Install the Redis Iris suite

Install the Identity Service, the Redis Iris services, and the Iris console on Kubernetes as one Helm release.

The redis-iris Helm chart installs the Identity Service, the Redis Iris services you choose, and the Iris console as one release. It's the supported way to run Redis Iris on your own Kubernetes cluster. The product charts that each service guide describes, such as redis-agent-memory and iris-identity-service, are published as dependencies of this chart. Installing one on its own isn't a supported install path.

What you deploy

The chart installs every component under a fixed name in the release namespace, whatever you call the release, so the components reach each other by Service name.

Every service is on by default. Set enabled: false for each one you don't install. A disabled service needs none of its values.

Install one release per namespace, and keep other Iris releases out of that namespace. The release is one tenant.

Prerequisites

1. Create the namespace

kubectl create namespace <namespace-name>

2. Create the shared Secrets

Create these Secrets in the release namespace. Each service guide lists that service's own Secrets in its suite section.

kubectl -n <namespace-name> create secret generic iris-license \
  --from-file=license.key=./license.key

The chart generates every credential the components share, including each service's admin token. See Credentials.

3. Write iris-values.yaml

Set the values the services share once, under global. The services derive their tenant, license, CA trust, OIDC settings, and Identity Service wiring from them. A service value that differs from a derived one fails the render and names the field.

global:
  tls:
    caCertSecret: cluster-ca
  iris:
    tenantId: default
    license:
      existingSecret: iris-license
    publicURL: https://<console-host>
    ingress:
      className: <ingress-class>
      tls:
        secretName: iris-tls
    auth:
      oidc:
        issuer: https://<idp-host>/<issuer-path>
        jwksURI: https://<idp-host>/<jwks-path>
      roleBindings:
        - { group: <admin-group>, role: suite_admin }
        - { group: <memory-operators-group>, role: operator, product: agent_memory }
    products:
      contextGateway:
        enabled: false

identityService:
  metadata:
    existingSecret: ids-metadata

ui:
  sso:
    clientId: <console-client-id>
    clientCredential:
      existingSecret: iris-ui-oidc
    redis:
      existingSecret: ui-session-redis

Then add each service's values under its key, as its guide describes:

• Agent Memory, under memory:
• Agent Playbooks, under playbook:
• Lens, under lens:
• Context Gateway, under contextGateway:
• Intent Router, under intent:

Admin token mode

Without an IdP, turn off console sign-in and the console Ingress. Operators then paste each service's admin token into the console, and publicURL, ingress, and auth.oidc aren't needed:

ui:
  sso:
    enabled: false
  ingress:
    enabled: false

Use admin token mode for evaluation, or as the break-glass path when your IdP is unavailable.

4. Run the preflight

The chart includes a preflight that checks the Kubernetes version, baseline sizing, the Metrics API, the console's IngressClass, and that the workload identity issuer is reachable. Run it with the kubectl preflight plugin, v0.124.0 or later:

helm template iris redis-ai/redis-iris --version 1.0.0 -n <namespace-name> -f iris-values.yaml \
  --show-only templates/preflight.yaml \
  | yq '.stringData["preflight.yaml"]' | kubectl preflight -

On clusters that refuse anonymous access to the ServiceAccount issuer, such as kubeadm clusters, the workload identity check fails and prints the binding to create. The chart creates no cluster-scoped permissions:

kubectl create clusterrolebinding <namespace-name>-issuer-discovery \
  --clusterrole=system:service-account-issuer-discovery --group=system:unauthenticated

5. Install

helm repo add redis-ai https://helm.redis.io/ai
helm repo update redis-ai
helm install iris redis-ai/redis-iris \
  --version 1.0.0 \
  --namespace <namespace-name> \
  -f iris-values.yaml

A missing or conflicting value fails the install and names the field to fix.

6. Verify the release

helm test iris --namespace <namespace-name> --logs

For each installed service, the test creates a resource with the admin token, mints a scoped agent key, calls the data plane with it, calls the console, and then removes what it created. It creates its temporary Agent Memory store in Memory database 1. If your Memory databases registry uses another key, set tests.suiteVerify.databaseId.

Credentials

By default, the chart generates every shared credential once, as Secrets it keeps across upgrades, rollbacks, and uninstalls.

<service> is memory, playbook, lens, context-gateway, or intent. Read an admin token with:

kubectl -n <namespace-name> get secret iris-memory-admin-token -o jsonpath='{.data.token}' | base64 -d

To rotate a credential, change its Secret in place. A rollback never restores an old value. To start over after helm uninstall, delete the Secrets yourself:

kubectl -n <namespace-name> delete secret -l app.kubernetes.io/component=credentials,app.kubernetes.io/name=redis-iris

To supply your own credentials, for example for an offline render with Argo CD or Flux, set global.iris.renderMode: gitops and global.iris.secrets.generate: false. Then name two Secrets: global.iris.secrets.dataplaneServiceCredentials.existingSecret, with a <service>-dp key for each installed service, and global.iris.secrets.controlplaneInternalTokens.existingSecret, with a <service> key for each.

Availability

The chart runs two replicas of the Identity Service, the console, and every data plane, and one of each control plane. Data planes roll one surge pod at a time and remove an old pod only when the new one is ready, so leave room for one extra pod. Every Deployment with more than one replica gets a PodDisruptionBudget with maxUnavailable: 1. The rollout strategy and the PodDisruptionBudgets are fixed. Replica counts are yours to size.

Move from a preview or standalone install

Upgrading to redis-iris from preview charts (0.x) or from product charts installed on their own isn't supported. Reinstall instead, against the same Redis databases:

1. Record your values.
2. Run helm uninstall for every Iris release in the namespace.
3. Write iris-values.yaml with the same Redis Secrets, and install redis-iris.

Data in those databases is kept, except from Agent Memory 0.0.x and Agent Playbooks 0.1.x previews, which can't be upgraded. Expect a few minutes of downtime.

Not supported in this release