{
  "schema_version": 2,
  "id": "operate/iris/intent-router/self-managed/operations",
  "title": "Operate self-managed Intent Router",
  "url": "https://redis.io/docs/latest/operate/iris/intent-router/self-managed/operations/",
  "summary": "Check health, rotate credentials, watch memory, update configuration, back up, upgrade, and uninstall Redis Intent Router.",
  "tags": [
    "docs",
    "operate",
    "iris"
  ],
  "last_updated": "2026-11-04T01:09:56+02:00",
  "page_type": "content",
  "content_hash": "a6004dc13c0a0fb0ba2a43b7a2b85962ce43da32ffbdec6b756544b85cd6a03a",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "This page describes how to operate self-managed Intent Router after you deploy it and give Routers to developers. It covers routine checks, such as service health and data-plane Redis memory, and how the deployment responds when Redis is unavailable. It also covers the maintenance tasks you run with `helm upgrade`: rotating credentials, updating Secrets, and upgrading the chart. It ends with backing up and uninstalling the deployment."
    },
    {
      "id": "check-service-health",
      "title": "Check service health",
      "role": "content",
      "text": "Every service answers `/health/liveness` and `/health/readiness` without a credential:\n\n[code example]\n\nCheck one Router with its health route. It returns `ok` and a `checks` list that covers the Router's state, the embedding provider, the intent store, and the search index. A failing check carries a `message` that says why:\n\n[code example]\n\nWith `tests.enabled=true`, `helm test intent -n <namespace-name>` probes every service and runs the shared security-profile checks."
    },
    {
      "id": "rotate-credentials",
      "title": "Rotate credentials",
      "role": "content",
      "text": "Rotate the control plane and Identity Service tokens as described in [Rotate credentials](https://redis.io/docs/latest/operate/iris/intent-router/self-managed/authentication#rotate-credentials). To rotate an embedding provider credential, update `embedders_connection_details` in the inference Secret, update `inference.existingSecretChecksum`, and run `helm upgrade`, so the data plane rolls."
    },
    {
      "id": "watch-the-data-plane-redis",
      "title": "Watch the data-plane Redis",
      "role": "content",
      "text": "The data-plane Redis holds every Router's examples and vector index. Watch its memory against the estimate in [Size memory](https://redis.io/docs/latest/operate/iris/intent-router/self-managed/prerequisites#size-memory), and add memory before a large authoring run. Intent limits stop a Router growing past `dataplane.limits.max_intents_per_router`, but not past the memory of the database. A Router whose database runs out of memory answers `424` with `/errors/database-out-of-memory`.\n\nThe data plane rebuilds a Router's index if it is lost, and reports the Router ready only after the index is built. While it rebuilds, match requests return `503` with `Retry-After`."
    },
    {
      "id": "handle-redis-outages",
      "title": "Handle Redis outages",
      "role": "content",
      "text": "A Router whose database is unreachable answers `503` with `Retry-After` until the database returns. See [Customer databases](https://redis.io/docs/latest/operate/iris/intent-router/self-managed/configuration#customer-databases) for what happens to a new Router."
    },
    {
      "id": "update-configuration-and-license-secrets",
      "title": "Update configuration and license Secrets",
      "role": "content",
      "text": "When you change a Secret, update its `existingSecretChecksum` in the values and run `helm upgrade`, so the pods roll and read the new content. Changing a customer database URL needs this restart."
    },
    {
      "id": "back-up-the-deployment",
      "title": "Back up the deployment",
      "role": "content",
      "text": "Back up the metadata Redis, which holds the Router records, and the data-plane Redis, which holds intents and examples. Back up the Identity Service metadata too, so agent keys survive a restore. Keep the Secrets and the values file in your secret store and source control.\n\nA restored data-plane Redis rebuilds its Router indexes. Embeddings are stored with each example, so a restore doesn't call the embedding provider."
    },
    {
      "id": "upgrade-the-chart",
      "title": "Upgrade the chart",
      "role": "content",
      "text": "[code example]\n\nSet the image tags to the new chart version. Check readiness on every service afterward."
    },
    {
      "id": "uninstall-the-chart",
      "title": "Uninstall the chart",
      "role": "content",
      "text": "[code example]\n\nUninstalling doesn't delete the Redis databases or the Secrets you created. The chart keeps the auto-generated token Secrets (`helm.sh/resource-policy: keep`), so delete them yourself if you don't plan to reinstall."
    }
  ],
  "examples": [
    {
      "id": "check-service-health-ex0",
      "language": "bash",
      "code": "curl -sS http://localhost:9400/health/readiness\ncurl -sS http://localhost:9401/health/readiness\ncurl -sS http://localhost:9200/health/readiness",
      "section_id": "check-service-health"
    },
    {
      "id": "check-service-health-ex1",
      "language": "bash",
      "code": "curl -sS \"$IRIS_INTENT_ROUTER_URL/iris/data/v1/intent/routers/$IRIS_INTENT_ROUTER_ID/health\" \\\n  -H \"Authorization: Bearer $IRIS_INTENT_ROUTER_API_KEY\" | jq .",
      "section_id": "check-service-health"
    },
    {
      "id": "upgrade-the-chart-ex0",
      "language": "bash",
      "code": "helm repo update redis-ai\nhelm upgrade intent redis-ai/redis-intent-router \\\n  --version <chart-version> \\\n  --namespace <namespace-name> \\\n  -f intent-values.yaml \\\n  --wait --timeout 5m",
      "section_id": "upgrade-the-chart"
    },
    {
      "id": "uninstall-the-chart-ex0",
      "language": "bash",
      "code": "helm uninstall intent --namespace <namespace-name>",
      "section_id": "uninstall-the-chart"
    }
  ]
}