{
  "schema_version": 2,
  "id": "operate/iris/context-gateway/self-managed",
  "title": "Self-managed Redis Context Gateway",
  "url": "https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/",
  "summary": "Deploy, configure, and operate Redis Context Gateway on a self-managed Kubernetes cluster.",
  "aliases": [
    "/operate/iris/context-retriever/self-managed/"
  ],
  "tags": [
    "docs",
    "operate",
    "iris"
  ],
  "last_updated": "2026-11-03T16:45:14-08:00",
  "children": [
    {
      "id": "operate/iris/context-gateway/self-managed/prerequisites",
      "summary": "Review software, Identity Service, Redis, credential storage, network, Secret, and image prerequisites for self-managed Context Gateway.",
      "title": "Self-managed Context Gateway prerequisites",
      "url": "https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/prerequisites/"
    },
    {
      "id": "operate/iris/context-gateway/self-managed/configuration",
      "summary": "Prepare Helm values, file references, credential storage, the database registry, Context Surface databases, and optional features for Context Gateway.",
      "title": "Configure self-managed Context Gateway",
      "url": "https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/configuration/"
    },
    {
      "id": "operate/iris/context-gateway/self-managed/deploy",
      "summary": "Install Redis Context Gateway with an external Identity Service, then create a Gateway, mint an agent key, and make one authenticated call.",
      "title": "Deploy Redis Context Gateway",
      "url": "https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/deploy/"
    },
    {
      "id": "operate/iris/context-gateway/self-managed/authentication",
      "summary": "Configure Context Gateway Control Plane credentials, agent-key grants, and identity provider sign-in for agents.",
      "title": "Authentication and authorization",
      "url": "https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/authentication/"
    },
    {
      "id": "operate/iris/context-gateway/self-managed/api-examples",
      "summary": "Create the Gateways and the sample Upstream, mint an agent key, verify agent access, and rotate or revoke keys.",
      "title": "Self-managed Context Gateway API examples",
      "url": "https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/api-examples/"
    },
    {
      "id": "operate/iris/context-gateway/self-managed/control-plane-api-reference",
      "summary": "",
      "title": "Control Plane API Reference",
      "url": "https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/control-plane-api-reference/"
    },
    {
      "id": "operate/iris/context-gateway/self-managed/operations",
      "summary": "Check health, rotate credentials and encryption keys, monitor the cache and the Gateway database, back up, upgrade, and uninstall Context Gateway.",
      "title": "Operate self-managed Context Gateway",
      "url": "https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/operations/"
    },
    {
      "id": "operate/iris/context-gateway/self-managed/reference",
      "summary": "Review self-managed Context Gateway configuration files, troubleshooting guidance, and reference links.",
      "title": "Configuration and troubleshooting",
      "url": "https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/reference/"
    }
  ],
  "page_type": "content",
  "content_hash": "0817ce669ce907757e1db9afca4d93c215c8fb2eb1592669b01bf6c0d7523996",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "> [!NOTE]\n> Install Context Gateway with the [`redis-iris` suite chart](https://redis.io/docs/latest/operate/iris/self-managed), the supported self-managed install. Installing the `redis-context-gateway` chart on its own isn't a supported install path. These guides document its values, which you set under the suite chart's `contextGateway:` key.\n\nThe `redis-context-gateway` Helm chart deploys one tenant's Context Gateway Control Plane and Data Plane. You provide the Identity Service release, the Redis databases, and the license. The chart does not install Identity Service, Redis, Vault, or Secrets Store CSI (Container Storage Interface) Driver resources.\n\nAgents call the Data Plane's Model Context Protocol (MCP) endpoint, described in the [MCP API Reference](https://redis.io/docs/latest/develop/ai/context-engine/context-gateway/api-reference). The [Control Plane API Reference](https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/control-plane-api-reference) documents the self-managed administration endpoints for Gateways and Upstreams.\n\nThese guides use `redis-context-gateway` chart `1.0.0`. Each chart release pins its matching Control Plane and Data Plane images by default."
    },
    {
      "id": "what-you-deploy",
      "title": "What you deploy",
      "role": "content",
      "text": "| Component | Purpose | Service port |\n| --- | --- | --- |\n| Control Plane | Create Gateways, register Upstreams, write credentials, and validate agent-key grants. | `9100` |\n| Data Plane | Serve each Gateway's MCP endpoint and call its Upstreams. | `8083` |\n| Identity Service | Issue agent keys and check them for the Data Plane. Installed as its own release. | `9200` |\n| Metadata Redis | Store Gateway and Upstream records. | Customer-provided |\n| Credential storage | Store Upstream credentials: encrypted Redis by default, or Vault or AWS Secrets Manager. | Customer-provided |\n| Registered databases | Context Surface data, and the Gateway database for cached results and handles. | Customer-provided |\n\nUse separately managed Redis deployments for metadata, credentials, and customer data. Use a separate Redis access control list (ACL) user for credentials."
    },
    {
      "id": "how-the-components-work-together",
      "title": "How the components work together",
      "role": "content",
      "text": "| Flow | Caller | Service | Backing store |\n| --- | --- | --- | --- |\n| Gateway administration | Platform admin | Control Plane | Metadata Redis and credential storage |\n| Agent-key administration | Platform admin | Identity Service | Identity Service metadata Redis |\n| Grant validation | Identity Service | Control Plane | Metadata Redis |\n| Tool listing and calls | Agent | Data Plane | Metadata Redis, credential storage, and Upstreams |\n\n1. Platform admins create Gateways and register Upstreams through the Control Plane, then mint agent keys through the Identity Service.\n1. The Identity Service asks the Control Plane to confirm that a Gateway exists before it mints a key for it.\n1. Agents call a Gateway's MCP endpoint on the Data Plane with an agent key or an identity provider token.\n1. The Data Plane checks the key with the Identity Service, reads the Gateway's records, and calls the Upstream with the Upstream's credential."
    },
    {
      "id": "api-surfaces",
      "title": "API surfaces",
      "role": "content",
      "text": "| API surface | Endpoint | Purpose |\n| --- | --- | --- |\n| Gateway MCP | `/iris/data/v1/context-gateway/gateways/{gatewayId}/mcp` | The Streamable HTTP MCP endpoint for one Gateway. |\n| Protected resource metadata | `/.well-known/oauth-protected-resource/iris/data/v1/context-gateway/gateways/{gatewayId}/mcp` | Names the identity provider for MCP client sign-in. |\n| Control Plane | `/iris/v1/context-gateway/gateways` | Administration of Gateways and Upstreams. |\n| Health | `/health/liveness`, `/health/readiness` | Liveness and readiness on both planes. |\n| Identity Service | `/v1/api-keys` | Administration of agent keys. |"
    },
    {
      "id": "get-started",
      "title": "Get started",
      "role": "content",
      "text": "1. Review the [prerequisites](https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/prerequisites).\n2. Prepare the [configuration](https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/configuration).\n3. [Deploy the chart](https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/deploy).\n4. [Load administrative credentials](https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/authentication).\n5. [Create a Gateway and an agent key](https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/api-examples)."
    },
    {
      "id": "manage-the-deployment",
      "title": "Manage the deployment",
      "role": "content",
      "text": "- [Manage Gateways and Upstreams](https://redis.io/docs/latest/develop/ai/context-engine/context-gateway/manage-gateways) and [Context Surfaces](https://redis.io/docs/latest/develop/ai/context-engine/context-gateway/manage-context-surfaces) through the Control Plane.\n- [Rotate or revoke agent keys](https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/api-examples#rotate-or-revoke-agent-keys).\n- [Check health, rotate credentials, back up, and upgrade](https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/operations).\n- [Troubleshoot the deployment](https://redis.io/docs/latest/operate/iris/context-gateway/self-managed/reference#troubleshooting)."
    }
  ],
  "examples": []
}