Skip to content

Iris: fix the Memory agent-key default and add Intent operator OIDC #4574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mich-elle-luna merged 1 commit into from
Nov 13, 2026
Merged

Iris: fix the Memory agent-key default and add Intent operator OIDC #4574

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion content/operate/iris/agent-memory/self-managed/authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ does not require a Control Plane redeploy.

## Data Plane auth modes

The Data Plane defaults to agent-key authentication whenever no auth method is set.
The Data Plane defaults to agent-key authentication only when the configuration sets no auth method. It also must enable no other auth provider, such as OIDC or worker identity. Set `auth.method: agent_key` explicitly, so that the security posture is visible in review.

### Agent-key authentication

Expand Down
17 changes: 14 additions & 3 deletions content/operate/iris/intent-router/self-managed/authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,13 +11,14 @@ weight: 60
hideListLinks: true
---

Self-managed Intent Router uses two kinds of credentials. Service tokens authenticate operators and the Intent Router components to each other. The `redis-iris` suite generates them for you. Agent keys authenticate applications to the data plane, and each key's grants control which Routers it can use and what it can do on them.
Self-managed Intent Router uses three kinds of credentials. Service tokens authenticate operators and the Intent Router components to each other. The `redis-iris` suite generates them for you. Operator access tokens from your identity provider (IdP) authenticate operators to the control plane when you configure OpenID Connect (OIDC). Agent keys authenticate applications to the data plane, and each key's grants control which Routers it can use and what it can do on them.

## Credentials

| Credential | Who presents it to whom | Secret / key | What it unlocks |
| --- | --- | --- | --- |
| Control-plane admin token | Operator → control plane (`:9400`) | `iris-intent-admin-token` / `token` | Router administration: `/iris/v1/intent/routers` and `/iris/v1/intent/models` |
| Operator access token | Operator → control plane (`:9400`) | None. Your IdP issues it | Router administration, as the operator's Iris role allows |
| Control-plane internal token | Identity Service → control plane | `iris-intent-internal-token` / `intent` | Checking that the Router in a grant exists |
| Identity Service control token | Operator → Identity Service (`:9200`) | `iris-identity-service-control-token` / `token` | Creating, listing, rotating, and revoking agent keys |
| Data-plane runtime credential | Data plane → Identity Service | `iris-intent-dataplane-credential` / `intent-dp` | Checking agent keys for `intent` |
Expand All @@ -29,9 +30,19 @@ An agent key gets `401` from the control plane. A key without a grant on a Route

## Load the administration tokens

Every Router operation needs the admin token in `Authorization: Bearer <token>`, and every agent-key operation needs the Identity Service control token. The health routes need no credential.
Every Router operation needs a control-plane credential in `Authorization: Bearer <token>`: the admin token, or an operator access token when you configure OIDC. Every agent-key operation needs the Identity Service control token. The health routes need no credential.

Load both from their Secrets before you call the control plane or the Identity Service:
The suite configures control-plane OIDC from `global.iris.auth.oidc`, and it maps IdP groups to Iris roles with `global.iris.auth.roleBindings` and the product `intent`. See [Write `iris-values.yaml`](/content/operate/iris/self-managed/_index.md#3-write-iris-valuesyaml). An operator access token gives only the access of its role:

| Role | What it allows |
| --- | --- |
| `viewer` | List the models, and list and read Routers. |
| `operator` | Also create and change Routers. |
| `product_admin`, `suite_admin` | Also delete Routers. |

The admin token allows every Router operation. Without OIDC, use the admin token, as [Admin token mode](/content/operate/iris/self-managed/_index.md#admin-token-mode) describes.

Load the admin token and the Identity Service control token from their Secrets before you call the control plane or the Identity Service:

```bash
export IRIS_INTENT_ROUTER_SERVICE_TOKEN="$(kubectl -n <namespace-name> get secret \
Expand Down
Loading