{ "schema_version": 2, "id": "operate/iris/lens/self-managed/deploy", "title": "Deploy Lens", "url": "https://redis.io/docs/latest/operate/iris/lens/self-managed/deploy/", "summary": "Install the Identity Service and Lens, check the deployment, create API keys, and give developers their Lens settings.", "tags": [ "docs", "operate", "iris" ], "last_updated": "2026-11-03T16:45:14-08:00", "page_type": "content", "content_hash": "ccd782d6903d1b27baf42a335169e48ad9be9577673da4b894eabd386aa396e2", "sections": [ { "id": "overview", "title": "Overview", "role": "overview", "text": "> [!NOTE]\n> For a supported install, see [Install with the Redis Iris suite chart](#install-with-the-redis-iris-suite-chart). The standalone steps on this page show what each value does.\n\nFollow these steps to install an Identity Service release and the `redis-lens` chart, check the deployment with a read key, and give developers the settings their agents need.\n\nThe examples use a Lens release named `lens` and an Identity Service release named `ids`, in the same namespace. With these names, the Lens Services are `lens-redis-lens-dataplane` and `lens-redis-lens-controlplane`, and the Identity Service is `ids-iris-identity-service`. If you choose other names, change them everywhere they appear, in both releases.\n\nBefore you begin, review the [prerequisites](https://redis.io/docs/latest/operate/iris/lens/self-managed/prerequisites). If you already run an Identity Service release for another Iris service, add the Lens entries from [step 3](#3-install-the-identity-service) to its values, and skip installing it." }, { "id": "1-create-the-namespace", "title": "1. Create the namespace", "role": "content", "text": "[code example]" }, { "id": "2-create-secrets", "title": "2. Create Secrets", "role": "content", "text": "Save the storage files from [Storage Secret](https://redis.io/docs/latest/operate/iris/lens/self-managed/configuration#storage-secret), and the license you received as `lens-license.key`. Save the Identity Service's metadata Redis as `ids-metadata.yaml`:\n\n[code example]\n\nThen create the Secrets:\n\n[code example]\n\nBoth releases mount `lens-dp-credential` and `lens-internal-token`. You own these two Secrets, and neither chart generates them. Neither chart checks the other's values, so keep them consistent yourself." }, { "id": "3-install-the-identity-service", "title": "3. Install the Identity Service", "role": "content", "text": "For every Identity Service setting, and for running one release that serves several products, see the [Identity Service guide](https://redis.io/docs/latest/operate/iris/identity-service).\n\nSave this as `values-ids.yaml`. It registers the data plane's runtime credential, and points grant validation at the Lens control plane:\n\n[code example]\n\n`singleTenantID` must equal the Lens `tenantId`. Lens needs no `subjectGrants.allowed` entry and no unscoped-grants product.\n\n[code example]\n\nUse the same version as the Lens chart, `1.0.0`. The Lens control plane doesn't exist yet. Wait until Lens is running before you create keys, because the Identity Service calls the control plane to validate each grant." }, { "id": "4-install-lens", "title": "4. Install Lens", "role": "content", "text": "Write `lens-values.yaml` from [Helm values](https://redis.io/docs/latest/operate/iris/lens/self-managed/configuration#helm-values), then install the chart:\n\n[code example]\n\nThe control plane creates the instance named by `instance.id` at startup, and generates the admin token Secret `lens-redis-lens-controlplane-admin-token`." }, { "id": "5-check-the-deployment", "title": "5. Check the deployment", "role": "content", "text": "Wait for the three Deployments:\n\n[code example]\n\nWith `tests.enabled=true`, run the readiness checks:\n\n[code example]\n\nReadiness stays false while the license is in its grace period. A release image without a valid license doesn't start." }, { "id": "6-make-an-authenticated-read", "title": "6. Make an authenticated read", "role": "content", "text": "Run each port-forward in its own terminal and leave it running:\n\n[code example]\n\n[code example]\n\nCreate a read key, as described in [Create API keys](https://redis.io/docs/latest/operate/iris/lens/self-managed/authentication#create-api-keys), and save it in `LENS_API_KEY`. Then list the instance's agents:\n\n[code example]\n\nA new instance returns an empty list. A `401` means the key is wrong or the data plane can't reach the Identity Service. A `403` means the key has no `read` grant on this instance." }, { "id": "expose-the-data-plane", "title": "Expose the data plane", "role": "content", "text": "Agents and read clients reach Lens at an Iris host, such as `https://iris.example.com`. The SDK refuses a plain `http://` endpoint outside loopback addresses by default, and the data plane serves plain HTTP. Publish it through a TLS-terminating ingress or gateway:\n\n- Route the path prefix `/iris/data/v1beta1/lens` on the Iris host to the `lens-redis-lens-dataplane` Service on port `9000`, without rewriting the path.\n- Allow request bodies up to the ingest request size in [Request limits](https://redis.io/docs/latest/develop/ai/context-engine/lens/limits#request-limits), 8 mebibytes (MiB) by default.\n- Don't publish the control plane. Operators reach it inside the cluster.\n\nFor example, with a Kubernetes Ingress:\n\n[code example]\n\nTo let developers open Lens in the Iris console, also add a `lens` entry to the console's gateway. See [Connect the console](https://redis.io/docs/latest/operate/iris/lens/self-managed/operations#connect-the-console)." }, { "id": "hand-off-to-developers", "title": "Hand off to developers", "role": "content", "text": "Give each application team these values. They match the variables in [Configure Lens](https://redis.io/docs/latest/develop/ai/context-engine/lens/configure) and the [read API](https://redis.io/docs/latest/develop/ai/context-engine/lens/read-api):\n\n| Variable | Value |\n| --- | --- |\n| `IRIS_LENS_ENDPOINT` | The Iris host, such as `https://`. The SDK sends turns to `/iris/data/v1beta1/lens/v1/traces` on it. |\n| `IRIS_LENS_API_KEY` | An ingest key for each agent. |\n| `LENS_URL` | The same Iris host, for the read client. |\n| `LENS_INSTANCE_ID` | Your `instance.id`, `default` unless you changed it. |\n| `LENS_API_KEY` | A read key for each person or tool that reads turns. |\n\nGive each agent its own ingest key. If one agent's key leaks, you can [revoke or rotate that key](https://redis.io/docs/latest/operate/iris/lens/self-managed/authentication) without interrupting your other agents. Send keys through your secret store, not in chat or tickets.\n\nDevelopers can then [trace their first turn](https://redis.io/docs/latest/develop/ai/context-engine/lens/quickstart)." }, { "id": "install-with-the-redis-iris-suite-chart", "title": "Install with the Redis Iris suite chart", "role": "setup", "text": "The `redis-iris` Helm chart installs Lens with the Identity Service and the Iris console in one release. Lens is on by default (`global.iris.products.lens.enabled`), and its values go under the `lens:` key. The chart also installs the other Iris products by default, so set `global.iris.products..enabled: false` for each one you don't deploy: `memory`, `playbook`, `contextGateway`, or `intent`.\n\nThe suite derives these values from `global.iris`. Don't set them under `lens:`: a value that differs fails the render and names the field.\n\n- `tenantId`, from `global.iris.tenantId`.\n- `license.existingSecret` and `license.secretKey`, from `global.iris.license`.\n- `dataplane.identityServiceBaseURL` and `identityService.allowInsecureTransport`, for the suite's Identity Service.\n- `identityService.credential` and `controlplane.internalToken`, the runtime credential and internal token.\n- `auth.oidc.audience`, `dataplane.oidc`, and `controlplane.oidc.enabled`, from `global.iris.auth.oidc` and `global.iris.auth.roleBindings`.\n\nThe suite also fixes `fullnameOverride` (`redis-lens`), the Service ports, `instance.id` (`default`), the data-plane rollout strategy, and `podDisruptionBudget.enabled` (`true`), and runs two data-plane replicas by default. The Services are `redis-lens-dataplane` and `redis-lens-controlplane`, the admin token is in the Secret `iris-lens-admin-token`, and the suite adds the console's Lens route. Save the Lens values in `iris-values.yaml`:\n\n[code example]\n\n[code example]\n\nThe rest of this guide applies to the values under `lens:`." }, { "id": "next-steps", "title": "Next steps", "role": "content", "text": "- [Create, rotate, and revoke API keys](https://redis.io/docs/latest/operate/iris/lens/self-managed/authentication).\n- [Operate the deployment](https://redis.io/docs/latest/operate/iris/lens/self-managed/operations)." } ], "examples": [ { "id": "1-create-the-namespace-ex0", "language": "bash", "code": "kubectl create namespace ", "section_id": "1-create-the-namespace" }, { "id": "2-create-secrets-ex0", "language": "yaml", "code": "metadata:\n urls: [\"rediss://:@:\"]", "section_id": "2-create-secrets" }, { "id": "2-create-secrets-ex1", "language": "bash", "code": "kubectl -n create secret generic lens-storage \\\n --from-file=lens-dataplane-storage.yaml \\\n --from-file=lens-controlplane-storage.yaml\nkubectl -n create secret generic lens-license \\\n --from-file=license=./lens-license.key\nkubectl -n create secret generic lens-dp-credential \\\n --from-literal=token=\"$(openssl rand -hex 32)\"\nkubectl -n create secret generic lens-internal-token \\\n --from-literal=token=\"$(openssl rand -hex 32)\"\nkubectl -n create secret generic ids-metadata \\\n --from-file=metadata.yaml=./ids-metadata.yaml\nkubectl -n create secret generic ids-control-token \\\n --from-literal=token=\"$(openssl rand -hex 32)\"", "section_id": "2-create-secrets" }, { "id": "3-install-the-identity-service-ex0", "language": "yaml", "code": "metadata:\n existingSecret: ids-metadata\ncontrol:\n existingSecret: ids-control-token\n autoGenerate: false\nruntime:\n apiKeyTenant:\n singleTenantID: default\n serviceCredentials:\n - name: lens-dataplane\n subject: lens-dataplane\n allowedOperations: [api-key-introspect]\n allowedProducts: [lens]\n existingSecret: lens-dp-credential\n secretKey: token\nproductValidation:\n products:\n lens:\n baseURL: http://lens-redis-lens-controlplane:9300\n credential:\n existingSecret: lens-internal-token\n secretKey: token", "section_id": "3-install-the-identity-service" }, { "id": "3-install-the-identity-service-ex1", "language": "bash", "code": "helm repo add redis-ai https://helm.redis.io/ai\nhelm repo update redis-ai\nhelm install ids redis-ai/iris-identity-service \\\n --version 1.0.0 \\\n --namespace \\\n -f values-ids.yaml", "section_id": "3-install-the-identity-service" }, { "id": "4-install-lens-ex0", "language": "bash", "code": "helm install lens redis-ai/redis-lens \\\n --version 1.0.0 \\\n --namespace \\\n -f lens-values.yaml \\\n --wait --timeout 5m", "section_id": "4-install-lens" }, { "id": "5-check-the-deployment-ex0", "language": "bash", "code": "kubectl -n rollout status deployment/lens-redis-lens-dataplane\nkubectl -n rollout status deployment/lens-redis-lens-worker\nkubectl -n rollout status deployment/lens-redis-lens-controlplane", "section_id": "5-check-the-deployment" }, { "id": "5-check-the-deployment-ex1", "language": "bash", "code": "helm test lens --namespace ", "section_id": "5-check-the-deployment" }, { "id": "6-make-an-authenticated-read-ex0", "language": "bash", "code": "kubectl -n port-forward svc/ids-iris-identity-service 9200:9200", "section_id": "6-make-an-authenticated-read" }, { "id": "6-make-an-authenticated-read-ex1", "language": "bash", "code": "kubectl -n port-forward svc/lens-redis-lens-dataplane 9000:9000", "section_id": "6-make-an-authenticated-read" }, { "id": "6-make-an-authenticated-read-ex2", "language": "bash", "code": "curl -sS http://localhost:9000/iris/data/v1beta1/lens/instances/default/agents \\\n -H \"Authorization: Bearer $LENS_API_KEY\"", "section_id": "6-make-an-authenticated-read" }, { "id": "expose-the-data-plane-ex0", "language": "yaml", "code": "apiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n name: lens\nspec:\n ingressClassName: \n tls:\n - hosts: []\n secretName: \n rules:\n - host: \n http:\n paths:\n - path: /iris/data/v1beta1/lens\n pathType: Prefix\n backend:\n service:\n name: lens-redis-lens-dataplane\n port:\n number: 9000", "section_id": "expose-the-data-plane" }, { "id": "install-with-the-redis-iris-suite-chart-ex0", "language": "yaml", "code": "lens:\n storage:\n existingSecret: lens-storage", "section_id": "install-with-the-redis-iris-suite-chart" }, { "id": "install-with-the-redis-iris-suite-chart-ex1", "language": "bash", "code": "helm install iris redis-ai/redis-iris \\\n --version 1.0.0 \\\n --namespace \\\n -f iris-values.yaml", "section_id": "install-with-the-redis-iris-suite-chart" } ] }