{
  "schema_version": 2,
  "id": "operate/iris/lens/self-managed",
  "title": "Self-managed Lens",
  "url": "https://redis.io/docs/latest/operate/iris/lens/self-managed/",
  "summary": "Deploy, configure, secure, and operate Lens on a self-managed Kubernetes cluster.",
  "tags": [
    "docs",
    "operate",
    "iris"
  ],
  "last_updated": "2026-11-03T16:45:14-08:00",
  "children": [
    {
      "id": "operate/iris/lens/self-managed/prerequisites",
      "summary": "Check the software, Redis databases, Identity Service, network access, and Secrets you need before you deploy Lens.",
      "title": "Self-managed Lens prerequisites",
      "url": "https://redis.io/docs/latest/operate/iris/lens/self-managed/prerequisites/"
    },
    {
      "id": "operate/iris/lens/self-managed/configuration",
      "summary": "Set the Helm values, storage Secret, retention, ingest, Identity Service connection, and TLS trust for Lens.",
      "title": "Configure self-managed Lens",
      "url": "https://redis.io/docs/latest/operate/iris/lens/self-managed/configuration/"
    },
    {
      "id": "operate/iris/lens/self-managed/deploy",
      "summary": "Install the Identity Service and Lens, check the deployment, create API keys, and give developers their Lens settings.",
      "title": "Deploy Lens",
      "url": "https://redis.io/docs/latest/operate/iris/lens/self-managed/deploy/"
    },
    {
      "id": "operate/iris/lens/self-managed/authentication",
      "summary": "Understand the Lens credentials, create API keys with grants, turn on operator sign-in, and rotate credentials.",
      "title": "Authentication and authorization",
      "url": "https://redis.io/docs/latest/operate/iris/lens/self-managed/authentication/"
    },
    {
      "id": "operate/iris/lens/self-managed/operations",
      "summary": "Check health, watch the records database, change retention, connect the console, back up, upgrade, uninstall, and troubleshoot Lens.",
      "title": "Operate self-managed Lens",
      "url": "https://redis.io/docs/latest/operate/iris/lens/self-managed/operations/"
    }
  ],
  "page_type": "content",
  "content_hash": "11455d9bc55d38ac586d23485ad81dea20332eee9fbf5ede7788a1908340556c",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "> [!NOTE]\n> Install Lens with the [`redis-iris` suite chart](https://redis.io/docs/latest/operate/iris/self-managed), the supported self-managed install. Installing the `redis-lens` chart on its own isn't a supported install path. These guides document its values, which you set under the suite chart's `lens:` key.\n\nLens traces your AI agent turns, so developers can see what each source returned, what entered the prompt, and how each step went. Before developers can send turns, a platform administrator deploys Lens, connects it to an Identity Service, and gives each application an endpoint and API keys.\n\nThis guide is for that administrator. It covers deploying Lens on your own Kubernetes cluster with the `redis-lens` Helm chart, then configuring, securing, and operating it. To install, start with the [prerequisites](https://redis.io/docs/latest/operate/iris/lens/self-managed/prerequisites).\n\n> [!NOTE]\n> You need a license key to deploy self-managed Lens. Contact your Redis representative or\n> [contact sales](https://redis.io/contact/).\n\nThese guides use `redis-lens` chart `1.0.0`."
    },
    {
      "id": "what-you-deploy",
      "title": "What you deploy",
      "role": "content",
      "text": "One release of the `redis-lens` chart runs three workloads. It deploys no Identity Service: it connects to a separate `iris-identity-service` release.\n\n| Component | Purpose | Service port |\n| --- | --- | --- |\n| Data plane | Receives turns from agents over OpenTelemetry Protocol (OTLP) and serves the read application programming interface (API). | `9000` |\n| Worker | Assembles received steps into turns. Runs the data-plane image, with no Service. | None |\n| Control plane | Holds the single Lens instance record and validates key grants for the Identity Service. | `9300` |\n| Identity Service | Mints Lens API keys and checks them for the data plane. Installed as its own release. | `9200` |\n| Records database | Turn streams and search indexes. | Customer-provided |\n| Content database | Captured prompts, responses, and tool payloads. | Customer-provided |\n| Metadata Redis | The Lens instance record. | Customer-provided |\n\nOne installation serves one Lens instance, `default` unless you set `instance.id`. The control plane creates it at startup, so there is no create call."
    },
    {
      "id": "how-the-components-work-together",
      "title": "How the components work together",
      "role": "content",
      "text": "| Flow | Caller | Service |\n| --- | --- | --- |\n| Send turns | Agent, with an `ingest` key | Data plane |\n| Read sessions and turns | Lens UI or read client, with a `read` key | Data plane |\n| Mint and revoke API keys | Platform admin, with the Identity Service control token | Identity Service |\n| Validate a key's grant before it's stored | Identity Service, with the control-plane internal token | Control plane |\n| Check an API key on each request | Data plane, with its runtime credential | Identity Service |\n| Read or change the instance's retention | Platform admin, with the control-plane admin token | Control plane |\n\nThe worker reads what the data plane receives from the records database and writes assembled turns back. It calls no other service."
    },
    {
      "id": "api-surfaces",
      "title": "API surfaces",
      "role": "content",
      "text": "| API surface | Endpoint | Purpose |\n| --- | --- | --- |\n| Ingest | `POST /iris/data/v1beta1/lens/v1/traces` | OTLP over HTTP (protobuf) from agents. |\n| Read API | `/iris/data/v1beta1/lens/instances/{instanceId}/...` | Agents, sessions, turns, and captured content. See the [read API](https://redis.io/docs/latest/develop/ai/context-engine/lens/read-api). |\n| Control plane | `/iris/v1beta1/lens/instance` | Read and change the instance's retention. |\n| Health | `/health/liveness`, `/health/readiness` | Liveness and readiness on every workload. |\n| Identity Service | `/v1/api-keys` | Administration of API keys. |"
    },
    {
      "id": "get-started",
      "title": "Get started",
      "role": "content",
      "text": "1. Review the [prerequisites](https://redis.io/docs/latest/operate/iris/lens/self-managed/prerequisites).\n1. Prepare the [configuration](https://redis.io/docs/latest/operate/iris/lens/self-managed/configuration).\n1. [Deploy the Identity Service and Lens](https://redis.io/docs/latest/operate/iris/lens/self-managed/deploy).\n1. [Create API keys](https://redis.io/docs/latest/operate/iris/lens/self-managed/authentication#create-api-keys).\n1. [Give developers their Lens settings](https://redis.io/docs/latest/operate/iris/lens/self-managed/deploy#hand-off-to-developers)."
    },
    {
      "id": "manage-the-deployment",
      "title": "Manage the deployment",
      "role": "content",
      "text": "- [Rotate credentials and revoke keys](https://redis.io/docs/latest/operate/iris/lens/self-managed/authentication#rotate-credentials).\n- [Check health, watch stream growth, change retention, and upgrade](https://redis.io/docs/latest/operate/iris/lens/self-managed/operations).\n- [Troubleshoot the deployment](https://redis.io/docs/latest/operate/iris/lens/self-managed/operations#troubleshooting)."
    }
  ],
  "examples": []
}