{
  "schema_version": 2,
  "id": "operate/iris/agent-playbook/self-managed/prerequisites",
  "title": "Self-managed Agent Playbooks prerequisites",
  "url": "https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/prerequisites/",
  "summary": "Review software, Identity Service, Redis, embedding, network, Secret, and image prerequisites for self-managed Agent Playbooks.",
  "tags": [
    "docs",
    "operate",
    "iris"
  ],
  "last_updated": "2026-11-04T01:09:56+02:00",
  "page_type": "content",
  "content_hash": "732dab7b15b63a45cc4e67e11360e92f0fb161d01829ea1dbf12b0fd8e34a160",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "Redis Agent Playbooks is distributed as container images on Docker Hub plus the `redis-agent-playbook` Helm chart in the Redis AI Helm repository. The chart deploys the control plane, the data plane, and the optional extraction worker. Install the `iris-identity-service` chart as its own release before you install Agent Playbooks.\n\nYou provide the Identity Service release, the Redis databases, the embedding provider, Kubernetes exposure, and the license.\n\n> [!NOTE]\n> This guide is for system administrators deploying Redis Agent Playbooks on a self-managed\n> Kubernetes cluster."
    },
    {
      "id": "what-you-need",
      "title": "What you need",
      "role": "content",
      "text": "| Requirement | Purpose |\n| --- | --- |\n| Kubernetes 1.28 or later and `kubectl` | Run the services and create Secrets in the deployment namespace. |\n| [Helm 3](https://helm.sh/docs/intro/install/), version 3.10 or later | Install `redis-ai/redis-agent-playbook` and `redis-ai/iris-identity-service` from `https://helm.redis.io/ai`. Helm 4 isn't supported. |\n| Bash, curl, jq, and OpenSSL | Generate tokens and run the administrative API examples. Use a curl version that supports `--fail-with-body`. |\n| License key | Contact your Redis representative or [contact sales](https://redis.io/contact/). An Agent Playbooks license or an Iris suite license that includes Agent Playbooks. |\n| Embedding provider | A provider and model the data plane can reach, with its credentials. |\n| Identity Service | An `iris-identity-service` release, chart `1.0.0`, with the Agent Playbooks entries registered. See [Deploy](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/deploy#3-install-identity-service-first). |"
    },
    {
      "id": "deployment-decisions",
      "title": "Deployment decisions",
      "role": "content",
      "text": "Choose these settings before you create playbooks:\n\n| Decision | What to plan |\n| --- | --- |\n| Tenant | Choose one `tenantId` for the deployment. The Identity Service release's `runtime.apiKeyTenant.singleTenantID` must match it, and agent-key grants name it. |\n| Storage | Provision separate metadata and content Redis deployments. |\n| Embeddings | List each provider, model, and dimension identity the deployment offers. Each playbook selects one when you create it. |\n| API exposure | Keep the control plane and Identity Service private. Expose the data plane to approved applications through your platform's ingress. |\n| Credentials | Provision the two credentials the Identity Service release shares with Agent Playbooks. Let the chart generate the admin token, or supply it. Give applications separate scoped agent keys. |\n| Operator identity | Use the admin token, OpenID Connect (OIDC) access tokens from your identity provider, or both. |\n| Extraction | To propose FAQs from Redis Agent Memory sessions, plan a durable queue Redis, a generation model, workload identity, and network paths between both products. See [Configure background FAQ extraction](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/extraction). |"
    },
    {
      "id": "choose-embedding-models",
      "title": "Choose embedding models",
      "role": "content",
      "text": "A playbook's embedding identity (`provider`, `model`, and `dimensions`) can't change after you create it. To change its model or dimensions, create a new playbook and migrate the content. You can offer several identities in one deployment. There is no default; every playbook names one.\n\nSet up the models in [Embedding configuration](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/configuration#embedding-configuration)."
    },
    {
      "id": "plan-api-exposure",
      "title": "Plan API exposure",
      "role": "content",
      "text": "The chart creates `ClusterIP` Services. Your platform owns ingress, network policy, and Transport Layer Security (TLS) termination. Neither the Agent Playbooks chart nor the Identity Service chart terminates TLS.\n\nThe data-plane Service on port `9201` serves both REST and MCP. To expose MCP, route `/iris/data/v1/agent-playbooks/playbooks/{playbookId}/mcp` to the data-plane Service and keep the complete path, the `Authorization` header, the request body, and the MCP and `Accept` headers. MCP messages use `POST`. The transport is stateless, so an authenticated `GET` or `DELETE` returns `405`.\n\nExposing a whole Identity Service also exposes its administration routes. Expose only the routes your applications need."
    },
    {
      "id": "plan-capacity-and-recovery",
      "title": "Plan capacity and recovery",
      "role": "content",
      "text": "The chart starts one replica of each service and leaves `resources` unset for the control plane and data plane. These defaults are not a production sizing recommendation. Set resource requests and limits, and leave capacity for old and new pods during upgrades. To keep a service available during node drains, run two or more replicas and set `podDisruptionBudget.enabled: true`, which adds a PodDisruptionBudget with `maxUnavailable: 1` for each Deployment that has more than one replica.\n\nPlan coordinated storage backups in [Operations](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/operations#back-up-the-deployment)."
    },
    {
      "id": "redis-databases",
      "title": "Redis databases",
      "role": "content",
      "text": "The chart uses existing Redis deployments. It does not provision them.\n\n| Redis deployment | Requirements | Use |\n| --- | --- | --- |\n| Metadata | Core Redis commands and Lua scripting. Also JSON when extraction is enabled. | Playbook configuration and extraction bindings. |\n| Content | JSON and Search, including vector indexes. | Entries, proposals, and retrieval. |\n| Identity Service metadata | Core Redis commands. Configured on the Identity Service release. | Agent-key records. |\n| Extraction queue | Persistence and a `noeviction` policy. Only with extraction. | Extraction jobs. |\n\nUse physically separate deployments for metadata and content. The services reject aliased endpoints, so different database numbers or credentials on the same Redis endpoint don't satisfy this requirement. A Redis 8 build that includes JSON and Search, such as the official `redis:8` image, meets both requirements.\n\nThe Identity Service can use the metadata deployment with its own, least-privileged Redis user. Use authenticated, certificate-verified `rediss://` connections for production, and trust the issuing certificate authority (CA)."
    },
    {
      "id": "images-and-network-access",
      "title": "Images and network access",
      "role": "content",
      "text": "The chart requires an explicit image tag for each plane.\n\n| Component | Image |\n| --- | --- |\n| Control plane | `redislabs/iris-agent-playbook-control:1.0.0` |\n| Data plane and extraction worker | `redislabs/iris-agent-playbook-data:1.0.0` |\n| Identity Service | The image that its own chart pins. |\n\nAllow chart downloads, image pulls, Redis connections, and data-plane access to the embedding provider. The data plane and control plane must reach the Identity Service, and the Identity Service must reach the control plane on port `9200`. For a disconnected installation, mirror the images, use a downloaded chart package, and set the image repositories and `imagePullSecrets` in your Helm values."
    },
    {
      "id": "secrets",
      "title": "Secrets",
      "role": "content",
      "text": "Prepare the files and Secrets described in [Configuration](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/configuration). Storage URLs, provider credentials, and license material belong in Secrets, not in Helm values or source control.\n\nFor the credentials each release needs, see [Credentials](https://redis.io/docs/latest/operate/iris/agent-playbook/self-managed/authentication#credentials)."
    }
  ],
  "examples": []
}