[plamilieva]

Adds a "Tenancy and identity provider limits" section to the suite page, on top of #4520.

A redis-iris release has one tenant, one issuer, and one audience, all taken from global.iris. The section lists the service values that fail the render when they differ, and the Not supported row now links to it.

Each failure was reproduced with helm template against the 1.0.0 chart: a product tenantId, tenant_id_claim, a different static_tenant_id, role_mappings, issuer, jwks_uri, and audience.

Not covered: multi-tenant mode in the standalone charts, which the docs don't support as installs and the Identity Service page marks as undecided.

The docs build isn't run.

Also fixes the CLI check step (step 7 of the install): it needs .env.admin loaded as well as .env. I ran the CLI steps against a local suite release: create and all five check hops pass once both files are loaded.

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only changes to install guidance; no product code or deployment behavior changes.

Overview
Updates the self-managed Iris suite install guide with clearer single-tenant / single-IdP constraints and a small CLI verification fix.

Adds Tenancy and identity provider limits, explaining that each redis-iris release pins one tenant, OIDC issuer, and token audience via global.iris, and that per-service values that override those settings fail Helm render (with a table of forbidden fields). It also notes that another namespace/release is required for a second tenant, and that cross-tenant rejection checks don’t apply to the suite.

Step 7 of the iris CLI flow now documents loading both .env.admin and .env before iris agent-memory service check, since the check needs admin and store settings.

The Not supported table row for multi-tenant installs is expanded to issuer/audience and links to the new section.

^{Reviewed by Cursor Bugbot for commit debb5ba. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.

[github-actions]

Staging links:
https://redis.io/docs/staging/docs/iris-suite-tenancy-limits/operate/iris/self-managed/

[github-actions]

🧠 Redis Memory

Found 7 related items from repository history (2 new this commit):

• PR — Iris docs: suite install gaps from local kind testing

  Fills the gaps Plamena Ilieva hit installing the redis-iris 1.0.0 suite on a local kind cluster (Apple silicon). I checked each item again

• Commit — Iris self-managed docs: make the redis-iris suite chart the one install

  Iris self-managed docs: make the redis-iris suite chart the one install

• PR — Iris self-managed docs: align with the redis-iris global Helm chart release

  Iris self-managed docs: align with the global Helm chart release

• PR — Iris docs: Identity Service self-managed guide for the redis-iris suite chart

  This PR updates the public Identity Service docs to match the on-prem operator guide in redislabsdev/iris (`docs/iris-onprem-identity-servic

• Commit — Iris docs: suite install gaps from local kind testing

  Iris docs: suite install gaps from local kind testing

• Commit — Iris docs: state the suite's one-tenant, one-issuer, one-audience limits 🆕

  Iris docs: state the suite's one-tenant, one-issuer, one-audience limits

• Commit — Iris self-managed docs: align with the redis-iris global Helm chart release 🆕

  Iris self-managed docs: align with the redis-iris global Helm chart release

Memory updated at debb5ba