[gudata]

Ticket ID

MOD-19813

Description

Update the seven Agent Memory self-managed pages for the published Memory chart 0.8.0 and the separately installed Identity Service chart 0.10.0. Memory deploys the data plane, workers, and control plane. Operators install Identity Service first, provision the shared credentials, then connect Memory through dataplane.identityServiceBaseURL and identityService.credential.

The installation procedure provides separate values files, matching tenant settings, secure endpoints, certificate trust, and worker identity. Configuration, authentication, private registry, rotation, Federal Information Processing Standards (FIPS), network policy, and troubleshooting guidance follow the same contract. Published Memory image tags default to 0.8.0; Identity Service uses its own version 0.10.0. Direct upgrades from earlier releases with an embedded Identity Service, including 0.7.0, remain unsupported.

Contract source: Iris pull request 1926 and the published Helm packages. Standalone Identity Service specification.

Summary

flowchart LR
    Memory["Memory 0.8.0 data plane"] -->|Runtime introspection| Identity["Identity Service 0.10.0"]
    Identity -->|Grant validation| Control["Memory control plane"]

Loading

Testing

• Extracted YAML examples parse; both published charts pass helm template and helm lint with the documented installation values.
• Manifest checks confirm Memory deploys no Identity Service resources and wires the runtime endpoint, credential mount, and admin tenant correctly.
• Thirteen render cases pass, covering required connection values, transport exceptions, FIPS, development-only disabled authentication, supplied configuration Secrets, chart-owned settings, removed keys, cache settings, and published image defaults.
• Shell examples pass bash -n after placeholder substitution.
• Hugo 0.143.1 builds successfully after local example generation; all seven rendered pages and 234 section links and anchors pass checks. Frontmatter and aliases are preserved; no new external Markdown links were added.
• Reproduced the documented legacy /health failure against the report's running Memory 0.8.0, then verified the corrected /health/readiness example returns HTTP 200 and {"status":"ready"}.
• Focused renders verify both rotation checksum annotations, complete local-provider replacement, preserved idempotency and its Redis overlay, HTTP lab values, and the mirrored Identity Service test image.
• Independent pr-deep-review reviewer/challenger passes and ponytail-review found no concrete defects.

The current chart, example, shell, and rendered-page checks cover documentation head 1edb30458. The supplied deployment report tested earlier revision 04a0aa18e on a disposable kind cluster: installation, authentication, promotion, credential rotation, supplied configuration, and local-model evaluation succeeded. Its seven findings are addressed: readiness route, isolated HTTP lab setup, worker idempotency, initial CA Secret configuration, complete local-provider edits, optional test-hook image, and configuration/rotation details. Final reviewer/challenger passes also caught and corrected the need for fresh stores after changing embedding dimensions.

The complete revised tutorial was not deployed again; the health correction was checked against the existing running installation. FIPS was rendered, not deployed. Additional package evidence is the successful Memory 0.8.0 release validation, at Iris revision dfdf966c9d88bb5832f57ddfb02b727f4c1ae488. The shared Cloud OpenAPI health entry is retained because the separate SM Cloud maintenance contract still defines it. The full component-refresh and derived-feed pipeline was not rerun. Browser screenshots were unavailable; inspection used rendered HTML.

Evidence

• Before: The draft described an Identity Service subchart, removed values, and chart 1.0.0.
• After: The pages describe two independent releases and render successfully against Memory 0.8.0 plus Identity Service 0.10.0.

Merge Danger

Door: Two-way; documentation changes can be reverted.

Blast Radius: Deployment. Incorrect instructions can prevent customer installation or authentication; package rendering and connection checks cover the documented wiring.

Main branch synchronization

Pull request 4227 merged as 65dd861b1 using a merge commit. The current documentation main (b01b5d9a2) now merges cleanly into this branch, preserving the earlier FIPS reconciliation. All seven reviewed self-managed pages are byte-identical to 1edb30458; existing chart, shell, deployment-report, and review evidence remains applicable. The merged site passes the pinned Hugo build, seven-page checks, and 234 section links and anchors. No manual conflict edits or application changes were needed. The FIPS dependency is complete.

Commits

• 8c0a67b — Merge current main after FIPS documentation lands; reviewed pages unchanged.

• 6d6e397a8 — Document installation with a standalone Identity Service.

• 04a0aa18e — Align authentication, configuration, and operations with the separate releases.

• 48e129192 — Incorporate the FIPS branch and resolve its overlap now.

• 1edb30458 — Fix the deployed documentation report findings and require fresh stores for local provider changes.

---

Note

Low Risk
Documentation-only changes with no application code; incorrect install steps could confuse operators but are reversible and validated against published charts.

Overview
Updates the seven self-managed Agent Memory docs for Memory chart 0.8.0 and a separately installed Identity Service chart 0.10.0. The deployment model no longer treats Identity Service as part of the Memory release; operators install ids first, provision shared Secrets (memory-dp-credential, memory-internal-token, ids-control-token), then wire Memory with dataplane.identityServiceBaseURL, identityService.credential, and matching tenantId / singleTenantID.

The Deploy walkthrough is rewritten for two Helm releases, TLS frontends (plus an HTTP-only lab path), values-ids.yaml, worker idempotency (background_jobs.idempotency), combined ram-ca trust, and health checks on /health/readiness instead of /health. Authentication, configuration, and operations document operator-owned shared credentials, chart-owned introspection fields, stricter dev-only auth.method: none, cross-namespace connection, coordinated secret rotation via checksums, independent upgrades, unsupported direct upgrade from bundled 0.7.0, and FIPS/network policy split across both charts.

Prerequisites and reference add the second chart, mirror/air-gap split, expanded troubleshooting for removed identityService.* / externalIdentityService values, and API surface notes for liveness/readiness endpoints.

^{Reviewed by Cursor Bugbot for commit 8c0a67b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Staging links:
https://redis.io/docs/staging/MOD-19272-ids-subchart-docs/operate/iris/agent-memory/self-managed/
https://redis.io/docs/staging/MOD-19272-ids-subchart-docs/operate/iris/agent-memory/self-managed/authentication/
https://redis.io/docs/staging/MOD-19272-ids-subchart-docs/operate/iris/agent-memory/self-managed/configuration/
https://redis.io/docs/staging/MOD-19272-ids-subchart-docs/operate/iris/agent-memory/self-managed/deploy/
https://redis.io/docs/staging/MOD-19272-ids-subchart-docs/operate/iris/agent-memory/self-managed/operations/
https://redis.io/docs/staging/MOD-19272-ids-subchart-docs/operate/iris/agent-memory/self-managed/prerequisites/
https://redis.io/docs/staging/MOD-19272-ids-subchart-docs/operate/iris/agent-memory/self-managed/reference/

[github-actions]

🧠 Redis Memory

Found 9 related items from repository history:

• PR — MOD-18825: Correct Iris self-managed docs for RAM 0.7.0 and LangCache 0.0.1

  Ticket: MOD-18825 · Control Plane OpenAPI text: [redislabsdev/iris#1648](https://github.

• PR — docs(iris): document both https endpoints for the RAM FIPS posture

  **Hold until the Agent Memory chart release that includes redislabsdev/iris#1606 is publis

• PR — MOD-17747: Add self-managed LangCache documentation

  Summary

• PR — WIP: Playbook self-managed operator docs

  MOD-19679 — Self-managed Redis Agent Playbooks operator documentation.

• Commit — MOD-17747: Fix chart-value and naming bugs found by content review

  MOD-17747: Fix chart-value and naming bugs found by content review

• Commit — docs(iris): MOD-19272 Agent Memory self-managed docs for the iris-identity-service subchart

  docs(iris): MOD-19272 Agent Memory self-managed docs for the iris-identity-service subchart

• PR — MOD-18528: Document Playbook bindings and RAM service-subject authentication

  Summary

• Commit — MOD-17747: Fix issues found by content review

  MOD-17747: Fix issues found by content review

• PR — MOD-17305 Document custom memory types in Redis Cloud console

  Description

Memory updated at 8c0a67b

[teoparvanov]

Could we recommend just noeviction in the Job Redis paragraph below (lines 76–77)? volatile-ttl evicts keys with an expiry under memory pressure, so it is not a non-evicting policy. Using noeviction would also keep this consistent with the Job Redis guidance on the Operations page. Redis eviction policies.