file=playbook-storage.yaml=./playbook-storage.yaml kubectl -n create secret generic playbook-license \ --from-file=license=./license kubectl -n create secret generic playbook-inference \ --from-file=inference.yaml=./inference.yaml kubectl -n create secret generic ids-metadata \ --from-file=metadata.yaml=./ids-metadata.yaml kubectl -n create secret generic playbook-dp-credential \ --from-literal=token="$(openssl rand -hex 32)" kubectl -n create secret generic playbook-controlplane-internal \ --from-literal=token="$(openssl rand -hex 32)" kubectl -n create secret generic ids-control-token \ --from-literal=token="$(openssl rand -hex 32)" kubectl -n create secret generic playbook-ca \ --from-file=ca.crt=./ca.crt ``` Both releases mount `playbook-dp-credential` and `playbook-controlplane-internal`. You own these Secrets; neither release generates them in this procedure. The runtime credential lets the data plane check agent keys. The internal token lets the Identity Service validate grants against the control plane. The `ids-control-token` Secret is used only by the Identity Service. ## 3. Install Identity Service first For every Identity Service setting, and for running one release that serves several products, see the [Identity Service guide](https://redis.io/docs/latest/operate/iris/identity-service). Save this as `values-ids.yaml`: ```yaml metadata: existingSecret: ids-metadata control: existingSecret: ids-control-token autoGenerate: false runtime: apiKeyTenant: singleTenantID: default serviceCredentials: - name: playbook-dp subject: playbook-dp allowedOperations: [api-key-introspect] allowedProducts: [playbook] existingSecret: playbook-dp-credential secretKey: token productValidation: products: playbook: baseURL: https:// credential: existingSecret: playbook-controlplane-internal secretKey: token tls: caCertSecret: playbook-ca ``` If the release also serves Agent Memory, keep its `memory-dp` credential, `memory` validator, and `runtime.unscopedGrantsProduct: memory`, and add these `playbook-dp` and `playbook` entries next to them. ```bash helm repo add redis-ai https://helm.redis.io/ai helm repo update redis-ai helm install ids redis-ai/iris-identity-service \ --version 1.0.0 \ --namespace \ -f values-ids.yaml ``` The Agent Playbooks control plane doesn't exist yet. Configure its endpoint now, but wait until both releases and the TLS routes are ready before you mint keys: the Identity Service calls the control plane to validate each playbook grant. ## 4. Create `playbook-values.yaml` Write the values file from [Helm values](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/configuration#helm-values), with your embedding model and the Identity Service TLS endpoint. ## Before you install: check your values Check each value before you install. If one is wrong, you see the symptom in its row. | Check | Symptom | Fix | | --- | --- | --- | | `controlplane.image.tag` and `dataplane.image.tag` are set | Rendering fails with a named message, or pods `ImagePullBackOff` | Set both tags. | | `dataplane.identityServiceBaseURL` is `https://`, or `identityService.allowInsecureTransport` is `true` | Rendering fails | Use the TLS endpoint, or the [lab option](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/configuration#isolated-lab-without-tls). | | The admin token, internal token, and runtime credential reference three different Secret keys | Rendering fails | Use distinct Secrets. | | `inference.models` lists at least one model | Rendering fails | List each model the deployment offers. | | Each model's `provider` names an `embedders_connection_details` entry in `inference.yaml` | Creating a playbook fails, or it doesn't become `READY` | Add the entry under that provider name. | | `tenantId` equals the Identity Service's `runtime.apiKeyTenant.singleTenantID` | Minting a key fails, or agent keys get `403` | Set both to the same tenant. | | The content Redis has JSON and Search | The data plane isn't ready, or a playbook is `FAILED` | Use a Redis 8 build that includes JSON and Search. | ## 5. Install ```bash helm install playbook redis-ai/redis-agent-playbook \ --version 1.0.0 \ --namespace \ -f playbook-values.yaml \ --wait --timeout 10m ``` ## 6. Verify pods and health ```bash kubectl -n rollout status deployment/playbook-controlplane kubectl -n rollout status deployment/playbook-dataplane kubectl -n get pods -l app.kubernetes.io/instance=ids helm test playbook --namespace --logs ``` `helm test` checks readiness on both planes and the configured security profile. It doesn't check that the two releases are consistent with each other; the remaining steps do. Run each port-forward in its own terminal and leave it running: ```bash kubectl -n port-forward svc/playbook-controlplane 9200:9200 ``` ```bash kubectl -n port-forward svc/playbook-dataplane 9201:9201 ``` ```bash kubectl -n port-forward svc/ids-iris-identity-service 9202:9200 ``` Then check readiness on every service: ```bash curl -sS http://localhost:9200/health/readiness curl -sS http://localhost:9201/health/readiness curl -sS http://localhost:9202/health/readiness ``` Rerun a port-forward after its pod is replaced. ## 7. Create a playbook [Load the administrative credentials](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/authentication#load-the-administrative-credentials), then follow [Create a playbook](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/api-examples#create-a-playbook). Continue when its state is `READY`. ## 8. Mint an agent key Mint a key with a grant on the playbook through the Identity Service. See [Create agent keys](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/api-examples#create-agent-keys). ## 9. Make one authenticated call Check the playbook with the key against the data plane: ```bash curl --fail-with-body -sS \ "$IRIS_AGENT_PLAYBOOKS_URL/iris/data/v1/agent-playbooks/playbooks/$IRIS_AGENT_PLAYBOOKS_PLAYBOOK_ID/health" \ -H "Authorization: Bearer $IRIS_AGENT_PLAYBOOKS_API_KEY" ``` The response reports `READY` for the playbook and for its metadata Redis, content Redis, embedding provider, and license. A `401` means the key is wrong, expired, or revoked. A `403` means it has no grant on the playbook. ## Install with the Redis Iris suite chart The `redis-iris` Helm chart installs Agent Playbooks with the Identity Service and the user interface (UI) in one release. Agent Playbooks is on by default (`global.iris.products.playbook.enabled: true`); set `global.iris.products..enabled: false` for each other product you don't install. Agent Playbooks values go under the `playbook:` key. The suite sets these Agent Playbooks values itself. Don't set them under `playbook:`: a value that differs fails the render and names the field. - `tenantId`, from `global.iris.tenantId`. - `license.existingSecret` and `license.secretKey`, from `global.iris.license`. - `dataplane.identityServiceBaseURL` and `identityService.allowInsecureTransport`, for the suite's own Identity Service. - `identityService.credential` and `controlplane.internalToken`, from the credentials the suite generates or that you supply in `global.iris.secrets`. The admin token is in the Secret `iris-playbook-admin-token`. - `auth.oidc.audience`, `dataplane.oidc`, and `controlplane.oidc.enabled`, from `global.iris.auth.oidc` and `global.iris.auth.roleBindings`. - The extraction connection and worker settings, from `global.iris.extraction.enabled`. See [Configure background FAQ extraction](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/extraction#extraction-with-the-redis-iris-suite-chart). - `fullnameOverride` (`redis-agent-playbook`), the Service ports, `dataplane.strategy`, and `podDisruptionBudget.enabled`, which the suite fixes. The suite runs two data-plane replicas by default. You still set `playbook.storage.existingSecret`, `playbook.inference.models`, and `playbook.inference.existingSecret` (unless every model is `noop`). Then install: ```bash helm install iris redis-ai/redis-iris \ --version 1.0.0 \ --namespace \ -f iris-values.yaml ``` The rest of this guide applies to the values under `playbook:`. ## Next steps - [Publish and retrieve your first FAQ](https://redis.io/docs/latest/develop/ai/context-engine/agent-playbooks/quickstart). - [Operate the deployment](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/operations).