Deploy the Identity Service

Install the Identity Service as its own Helm release, register a service with it, and check that it answers.

Follow these steps to install the Identity Service with the iris-identity-service Helm chart, register your first Iris service with it, and check that its control API accepts your control token.

The examples install chart 1.0.0 as release ids in the same namespace as the services, so the Service is ids-iris-identity-service:9200. They register Agent Memory. For the other services, swap in their entries from Register services.

Prerequisites

1. Create the namespace

Skip this step if the services' namespace already exists.

kubectl create namespace <namespace-name>

2. Create the metadata Secret

1. Save the metadata Redis connection as ids-metadata.yaml. Use rediss:// for TLS, and put the Redis user and password in the URL:

   metadata:
     urls: ["rediss://<metadata-user>:<metadata-password>@<metadata-host>:<metadata-port>"]
   

2. Create the Secret. The key must be metadata.yaml:

   kubectl -n <namespace-name> create secret generic ids-metadata \
     --from-file=metadata.yaml=./ids-metadata.yaml
   

3. Create the control token and shared Secrets

1. Create the control token Secret. Only the Identity Service mounts it:

   kubectl -n <namespace-name> create secret generic ids-control-token \
     --from-literal=token="$(openssl rand -hex 32)"
   

   To let the chart generate the token instead, skip this step and omit control from the values file. The chart then creates ids-iris-identity-service-control-token and keeps it across upgrades and uninstalls.

2. Create the service's data-plane runtime credential. The data plane and the Identity Service both mount it:

   kubectl -n <namespace-name> create secret generic memory-dp-credential \
     --from-literal=token="$(openssl rand -hex 32)"
   

3. Create the service's control-plane internal token. The control plane and the Identity Service both mount it:

   kubectl -n <namespace-name> create secret generic memory-internal-token \
     --from-literal=token="$(openssl rand -hex 32)"
   

Every credential needs its own value. The Identity Service doesn't start when two credentials have the same value. If you already followed a service's deploy guide, these Secrets exist: reuse them.

4. Create values-ids.yaml

Save this file. It registers Agent Memory over the in-cluster Service. For production, use the control plane's TLS endpoint and set tls.caCertSecret, as described in TLS, Federal Information Processing Standards (FIPS), and network.

metadata:
  existingSecret: ids-metadata
control:
  existingSecret: ids-control-token
  autoGenerate: false
runtime:
  unscopedGrantsProduct: memory
  apiKeyTenant:
    singleTenantID: default
  serviceCredentials:
    - name: memory-dp
      subject: memory-dp
      allowedOperations: [api-key-introspect]
      allowedProducts: [memory]
      existingSecret: memory-dp-credential
      secretKey: token
productValidation:
  products:
    memory:
      baseURL: http://redis-agent-memory-controlplane:9100
      credential:
        existingSecret: memory-internal-token
        secretKey: token

runtime.unscopedGrantsProduct: memory is for Agent Memory only. Omit it when the release doesn't serve Agent Memory.

Before you install: check your values

The chart's values schema is closed: an unknown key, service, or operation fails the install. Check each value before you install. If one is wrong, you see the symptom in its row.

5. Install

helm repo add redis-ai https://helm.redis.io/ai
helm repo update redis-ai
helm install ids redis-ai/iris-identity-service \
  --version 1.0.0 \
  --namespace <namespace-name> \
  -f values-ids.yaml

The service's control plane can be missing at this point. The Identity Service starts without it, but minting a key for that service fails until the control plane answers grant validation.

6. Verify the release

1. Wait for the Deployment:

   kubectl -n <namespace-name> rollout status deployment/ids-iris-identity-service
   

2. Run the chart test. It checks that the Identity Service is ready, which means it reaches the metadata Redis:

   helm test ids --namespace <namespace-name>
   

3. In a separate terminal, forward the Service port and leave it running:

   kubectl -n <namespace-name> port-forward svc/ids-iris-identity-service 9200:9200
   

4. Load the control token:

   export IRIS_IDENTITY_URL='http://localhost:9200'
   export IRIS_IDENTITY_TOKEN="$(kubectl -n <namespace-name> get secret \
     ids-control-token -o jsonpath='{.data.token}' | base64 --decode)"
   

   If the chart generated the token, read ids-iris-identity-service-control-token instead. helm status ids -n <namespace-name> prints the command for your release.

5. List the registered services. The response names each service that has a grant validator:

   curl -sS -H "Authorization: Bearer $IRIS_IDENTITY_TOKEN" "$IRIS_IDENTITY_URL/v1/products"
   

A passing helm test doesn't prove that the release can mint keys. Minting needs the service's control plane. After you install the service, mint a key as its deploy guide shows, or as described in Mint an agent key.

Next steps

• Install the service and connect its data plane to http://ids-iris-identity-service:9200, or to the Identity Service's TLS endpoint.
• Register more services on the same release.
• Let operators sign in with your identity provider, so they don't share the control token.