chore: sync redis-agent-memory chart 0.7.0

ai/charts/redis-agent-memory/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: redis-iris-onprem-lib
+  repository: https://helm.redis.io/ai
+  version: 0.1.0
+digest: sha256:a059a4962d0d7b96562cc79d6686cbe28be0adf05abe7bf0889b1f6edb91463c
+generated: "2026-09-09T15:04:24.73905+03:00"

ai/charts/redis-agent-memory/Chart.yaml

@@ -2,5 +2,13 @@ apiVersion: v2
 name: redis-agent-memory
 description: Helm chart to deploy Redis Agent Memory for on-premises deployment.
 type: application
-version: 0.6.0
-appVersion: "0.6.0"
+# 0.0.14: breaking config change — llm endpoint settings moved from the
+# strategy llm blocks into the root inference_providers registry, which also
+# holds http_client defaults that a block can override per field. See
+# "Migrating to inference_providers" in the README.
+version: 0.7.0
+appVersion: "0.7.0"
+dependencies:
+  - name: redis-iris-onprem-lib
+    version: 0.1.0
+    repository: https://helm.redis.io/ai

ai/charts/redis-agent-memory/examples/basic/secret-overlay.example.yaml

@@ -4,8 +4,8 @@
 # deep-merges over the rendered config at runtime, holding everything secret in
 # one document: the embedder/LLM API keys AND the full Redis connection strings
 # (credentials live INSIDE the URL). Its keys mirror the config's own snake_case
-# paths; metadata.stores uses the same store id as values.yaml, so `urls` merge
-# into that store.
+# paths. The same metadata and database URLs are consumed by the data plane and
+# bundled control plane.
 #
 # Create the Secret from this file:
 #   kubectl create secret generic ram-secrets \
@@ -15,10 +15,12 @@ embedders_connection_details:
     credentials:
       api_key: sk-REPLACE-ME
 metadata:
-  stores:
-    "00000000000000000000000000000001":
-      urls:
-        - redis://user:pass@redis-store:6379
+  urls:
+    - redis://user:pass@redis-metadata:6379
+databases:
+  "1":
+    urls:
+      - redis://user:pass@redis-store:6379
 background_jobs:
   redis:
     urls:

ai/charts/redis-agent-memory/examples/basic/values.yaml

@@ -1,6 +1,6 @@
 # Redis Agent Memory — default deployment values.
 #
-# One server + one worker serving a static store. The chart renders the
+# One bundled control plane + server + worker deployment. The chart renders the
 # structural config into a ConfigMap; one pre-created Secret supplies the
 # credentials (Redis connection URLs + embedder/LLM API keys) through a mounted
 # overlay, so nothing secret lives in this file.
@@ -9,8 +9,21 @@
 #      kubectl create secret generic ram-license --from-file=license=./license
 #      kubectl create secret generic ram-secrets \
 #        --from-file=overlay.yaml=./secret-overlay.example.yaml
-# 2. Install:
-#      helm install ram ../.. -f values.yaml --set image.tag=<RAM_VERSION>
+# 2. Create the Identity Service metadata Secret. IdS keeps its agent-key
+#    records in its own overlay Secret rather than reading the data plane's, so
+#    give it the same URL you put under `metadata.urls` in
+#    secret-overlay.example.yaml. Put it in the environment first so the
+#    credential -- which lives inside the URL -- never lands in your shell
+#    history:
+#      read -rs RAM_IDS_METADATA_URL
+#      kubectl create secret generic ram-ids-metadata \
+#        --from-literal=metadata.yaml="metadata:
+#          urls: [$RAM_IDS_METADATA_URL]"
+# 3. Install. The Identity Service is versioned independently of RAM, so its
+#    tag is set separately:
+#      helm install ram ../.. -f values.yaml --set image.tag=<RAM_VERSION> \
+#        --set controlplane.image.tag=<RAM_VERSION> \
+#        --set identityService.image.tag=<IDS_VERSION>
 #
 # See secret-overlay.example.yaml in this directory for the overlay contents.
 
@@ -31,20 +44,31 @@ config:
 secrets:
   secretName: ram-secrets
 
-# Blocks shared by the data plane (and control plane, if enabled). Structure only.
+# Blocks shared by the data plane and bundled control plane. Structure only.
 shared:
-  embedders_connection_details:
-    openai:
-      base_url: https://api.openai.com
-      credentials:
-        # api_key arrives via the overlay — not stored here.
-        type: static
+  databases:
+    "1":
+      name: default
 
 # Data-plane config body (snake_case). Structure only — no URLs, no API keys.
 memory:
   default_extraction_strategy: instruct
+  # This starter keeps the Data Plane behind an infrastructure access boundary.
+  # Before exposing it, use agent_key auth and configure worker identity as
+  # described in the on-prem guide.
   auth:
     method: none
+  embedders_connection_details:
+    openai:
+      base_url: https://api.openai.com
+      credentials:
+        # api_key arrives via the overlay — not stored here.
+        type: static
+  embedding:
+    provider: openai
+    models:
+      default_embedding_model: text-embedding-3-large
+      dimensions: 3072
   background_jobs:
     redis:
       enabled: true
@@ -56,22 +80,46 @@ memory:
         - default
   request_region:
     default: default
+  dataplane_client:
+    base_url: http://ram-redis-agent-memory:9000
+    auth:
+      disabled: true
+
+# Suite-level API-key service. Enabled by default: it is what issues and
+# introspects the agent keys `memory.auth.method: agent_key` accepts. This
+# starter runs with `auth.method: none` behind an infrastructure boundary, so
+# nothing authenticates against IdS yet -- it is deployed so that turning
+# agent-key auth on later needs no re-plumbing. Set `enabled: false` to drop it
+# (and with it any agent-key authority).
+identityService:
+  image:
+    repository: redislabs/iris-identity-service
+    # tag is supplied at install time: --set identityService.image.tag=<IDS_VERSION>
   metadata:
-    source: static
-    # stores is a MAP keyed by store id. The store's structure lives here; its
-    # `urls` arrive from the overlay, merged into the same id at runtime.
-    stores:
-      "00000000000000000000000000000001":
-        short_memory:
-          ttl_seconds: 86400
-        long_term_memory:
-          embedding_provider: openai
-          embedding_model: text-embedding-3-large
-          embedding_dimensions: 3072
+    # Pre-created Secret holding the IdS metadata Redis connection (step 2).
+    existingSecret: ram-ids-metadata
+
+controlplane:
+  image:
+    repository: redislabs/agent-memory-control-plane
+  config:
+    render: true
+  configData:
+    profile: prod
+    auth:
+      type: admin-token
+      admin_token:
+        token_file: /etc/controlplane-onprem/admin/token
+      internal_token:
+        token_file: /etc/controlplane-onprem/internal/token
+    license:
+      license_path: /etc/redis-agent-memory/license
+    embedding:
+      dimensions: 3072
 
 # Expose the API through an ingress host (optional).
 ingress:
-  enabled: true
+  enabled: false
   hosts:
     - host: memory.example.com
       paths:

ai/charts/redis-agent-memory/examples/multi-region/base-values.yaml

@@ -3,8 +3,10 @@
 # Holds everything identical across regions. Deploy one release per region,
 # combining this file with a small per-region file:
 #
-#   helm install ram-eu ../.. -f base-values.yaml -f region-eu.yaml --set image.tag=<RAM_VERSION>
-#   helm install ram-us ../.. -f base-values.yaml -f region-us.yaml --set image.tag=<RAM_VERSION>
+#   helm install ram-eu ../.. -f base-values.yaml -f region-eu.yaml \
+#     --set image.tag=<RAM_VERSION> --set controlplane.image.tag=<RAM_VERSION>
+#   helm install ram-us ../.. -f base-values.yaml -f region-us.yaml \
+#     --set image.tag=<RAM_VERSION> --set controlplane.image.tag=<RAM_VERSION>
 #
 # Helm deep-merges base + region, so each region file carries only its non-secret
 # deltas (region id, worker_regions, ingress host) — see region-*.yaml.
@@ -29,21 +31,31 @@ config:
 # region-<x>.yaml), since each region's Secret carries that region's own Redis
 # URLs. Nothing secret-related belongs in this shared base file.
 
-# Blocks common to data plane (and control plane, if enabled). Structure only.
+# Blocks common to the data plane and bundled control plane. Structure only.
 shared:
-  embedders_connection_details:
-    openai:
-      base_url: https://api.openai.com
-      credentials:
-        # api_key arrives via the shared secret overlay — not stored here.
-        type: static
+  databases:
+    "1":
+      name: default
 
 # Data-plane config body (snake_case). Region files override the region-identity
 # fields only; everything here is the stable, non-secret default.
 memory:
   default_extraction_strategy: instruct
+  # This starter assumes infrastructure-controlled access in each region.
+  # Before enabling ingress, use agent_key auth and configure worker identity.
   auth:
     method: none
+  embedders_connection_details:
+    openai:
+      base_url: https://api.openai.com
+      credentials:
+        # api_key arrives via the regional secret overlay — not stored here.
+        type: static
+  embedding:
+    provider: openai
+    models:
+      default_embedding_model: text-embedding-3-large
+      dimensions: 3072
   client_pool:
     enable: true
     max_size: 1000
@@ -63,18 +75,44 @@ memory:
         completed_retention: 1h
         requeue_without_retry_delay: 5s
         shutdown_timeout: 30s
-  metadata:
-    source: static
-    # stores is a MAP keyed by store id (NOT a list). The store's non-secret
-    # structure lives here; its `urls` arrive from the regional secret overlay,
-    # which the loader deep-merges into the same id at runtime. Helm also
-    # deep-merges maps, so a region file could set structure per id — but here
-    # only the urls differ per region, and those are in the overlay.
-    stores:
-      "00000000000000000000000000000001":
-        short_memory:
-          ttl_seconds: 86400
-        long_term_memory:
-          embedding_provider: openai
-          embedding_model: text-embedding-3-large
-          embedding_dimensions: 3072
+  dataplane_client:
+    auth:
+      disabled: true
+
+# On the Identity Service (no settings needed here, hence no stanza):
+#
+# IdS is the authority for agent keys and the chart runs it by default, so it
+# comes up in every region without this file asking for it. That holds even
+# though the starter sets `memory.auth.method: none` (infrastructure-controlled
+# access, see above) and nothing introspects yet — running IdS from the start is
+# what lets a region mint keys and flip its data plane to agent-key auth without
+# a second deployment step. Set `identityService.enabled: false` only to point
+# the region at an Identity Service this chart does not own, and then write
+# `memory.auth.agent_keys.introspection` yourself.
+#
+# Running it makes two inputs mandatory, and both are set elsewhere. The image
+# tag goes on the install command line, next to the RAM ones, because IdS is
+# versioned separately:
+#
+#   --set identityService.image.tag=<IDS_VERSION>
+#
+# The metadata Secret is per-region, for the same reason each region names its
+# own credentials Secret, so it lives in region-eu.yaml / region-us.yaml.
+
+controlplane:
+  image:
+    repository: redislabs/agent-memory-control-plane
+  config:
+    render: true
+  configData:
+    profile: prod
+    auth:
+      type: admin-token
+      admin_token:
+        token_file: /etc/controlplane-onprem/admin/token
+      internal_token:
+        token_file: /etc/controlplane-onprem/internal/token
+    license:
+      license_path: /etc/redis-agent-memory/license
+    embedding:
+      dimensions: 3072

ai/charts/redis-agent-memory/examples/multi-region/region-eu.secret-overlay.example.yaml

@@ -14,17 +14,18 @@
 # /etc/ai/overlays/0/overlay.yaml and passes it to the binary as a --config arg
 # after the base config. The shared API keys are duplicated here per region (we
 # keep few, so this is simpler than a separate shared Secret). The keys mirror the
-# config's own snake_case paths; metadata.stores is a map keyed by the same store
-# id used in base-values.yaml, so `urls` merges into that store's structure per id.
+# config's own snake_case paths.
 embedders_connection_details:
   openai:
     credentials:
       api_key: sk-REPLACE-ME
 metadata:
-  stores:
-    "00000000000000000000000000000001":
-      urls:
-        - redis://user:pass@redis-store-eu.internal:6379
+  urls:
+    - redis://user:pass@redis-metadata-eu.internal:6379
+databases:
+  "1":
+    urls:
+      - redis://user:pass@redis-store-eu.internal:6379
 background_jobs:
   redis:
     urls:

ai/charts/redis-agent-memory/examples/multi-region/region-eu.yaml

@@ -1,6 +1,8 @@
 # EU region overrides. Merged on top of base-values.yaml.
 #
-#   helm install ram-eu ../.. -f base-values.yaml -f region-eu.yaml --set image.tag=<VER>
+#   helm install ram-eu ../.. -f base-values.yaml -f region-eu.yaml \
+#     --set image.tag=<VER> --set controlplane.image.tag=<VER> \
+#     --set identityService.image.tag=<IDS_VER>
 #
 # Only the non-secret regional deltas live here: the region identity, the
 # regions this deployment owns, and the ingress host. The API keys and Redis
@@ -11,7 +13,24 @@ secrets:
   # in one overlay document, mounted and merged over the base config at runtime.
   secretName: ram-eu-secrets
 
+identityService:
+  metadata:
+    # The Identity Service keeps its agent-key records in this region's metadata
+    # Redis, and reads the connection string from its own overlay Secret rather
+    # than from the data plane's. Use the same URL as `metadata.urls` in
+    # region-eu.secret-overlay.example.yaml, under the key the chart mounts.
+    # Put it in the environment first so the credential -- which lives inside the
+    # URL -- never lands in your shell history:
+    #
+    #   read -rs RAM_EU_IDS_METADATA_URL
+    #   kubectl create secret generic ram-eu-ids-metadata \
+    #     --from-literal=metadata.yaml="metadata:
+    #       urls: [$RAM_EU_IDS_METADATA_URL]"
+    existingSecret: ram-eu-ids-metadata
+
 memory:
+  dataplane_client:
+    base_url: http://ram-eu-redis-agent-memory:9000
   request_region:
     default: eu1
   background_jobs:
@@ -21,7 +40,8 @@ memory:
         - eu1
 
 ingress:
-  enabled: true
+  # Enable only after configuring Data Plane auth or an authenticated gateway.
+  enabled: false
   hosts:
     - host: memory-eu.example.com
       paths:

ai/charts/redis-agent-memory/examples/multi-region/region-us.secret-overlay.example.yaml

@@ -18,10 +18,12 @@ embedders_connection_details:
     credentials:
       api_key: sk-REPLACE-ME
 metadata:
-  stores:
-    "00000000000000000000000000000001":
-      urls:
-        - redis://user:pass@redis-store-us.internal:6379
+  urls:
+    - redis://user:pass@redis-metadata-us.internal:6379
+databases:
+  "1":
+    urls:
+      - redis://user:pass@redis-store-us.internal:6379
 background_jobs:
   redis:
     urls: