MOD-19813: Document Memory 0.8.0 with a standalone Identity Service

content/operate/iris/agent-memory/self-managed/_index.md

@@ -31,15 +31,18 @@ documents the self-managed admin endpoints for stores.
 
 ## What you are deploying
 
-The chart always deploys the Data Plane, the workers, the Control Plane, and the Identity Service.
-You provide the Redis databases.
+The `redis-agent-memory` chart `0.8.0` deploys the Data Plane, workers, and Control Plane.
+Install the `iris-identity-service` chart `0.10.0` as a separate release first, then connect
+Memory to it. Memory does not deploy Identity Service resources or include it as a subchart.
+You provide the Redis databases. Follow [Deploy](/content/operate/iris/agent-memory/self-managed/deploy.md)
+to configure both releases.
 
 | Component | Purpose | Default service |
 | --- | --- | --- |
 | Redis Agent Memory Data Plane | Store-scoped runtime memory API. | `redis-agent-memory:9000` |
 | Redis Agent Memory worker | Background promotion, summarization, and forgetting work. | No public service |
 | Redis Agent Memory Control Plane | Admin API for creating and managing stores. | `redis-agent-memory-controlplane:9100` |
-| Identity Service | Mints, rotates, revokes, and checks agent keys. | `redis-agent-memory-identity-service:9200` |
+| Identity Service (separate release) | Mints, rotates, revokes, and checks agent keys. | `ids-iris-identity-service:9200` for release `ids` |
 | Store Redis | Holds session memory, long-term memory, indexes, and TTL data. | Customer-provided |
 | Job Redis | Holds background work for Redis Agent Memory workers. | Customer-provided |
 | Metadata Redis | Holds Control Plane store records. The Identity Service keeps agent-key records in the Metadata Redis named in its own metadata Secret. | Customer-provided |
@@ -66,8 +69,8 @@ and the Identity Service handles agent keys.
 
 ### API surfaces
 
-All Data Plane APIs except `/health` are scoped to a store. A store is the logical isolation
-boundary for memory data.
+Memory data APIs are scoped to a store, the logical isolation boundary for memory data.
+Service liveness and readiness endpoints are not store-scoped.
 
 When agent-key authentication is enabled, the grants on each agent key determine which stores and
 actions the key can access.
@@ -79,7 +82,7 @@ actions the key can access.
 | Namespaces | `/v1/stores/{storeId}/namespaces` | Namespace resources within a store. |
 | Model Context Protocol (MCP) | `/v1/stores/{storeId}/mcp` | The MCP streamable-HTTP endpoint for a store. |
 | Store health | `/v1/stores/{storeId}/health` | Read-only health for store-scoped features. |
-| Service health | `/health` | Operational status of the Data Plane. |
+| Service health | `/health/liveness`, `/health/readiness` | Process liveness and readiness to serve requests; neither requires an agent key. |
 | Control Plane | `/v1/stores`, `/v1/detectors` | Self-managed administration for stores, and the catalog of built-in sensitive-data detectors. |
 | Identity Service | `/v1/api-keys` | Self-managed administration for agent keys. |
 

content/operate/iris/agent-memory/self-managed/authentication.md

@@ -25,13 +25,15 @@ grants.
 | Credential | Who presents it to whom | Secret / key | Auto-generated? | What it unlocks |
 | --- | --- | --- | --- | --- |
 | Control Plane admin token | Operator → Control Plane (`:9100`) | `redis-agent-memory-controlplane-admin-token` / `token` | Yes (`controlplane.adminToken.autoGenerate`) | Store management: `/v1/stores`, `/v1/detectors` |
-| Control Plane internal token | Identity Service → Control Plane | `redis-agent-memory-controlplane-internal-token` / `token` | Yes (`controlplane.internalToken.autoGenerate`) | Checking that the store in a grant exists. Chart-managed; you handle it only with bring-your-own (BYO) configuration |
-| Identity Service control token | Operator → Identity Service (`:9200`) | `redis-agent-memory-identity-service-control-token` / `token` | Yes (`identityService.controlToken.autoGenerate`) | Creating, listing, updating, rotating and revoking agent keys |
-| Data Plane service credential | Data Plane → Identity Service | `redis-agent-memory-identity-service-runtime-memory-dp` / `token` | Yes (`identityService.runtime.serviceCredentials`) | Checking agent keys for `memory`. Chart-managed; you handle it only with bring-your-own (BYO) configuration |
+| Control Plane internal token | Identity Service → Control Plane | `memory-internal-token` / `token` in the walkthrough | You provision it for both releases | Checking that the store in a grant exists. Set `controlplane.internalToken.existingSecret` on Memory and `productValidation.products.memory.credential.existingSecret` on Identity Service. |
+| Identity Service control token | Operator → Identity Service (`:9200`) | `ids-control-token` / `token` in the walkthrough | Supplied through `control.existingSecret` on Identity Service; that chart can also generate one | Creating, listing, updating, rotating and revoking agent keys |
+| Data Plane service credential | Data Plane → Identity Service | `memory-dp-credential` / `token` in the walkthrough | You provision it for both releases | Checking agent keys for `memory`. Set `identityService.credential.existingSecret` on Memory and register it in `runtime.serviceCredentials[]` on Identity Service. |
 | Agent key | Application → Data Plane (`:9000`) | None; returned once when minted or rotated | No | The Data Plane operations its grants allow |
 
-Each generated Secret keeps its value across upgrades (`helm.sh/resource-policy: keep`). To bring
-your own, set `existingSecret` on the matching value.
+Generated token Secrets are retained across upgrades and uninstalls (`helm.sh/resource-policy: keep`).
+Use existing Secrets for shared credentials and for reproducible deployment automation.
+Secret names and keys must agree between releases. See
+[Secret rotation](/content/operate/iris/agent-memory/self-managed/operations.md#secret-rotation).
 
 ## Control Plane admin token
 
@@ -63,7 +65,8 @@ The Data Plane defaults to agent-key authentication whenever no auth method is s
 
 The [`deploy` walkthrough](/content/operate/iris/agent-memory/self-managed/deploy.md) uses agent-key
 authentication from the start. In the chart-rendered configuration, the chart writes the agent-key
-introspection settings for you, so you add nothing more.
+introspection settings from `dataplane.identityServiceBaseURL` and `identityService.credential`.
+These must point to the standalone release and its registered `memory-dp` credential.
 
 A bring-your-own (BYO) Data Plane configuration needs the `auth.agent_keys.introspection` block,
 including a BYO configuration without `auth`. See
@@ -83,10 +86,16 @@ Treat agent keys as opaque credentials. Do not parse their contents.
 Use auth-disabled mode for development and testing only:
 
 ```yaml
+profile: dev
 auth:
   method: none
 ```
 
+These are application configuration fields; put them under `memory` in Helm values.
+The Data Plane refuses `auth.method: none` unless `profile` is exactly `dev`.
+Chart-rendered configuration fails to render otherwise. With a supplied configuration Secret,
+the same rule is enforced at process startup.
+
 > [!WARNING]
 > Do not expose an auth-disabled Data Plane to untrusted callers. In auth-disabled
 > mode, Redis Agent Memory does not authenticate or authorize Data Plane requests; any
@@ -116,7 +125,11 @@ A grant names the tenant, product, store, and actions:
 }
 ```
 
-Use the same tenant on every grant of a key. Any string is accepted. Use `1` if you manage stores with the Control Plane admin token.
+Use the installation's tenant on every grant, for example `default`. Set Memory's `tenantId`
+and Identity Service's `runtime.apiKeyTenant.singleTenantID` to that same value. With a rendered
+Control Plane configuration, `tenantId` sets `auth.admin_tenant_id`, so admin-token stores belong
+to that tenant too. With a supplied Control Plane configuration Secret, set `auth.admin_tenant_id`
+yourself. Neither release checks the other release's tenant setting.
 
 Grant actions:
 

content/operate/iris/agent-memory/self-managed/configuration.md

@@ -14,8 +14,9 @@ aliases:
 - /operate/iris/agent-memory/self-managed/data-plane-configuration/
 ---
 
-The chart renders the Data Plane, Control Plane, and Identity Service configuration from Helm values
-(`config.render: true`). Credentials stay out of the values, in the overlay Secret. For a complete
+The Memory chart renders Data Plane and Control Plane configuration from Helm values
+(`config.render: true` and `controlplane.config.render: true`). Identity Service uses its own
+release and `values-ids.yaml`. Credentials stay in existing Secrets. For a complete
 example, see the values in [step 3 of Deploy](/content/operate/iris/agent-memory/self-managed/deploy.md#3-create-ram-valuesyaml).
 
 To supply complete configuration files in your own Secrets instead, see
@@ -28,7 +29,8 @@ To supply complete configuration files in your own Secrets instead, see
 | `shared` | Settings common to the Data Plane and the Control Plane, such as `databases`. The chart merges them under `memory` and `controlplane.configData`. |
 | `memory` | The Data Plane and worker configuration file. |
 | `controlplane.configData` | The Control Plane configuration file. |
-| `identityService.*` | The Identity Service. `identityService.metadata.existingSecret` names the Secret with its Metadata Redis URL. |
+| `dataplane.identityServiceBaseURL`, `identityService.credential.*`, `identityService.allowInsecureTransport` | Memory's connection to the standalone Identity Service. These values do not configure that service. |
+| Separate `values-ids.yaml` | Identity Service's `metadata`, `control`, `runtime`, `productValidation`, and optional `subjectGrants` values. |
 | Overlay Secret (`secrets.secretName`, key `overlay.yaml`) | `metadata.urls`, `metadata.namespace`, `databases."1".urls`, `background_jobs.redis.urls`, and provider `api_key` values. The Data Plane, the workers, and the Control Plane all read it. |
 
 ## Data Plane settings
@@ -46,26 +48,43 @@ Data Plane settings go under `memory`, or at the top level of a BYO Data Plane c
 | `license.license_path` | Path where the license Secret is mounted. |
 | `request_region` | Region used for background work routing. |
 | `background_jobs.redis` | Job Redis connection used by background workers. |
+| `background_jobs.idempotency` | Enable execution idempotency and extraction serialization for production workers. Requires `enabled: true` and `urls`; it can share Job Redis. |
 | `embedders_connection_details` | Embedding provider endpoint and credentials. |
 | `dataplane_client` | Worker callback client configuration. |
 | `promote_session_memory` | Promotion strategy and LLM connection used by workers. |
 
 An `llm` block names its provider with `llm.provider`, which must match an `inference_providers`
 entry. The endpoint goes in `inference_providers.<name>.endpoint`, not in the `llm` block.
 
-In the chart-rendered configuration, the chart writes the agent-key introspection settings for you.
-Leave `auth.method` unset to keep the `agent_key` default.
+In the chart-rendered configuration, the chart writes the agent-key introspection settings for you:
+it owns `auth.agent_keys.introspection.base_url`, `credential`, and `allow_insecure_transport`, and
+refuses hand-set values in either `memory.auth` or `shared.auth`. Cache tuning under
+`auth.agent_keys.introspection.cache` is still allowed. Set `dataplane.identityServiceBaseURL`
+and `identityService.credential.existingSecret`; optional `secretKey` defaults to `token`, and
+`existingSecretChecksum` triggers a rollout after credential rotation. Set `memory.auth.method: agent_key`
+explicitly when combining agent keys with worker or other authentication methods.
+
+The runtime endpoint must use `https://`. An `http://` endpoint is accepted only when
+`identityService.allowInsecureTransport: true` is set and the FIPS profile is not enabled.
+Subjects using the `identity_service` authority also need this connection for grant lookup,
+even when another authentication method is selected.
 
 ## Bring-your-own (BYO) configuration
 
 With BYO configuration, you supply each complete configuration file in your own Secret, and the
 chart injects nothing into it. Add the keys the chart would otherwise write:
 
 - **Data Plane**: the `auth.agent_keys.introspection` block.
-- **Control Plane**: `auth.internal_token.token_file: /etc/controlplane-onprem/internal/token`.
+- **Control Plane**: `auth.internal_token.token_file: /etc/controlplane-onprem/internal/token`
+  and `auth.admin_tenant_id` matching the installation's tenant.
+
+With `config.existingSecret`, the chart does not inspect the supplied file. Rendering cannot
+catch missing introspection settings or an invalid development profile in that file; startup
+validation still applies. Connection Secrets must still be named in Helm values so they are mounted.
 
 The Data Plane defaults to `agent_key` whenever no auth method is set. A BYO Data Plane configuration
-without `auth` therefore needs the `auth.agent_keys.introspection` block, or `auth.method: none`.
+without `auth` therefore needs the `auth.agent_keys.introspection` block. For development only,
+`auth.method: none` requires exact `profile: dev`.
 The `MEM_AUTH_METHOD` environment variable overrides the method.
 
 ### Data Plane configuration file
@@ -85,6 +104,10 @@ request_region:
   default: eu1
 
 background_jobs:
+  idempotency:
+    enabled: true
+    urls:
+      - redis://<job-redis-host>:6379
   redis:
     enabled: true
     queue_prefix: ram
@@ -104,10 +127,10 @@ databases:
       - redis://<store-redis-host>:6379
 
 auth:
+  method: agent_key
   agent_keys:
     introspection:
-      base_url: http://redis-agent-memory-identity-service:9200
-      allow_insecure_transport: true
+      base_url: https://<identity-service-tls-endpoint>
       product: memory
       credential:
         token_file: /etc/identity-service/runtime/memory-dp/token
@@ -190,6 +213,7 @@ auth:
     token_file: /etc/controlplane-onprem/admin/token
   internal_token:
     token_file: /etc/controlplane-onprem/internal/token
+  admin_tenant_id: default
 
 license:
   license_path: /etc/redis-agent-memory/license
@@ -225,9 +249,43 @@ In `ram-values.yaml`, replace `config.render`, `shared`, `memory`, `controlplane
 `config.existingSecret` and `config.render` are set.
 
 ```yaml
+tenantId: default
 config:
   existingSecret: ram-config
+identityService:
+  credential:
+    existingSecret: memory-dp-credential
 controlplane:
+  internalToken:
+    existingSecret: memory-internal-token
   config:
     existingSecret: ram-controlplane-config
 ```
+
+## Connect releases across namespaces
+
+For another namespace, resolve the standalone Service using its full address, such as
+`ids-iris-identity-service.<identity-namespace>.svc:9200`, and the Memory Control Plane as
+`redis-agent-memory-controlplane.<memory-namespace>.svc:9100`. Configure their TLS frontends
+for the two connection URLs. With a naming override, use the rendered Service name.
+
+Pods can mount Secrets only from their own namespace. Provision the same runtime credential
+and internal token values in both namespaces, plus each namespace's trust bundle. Allow Memory
+to reach Identity Service and Identity Service to reach the Control Plane, including any
+TLS proxies. See [Network policy](/content/operate/iris/agent-memory/self-managed/operations.md#network-policy).
+
+## Optional Playbook extraction
+
+On the Identity Service release, allow Memory subject grants for Playbook extraction:
+
+```yaml
+subjectGrants:
+  allowed:
+    - product: memory
+      resourceType: mem-store
+      actions: [read, read_all_owners]
+```
+
+Also add `subject-grant-lookup` to the `memory-dp` runtime credential's `allowedOperations`
+alongside `api-key-introspect`. These are Identity Service values, not Memory's `identityService`
+values. `read_all_owners` is a subject-grant action; do not add it to agent-key grants.