{ "schema_version": 2, "id": "operate/iris/identity-service/deploy", "title": "Deploy the Identity Service", "url": "https://redis.io/docs/latest/operate/iris/identity-service/deploy/", "summary": "Install the Identity Service as its own Helm release, register a service with it, and check that it answers.", "tags": [ "docs", "operate", "iris" ], "last_updated": "2026-11-03T16:45:14-08:00", "page_type": "content", "content_hash": "54fd19d8fd6c66fdbf6daff17aef44a7effb078b9ed06beac1b03630381d1bc2", "sections": [ { "id": "overview", "title": "Overview", "role": "overview", "text": "> [!NOTE]\n> The [`redis-iris` suite chart](https://redis.io/docs/latest/operate/iris/self-managed), the supported self-managed install, always installs the Identity Service and registers each service with it. Installing the `iris-identity-service` chart on its own isn't a supported install path. These guides document its values, which you set under the suite chart's `identityService:` key.\n\nFollow these steps to install the Identity Service with the `iris-identity-service` Helm chart, register your first Iris service with it, and check that its control API accepts your control token.\n\nThe examples install chart `1.0.0` as release `ids` in the same namespace as the services, so the Service is `ids-iris-identity-service:9200`. They register Agent Memory. For the other services, swap in their entries from [Register services](https://redis.io/docs/latest/operate/iris/identity-service/configuration#register-services)." }, { "id": "prerequisites", "title": "Prerequisites", "role": "content", "text": "| Requirement | Details |\n| --- | --- |\n| Kubernetes | A cluster and a namespace for the release. The tested layout puts the Identity Service in the same namespace as the services, because they share Secrets. |\n| Helm | Helm 3, with the Redis AI repository `https://helm.redis.io/ai`. |\n| Image | `redislabs/iris-identity-service` from Docker Hub, or a copy in your private registry. By default, the chart deploys the image tag that matches its version. |\n| Metadata Redis | A Redis database for the Identity Service. Turn on persistence (append-only file or RDB snapshots) and keep its data on durable storage. It holds every agent key, so back it up. See [Metadata Redis](https://redis.io/docs/latest/operate/iris/identity-service/configuration#metadata-redis). |\n| Tenant | One tenant ID for the installation, for example `default`. Every service release sets the same value as its `tenantId`. You can't change it later. |\n| Service details | For each service you register: its control-plane Service address, its control-plane internal token Secret, and its data-plane runtime credential Secret. Each service's deploy guide names them. |\n| Transport Layer Security (TLS) | The Identity Service has no TLS listener. For production, put a TLS endpoint in front of it and of each service control plane. |" }, { "id": "1-create-the-namespace", "title": "1. Create the namespace", "role": "content", "text": "Skip this step if the services' namespace already exists.\n\n[code example]" }, { "id": "2-create-the-metadata-secret", "title": "2. Create the metadata Secret", "role": "content", "text": "1. Save the metadata Redis connection as `ids-metadata.yaml`. Use `rediss://` for TLS, and put the Redis user and password in the URL:\n\n [code example]\n\n1. Create the Secret. The key must be `metadata.yaml`:\n\n [code example]" }, { "id": "3-create-the-control-token-and-shared-secrets", "title": "3. Create the control token and shared Secrets", "role": "content", "text": "1. Create the control token Secret. Only the Identity Service mounts it:\n\n [code example]\n\n To let the chart generate the token instead, skip this step and omit `control` from the values file. The chart then creates `ids-iris-identity-service-control-token` and keeps it across upgrades and uninstalls.\n\n1. Create the service's data-plane runtime credential. The data plane and the Identity Service both mount it:\n\n [code example]\n\n1. Create the service's control-plane internal token. The control plane and the Identity Service both mount it:\n\n [code example]\n\nEvery credential needs its own value. The Identity Service doesn't start when two credentials have the same value. If you already followed a service's deploy guide, these Secrets exist: reuse them." }, { "id": "4-create-values-idsyaml", "title": "4. Create `values-ids.yaml`", "role": "content", "text": "Save this file. It registers Agent Memory over the in-cluster Service. For production, use the control plane's TLS endpoint and set `tls.caCertSecret`, as described in [TLS, Federal Information Processing Standards (FIPS), and network](https://redis.io/docs/latest/operate/iris/identity-service/configuration#tls-fips-and-network).\n\n[code example]\n\n`runtime.unscopedGrantsProduct: memory` is for Agent Memory only. Omit it when the release doesn't serve Agent Memory." }, { "id": "before-you-install-check-your-values", "title": "Before you install: check your values", "role": "content", "text": "The chart's values schema is closed: an unknown key, service, or operation fails the install. Check each value before you install. If one is wrong, you see the symptom in its row.\n\n| Check | Symptom | Fix |\n| --- | --- | --- |\n| `metadata.existingSecret` is set | Rendering fails | Name the metadata Secret. |\n| `runtime.serviceCredentials` has at least one entry | Rendering fails | Add an entry for each service data plane. |\n| `productValidation.products` has at least one enabled service | Rendering fails | Add a validator for each service control plane. |\n| The control token, runtime credentials, and internal tokens use different Secret keys and different values | Rendering fails, or the pod doesn't start | Create a separate Secret for each. |\n| `runtime.apiKeyTenant.singleTenantID` equals each service's `tenantId` | Minting a key fails with `400`, or agents get `403` | Set the same tenant in every release. |\n| A numeric tenant ID is a string | Rendering fails, or the tenant doesn't match | Quote it in YAML, or use `--set-string`. |" }, { "id": "5-install", "title": "5. Install", "role": "content", "text": "[code example]\n\nThe service's control plane can be missing at this point. The Identity Service starts without it, but minting a key for that service fails until the control plane answers grant validation." }, { "id": "6-verify-the-release", "title": "6. Verify the release", "role": "content", "text": "1. Wait for the Deployment:\n\n [code example]\n\n1. Run the chart test. It checks that the Identity Service is ready, which means it reaches the metadata Redis:\n\n [code example]\n\n1. In a separate terminal, forward the Service port and leave it running:\n\n [code example]\n\n1. Load the control token:\n\n [code example]\n\n If the chart generated the token, read `ids-iris-identity-service-control-token` instead. `helm status ids -n ` prints the command for your release.\n\n1. List the registered services. The response names each service that has a grant validator:\n\n [code example]\n\nA passing `helm test` doesn't prove that the release can mint keys. Minting needs the service's control plane. After you install the service, mint a key as its deploy guide shows, or as described in [Mint an agent key](https://redis.io/docs/latest/operate/iris/identity-service/operations#mint-an-agent-key)." }, { "id": "next-steps", "title": "Next steps", "role": "content", "text": "- Install the service and connect its data plane to `http://ids-iris-identity-service:9200`, or to the Identity Service's TLS endpoint.\n- [Register more services](https://redis.io/docs/latest/operate/iris/identity-service/configuration#register-services) on the same release.\n- [Let operators sign in with your identity provider](https://redis.io/docs/latest/operate/iris/identity-service/authentication#operator-sign-in-with-your-identity-provider), so they don't share the control token." } ], "examples": [ { "id": "1-create-the-namespace-ex0", "language": "bash", "code": "kubectl create namespace ", "section_id": "1-create-the-namespace" }, { "id": "2-create-the-metadata-secret-ex0", "language": "yaml", "code": "metadata:\n urls: [\"rediss://:@:\"]", "section_id": "2-create-the-metadata-secret" }, { "id": "2-create-the-metadata-secret-ex1", "language": "bash", "code": "kubectl -n create secret generic ids-metadata \\\n --from-file=metadata.yaml=./ids-metadata.yaml", "section_id": "2-create-the-metadata-secret" }, { "id": "3-create-the-control-token-and-shared-secrets-ex0", "language": "bash", "code": "kubectl -n create secret generic ids-control-token \\\n --from-literal=token=\"$(openssl rand -hex 32)\"", "section_id": "3-create-the-control-token-and-shared-secrets" }, { "id": "3-create-the-control-token-and-shared-secrets-ex1", "language": "bash", "code": "kubectl -n create secret generic memory-dp-credential \\\n --from-literal=token=\"$(openssl rand -hex 32)\"", "section_id": "3-create-the-control-token-and-shared-secrets" }, { "id": "3-create-the-control-token-and-shared-secrets-ex2", "language": "bash", "code": "kubectl -n create secret generic memory-internal-token \\\n --from-literal=token=\"$(openssl rand -hex 32)\"", "section_id": "3-create-the-control-token-and-shared-secrets" }, { "id": "4-create-values-idsyaml-ex0", "language": "yaml", "code": "metadata:\n existingSecret: ids-metadata\ncontrol:\n existingSecret: ids-control-token\n autoGenerate: false\nruntime:\n unscopedGrantsProduct: memory\n apiKeyTenant:\n singleTenantID: default\n serviceCredentials:\n - name: memory-dp\n subject: memory-dp\n allowedOperations: [api-key-introspect]\n allowedProducts: [memory]\n existingSecret: memory-dp-credential\n secretKey: token\nproductValidation:\n products:\n memory:\n baseURL: http://redis-agent-memory-controlplane:9100\n credential:\n existingSecret: memory-internal-token\n secretKey: token", "section_id": "4-create-values-idsyaml" }, { "id": "5-install-ex0", "language": "bash", "code": "helm repo add redis-ai https://helm.redis.io/ai\nhelm repo update redis-ai\nhelm install ids redis-ai/iris-identity-service \\\n --version 1.0.0 \\\n --namespace \\\n -f values-ids.yaml", "section_id": "5-install" }, { "id": "6-verify-the-release-ex0", "language": "bash", "code": "kubectl -n rollout status deployment/ids-iris-identity-service", "section_id": "6-verify-the-release" }, { "id": "6-verify-the-release-ex1", "language": "bash", "code": "helm test ids --namespace ", "section_id": "6-verify-the-release" }, { "id": "6-verify-the-release-ex2", "language": "bash", "code": "kubectl -n port-forward svc/ids-iris-identity-service 9200:9200", "section_id": "6-verify-the-release" }, { "id": "6-verify-the-release-ex3", "language": "bash", "code": "export IRIS_IDENTITY_URL='http://localhost:9200'\n export IRIS_IDENTITY_TOKEN=\"$(kubectl -n get secret \\\n ids-control-token -o jsonpath='{.data.token}' | base64 --decode)\"", "section_id": "6-verify-the-release" }, { "id": "6-verify-the-release-ex4", "language": "bash", "code": "curl -sS -H \"Authorization: Bearer $IRIS_IDENTITY_TOKEN\" \"$IRIS_IDENTITY_URL/v1/products\"", "section_id": "6-verify-the-release" } ] }