{
  "schema_version": 2,
  "id": "operate/iris/langcache/self-managed/operations",
  "title": "Operations",
  "url": "https://redis.io/docs/latest/operate/iris/langcache/self-managed/operations/",
  "summary": "Operate self-managed LangCache with backups, secret rotation, updates, FIPS posture, and support bundles.",
  "tags": [
    "docs",
    "operate",
    "iris"
  ],
  "last_updated": "2026-09-10T16:06:39+03:00",
  "page_type": "content",
  "content_hash": "d17451bc779d3cdc8ed10fd9c3fce48a70602ff0c53c6d915da10d77fcc1baa2",
  "sections": [
    {
      "id": "backups",
      "title": "Backups",
      "role": "overview",
      "text": "- Back up Cache Redis according to your cache-retention policy. LangCache\n  can rebuild the RediSearch index from existing entries, but losing the\n  underlying hashes loses cached responses.\n- Back up Metadata Redis. Losing metadata removes Control Plane cache\n  records — including the `databaseUrls` the Data Plane depends on to reach\n  Cache Redis.\n- Back up the Identity Service's own metadata Redis (bundled mode). Losing\n  it removes agent-key and grant records.\n- Back up any external secret manager material used to recreate the config\n  overlay, license, and token Secrets."
    },
    {
      "id": "secret-rotation",
      "title": "Secret rotation",
      "role": "content",
      "text": "The chart cannot see the contents of Secrets you bring yourself\n(`existingSecret` values), so it can't roll pods automatically when you\nupdate one. Every rotatable Secret has a matching `existingSecretChecksum`\nvalue: update the Secret, then bump the checksum and run `helm upgrade` to\nforce a rollout.\n\nRotate the config overlay Secrets (Redis URLs, database registry, embedding\ncredential):\n\n[code example]\n\n[code example]\n\nRotate the license the same way, using `dataplane.license.existingSecretChecksum`.\n\n**Linux:**\n\n[code example]\n\n**macOS:**\n\n[code example]\n\n\n\nApply the updated values and verify the workloads rolled:\n\n[code example]\n\nRotating an auto-generated token (admin token, internal token, Identity\nService control token, or the Data Plane's Identity Service runtime\ncredential) is different: those Secrets are Helm-managed, not\n`existingSecret`, so there is no checksum to bump. The chart looks up the\nexisting Secret on every `helm upgrade` and keeps its value stable unless\nthe Secret is gone, so either set `autoGenerate: false` and supply a new\n`existingSecret`, or delete the underlying Secret (it carries a\n`helm.sh/resource-policy: keep` annotation, so `helm uninstall` won't do\nthis for you) and let the next `helm upgrade` mint a fresh one.\n\nRotate agent keys minted for LangCache caches through the Identity Service;\nsee [API examples](https://redis.io/docs/latest/operate/iris/langcache/self-managed/api-examples#identity-service-api-examples)."
    },
    {
      "id": "updates",
      "title": "Updates",
      "role": "content",
      "text": "For every update:\n\n1. Update chart version and image tags.\n2. Recalculate `existingSecretChecksum` values for any changed overlay or\n   license Secrets.\n3. Run `helm upgrade`.\n4. Verify pod rollout and health endpoints.\n\n[code example]\n\nOn small clusters, avoid `--atomic` unless the timeout and capacity are\nknown to be sufficient."
    },
    {
      "id": "helm-tests",
      "title": "Helm tests",
      "role": "content",
      "text": "The chart can render `helm test` resources when `tests.enabled: true`. This\nrenders the shared security-profile check and the minimal RBAC it needs:\n\n[code example]\n\n`tests.smoke.enabled: true` independently gates an additional smoke test\nthat proves authenticated set/search/delete of one uniquely generated cache\nentry. It expects a `READY` cache and a valid agent key to already\nexist — create the cache through the Control Plane and mint the key\nthrough the Identity Service first, then store the key's plaintext token\nin a Secret and reference it:\n\n[code example]"
    },
    {
      "id": "fips-oriented-posture",
      "title": "FIPS-oriented posture",
      "role": "content",
      "text": "In a valid `security.profile: fips` deployment, the chart sets\n`GODEBUG=fips140=on` on the Data Plane and Control Plane containers:\n\n[code example]\n\nUnder this posture, the chart:\n\n- refuses to render with `identityService.mode: bundled` — the bundled\n  Identity Service's in-cluster Service has no TLS termination of its own,\n  so its address is always `http://`, which the profile forbids. Use\n  `identityService.mode: external` with a TLS-fronted Identity Service\n  instead.\n- refuses `identityService.external.baseURL` unless it is `https://`.\n  `identityService.external.allowInsecureTransport: true` is a real opt-out\n  outside `fips`, but is not honored under `fips`.\n\nThis is not a formal FIPS 140 compliance or validation claim. Treat it as an\nopt-in deployment posture and guardrail that must still be reviewed against\nyour compliance boundary."
    },
    {
      "id": "support-bundles-and-preflight",
      "title": "Support bundles and preflight",
      "role": "compatibility",
      "text": "`supportPackage.enabled: true` (the default) ships a namespace-scoped\n[Troubleshoot](https://troubleshoot.sh) spec as a ConfigMap. Collect a\nbundle with:\n\n[code example]\n\nThe bundle excludes Secret contents, license data, Redis URLs,\nadmin/internal/runtime credentials, API-key material, prompts, responses,\nvectors, and cache records — see the redactor spec shipped in the same\nnamespace (`langcache-support-redactors`) for the exact rules.\n\n`preflight.enabled: true` (the default) ships a cluster preflight check as\nboth a ConfigMap and a standalone file (`support/langcache-preflight.yaml`\nin the chart source) for `kubectl preflight` before you install:\n\n[code example]"
    },
    {
      "id": "network-policy",
      "title": "Network policy",
      "role": "content",
      "text": "For every Identity Service mode, prevent callers from bypassing your\nintended access path (gateway, ingress, or trusted-internal-only) and\nreaching the Data Plane, Control Plane, or bundled Identity Service Service\ndirectly. Write a NetworkPolicy for your cluster's CNI that default-denies\ningress to the `langcache`, `langcache-controlplane`, and (bundled mode)\n`langcache-identity-service` Services, then allow TCP traffic on their\nrespective ports (`9000`, `9100`, `9200`) from approved callers only."
    },
    {
      "id": "see-also",
      "title": "See also",
      "role": "related",
      "text": "- [Configuration](https://redis.io/docs/latest/operate/iris/langcache/self-managed/configuration) for the Redis roles being backed up and rotated here.\n- [Authentication and authorization](https://redis.io/docs/latest/operate/iris/langcache/self-managed/authentication) for how the tokens and agent keys rotated above are used.\n- [Configuration and troubleshooting](https://redis.io/docs/latest/operate/iris/langcache/self-managed/reference) for symptoms and fixes if a rotation or update doesn't take effect."
    }
  ],
  "examples": [
    {
      "id": "secret-rotation-ex0",
      "language": "bash",
      "code": "kubectl -n <namespace-name> create secret generic dp-overlay \\\n  --from-file=overlay.yaml=./dp-overlay.yaml \\\n  --dry-run=client -o yaml | kubectl apply -f -\nkubectl -n <namespace-name> create secret generic cp-overlay \\\n  --from-file=overlay.yaml=./cp-overlay.yaml \\\n  --dry-run=client -o yaml | kubectl apply -f -",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex1",
      "language": "yaml",
      "code": "dataplane:\n  secrets:\n    secretName: dp-overlay\n    existingSecretChecksum: \"<new-dp-overlay-checksum>\"\ncontrolplane:\n  secrets:\n    secretName: cp-overlay\n    existingSecretChecksum: \"<new-cp-overlay-checksum>\"",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex2",
      "language": "bash",
      "code": "sha256sum ./dp-overlay.yaml | awk '{print $1}'",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex3",
      "language": "bash",
      "code": "shasum -a 256 ./dp-overlay.yaml | awk '{print $1}'",
      "section_id": "secret-rotation"
    },
    {
      "id": "secret-rotation-ex4",
      "language": "bash",
      "code": "helm upgrade langcache redis-ai/langcache \\\n  --version <chart-version> \\\n  --namespace <namespace-name> \\\n  -f langcache-values.yaml\n\nkubectl -n <namespace-name> rollout status deployment/langcache\nkubectl -n <namespace-name> rollout status deployment/langcache-controlplane",
      "section_id": "secret-rotation"
    },
    {
      "id": "updates-ex0",
      "language": "bash",
      "code": "helm upgrade langcache redis-ai/langcache \\\n  --version <chart-version> \\\n  --namespace <namespace-name> \\\n  -f langcache-values.yaml \\\n  --atomic --wait",
      "section_id": "updates"
    },
    {
      "id": "helm-tests-ex0",
      "language": "bash",
      "code": "helm upgrade --install langcache redis-ai/langcache \\\n  --version <chart-version> \\\n  --namespace <namespace-name> \\\n  -f langcache-values.yaml \\\n  --set tests.enabled=true\n\nhelm test langcache --logs",
      "section_id": "helm-tests"
    },
    {
      "id": "helm-tests-ex1",
      "language": "yaml",
      "code": "tests:\n  enabled: true\n  smoke:\n    enabled: true\n    cacheID: <the cache ID you created>\n    apiKey:\n      existingSecret: langcache-smoke-key",
      "section_id": "helm-tests"
    },
    {
      "id": "fips-oriented-posture-ex0",
      "language": "yaml",
      "code": "security:\n  profile: fips",
      "section_id": "fips-oriented-posture"
    },
    {
      "id": "support-bundles-and-preflight-ex0",
      "language": "bash",
      "code": "kubectl support-bundle --namespace <namespace-name> --load-cluster-specs \\\n  -l troubleshoot.sh/kind=support-bundle",
      "section_id": "support-bundles-and-preflight"
    },
    {
      "id": "support-bundles-and-preflight-ex1",
      "language": "bash",
      "code": "kubectl preflight support/langcache-preflight.yaml",
      "section_id": "support-bundles-and-preflight"
    }
  ]
}