Self-managed Redis Context Gateway
Deploy, configure, and operate Redis Context Gateway on a self-managed Kubernetes cluster.
Install Context Gateway with the redis-iris suite chart, the supported self-managed install. Installing the redis-context-gateway chart on its own isn't a supported install path. These guides document its values, which you set under the suite chart's contextGateway: key.
The redis-context-gateway Helm chart deploys one tenant's Context Gateway Control Plane and Data Plane. You provide the Identity Service release, the Redis databases, and the license. The chart does not install Identity Service, Redis, Vault, or Secrets Store CSI (Container Storage Interface) Driver resources.
Agents call the Data Plane's Model Context Protocol (MCP) endpoint, described in the MCP API Reference. The Control Plane API Reference documents the self-managed administration endpoints for Gateways and Upstreams.
These guides use redis-context-gateway chart 1.0.0. Each chart release pins its matching Control Plane and Data Plane images by default.
What you deploy
| Component | Purpose | Service port |
|---|---|---|
| Control Plane | Create Gateways, register Upstreams, write credentials, and validate agent-key grants. | 9100 |
| Data Plane | Serve each Gateway's MCP endpoint and call its Upstreams. | 8083 |
| Identity Service | Issue agent keys and check them for the Data Plane. Installed as its own release. | 9200 |
| Metadata Redis | Store Gateway and Upstream records. | Customer-provided |
| Credential storage | Store Upstream credentials: encrypted Redis by default, or Vault or AWS Secrets Manager. | Customer-provided |
| Registered databases | Context Surface data, and the Gateway database for cached results and handles. | Customer-provided |
Use separately managed Redis deployments for metadata, credentials, and customer data. Use a separate Redis access control list (ACL) user for credentials.
How the components work together
| Flow | Caller | Service | Backing store |
|---|---|---|---|
| Gateway administration | Platform admin | Control Plane | Metadata Redis and credential storage |
| Agent-key administration | Platform admin | Identity Service | Identity Service metadata Redis |
| Grant validation | Identity Service | Control Plane | Metadata Redis |
| Tool listing and calls | Agent | Data Plane | Metadata Redis, credential storage, and Upstreams |
- Platform admins create Gateways and register Upstreams through the Control Plane, then mint agent keys through the Identity Service.
- The Identity Service asks the Control Plane to confirm that a Gateway exists before it mints a key for it.
- Agents call a Gateway's MCP endpoint on the Data Plane with an agent key or an identity provider token.
- The Data Plane checks the key with the Identity Service, reads the Gateway's records, and calls the Upstream with the Upstream's credential.
API surfaces
| API surface | Endpoint | Purpose |
|---|---|---|
| Gateway MCP | /iris/data/v1/context-gateway/gateways/{gatewayId}/mcp |
The Streamable HTTP MCP endpoint for one Gateway. |
| Protected resource metadata | /.well-known/oauth-protected-resource/iris/data/v1/context-gateway/gateways/{gatewayId}/mcp |
Names the identity provider for MCP client sign-in. |
| Control Plane | /iris/v1/context-gateway/gateways |
Administration of Gateways and Upstreams. |
| Health | /health/liveness, /health/readiness |
Liveness and readiness on both planes. |
| Identity Service | /v1/api-keys |
Administration of agent keys. |
Get started
- Review the prerequisites.
- Prepare the configuration.
- Deploy the chart.
- Load administrative credentials.
- Create a Gateway and an agent key.