Self-managed LangCache prerequisites

Review software, Redis, network, Secret, image, and sizing prerequisites for self-managed LangCache.

LangCache self-managed is distributed as container images on Docker Hub plus the langcache Helm chart. One helm install of the chart deploys the LangCache Data Plane, the LangCache Control Plane, and either a bundled Identity Service or a connection to an external Identity Service.

You provide the Redis databases, embedding provider credentials, Kubernetes exposure, and license material used by the deployment.

What you need

Required software

Redis databases

The Helm chart does not deploy Redis databases. Provision them outside the chart and register them through the Control Plane's and Data Plane's config overlays (see Configuration).

Cache Redis must support RediSearch with vector search, because LangCache creates a RediSearch vector index per cache. Metadata Redis does not need that capability.

For a lab deployment, these Redis roles can point at the same Redis endpoint if it has the required modules and capacity. For production, separate them so cache data and control metadata can be scaled, backed up, and operated independently.

Metadata Redis durability

Metadata Redis is small compared with Cache Redis, but it is operationally critical. Use persistent storage, Redis authentication, network isolation, and TLS where required. Avoid eviction of metadata keys; losing metadata removes Control Plane cache records.

Network access

• Connected install: the cluster must be able to pull the LangCache and Identity Service images from Docker Hub (or your mirrored registry) and reach https://helm.redis.io/ai.
• Air-gapped install: mirror the images into an internal registry and use a locally downloaded chart package.
• Runtime access: LangCache pods must reach the Redis databases and the embedding provider endpoint used by the deployment. The Data Plane must also reach the Identity Service (bundled or external); the Control Plane must reach Metadata Redis and every registered Cache Redis database.
• Data Plane exposure: use NetworkPolicy, ingress, gateway, service mesh, private load balancer, or equivalent controls to restrict API access.

Credentials and Secrets

The chart never puts Redis URLs, the database registry, or the embedding credential in values.yaml or a rendered ConfigMap. Each of the Data Plane, Control Plane, and bundled Identity Service reads its own pre-created overlay Secret, deep-merged over its rendered base config at runtime. See Configuration for the overlay content each component expects.

Release artifacts and image tags

LangCache self-managed image tags use the release SemVer value, for example:

dataplane:
  image:
    repository: redislabs/iris-langcache-data
    tag: "<langcache-version>"
controlplane:
  image:
    repository: redislabs/iris-langcache-control
    tag: "<langcache-version>"
identityService:
  bundled:
    image:
      repository: redislabs/iris-identity-service
      tag: "<langcache-version>"

Use the image tags listed for the release on Docker Hub or provided by Redis. Do not use floating image tags in production.

Air-gapped and private registry installs

Mirror the published images into your internal registry:

for image in iris-langcache-data iris-langcache-control iris-identity-service; do
  docker pull redislabs/$image:<langcache-version>
  docker tag redislabs/$image:<langcache-version> \
    registry.example.com/redislabs/$image:<langcache-version>
  docker push registry.example.com/redislabs/$image:<langcache-version>
done

If the registry requires authentication, create an image pull Secret and reference it from imagePullSecrets in your values file:

kubectl -n <namespace-name> create secret docker-registry langcache-registry \
  --docker-server=registry.example.com \
  --docker-username=<username> \
  --docker-password=<password>

imagePullSecrets:
  - name: langcache-registry

System requirements

Default chart values:

During a rolling update, Kubernetes may temporarily run old and new pods at the same time. A small test cluster can run out of CPU during install or upgrade; size for the maximum rolling-update overlap, or reduce replicas explicitly for a lab install.

Helm values to review

The walkthroughs in this guide assume the chart's default fullnameOverride: langcache, which fixes the rendered resource names to langcache (Data Plane), langcache-controlplane, and langcache-identity-service (bundled mode). If you change it, update the release-derived names in the verification commands throughout this guide.

Next steps

Continue to Configuration to prepare the Data Plane, Control Plane, and Identity Service overlay Secrets, then Deploy self-managed LangCache.