IRIS-NG-v1.1.1: retarget from the never-tagged v1.1.0, document the advisories
v1.1.0 was staged on main but never tagged, so every reference to it as the
release a change shipped in was wrong. Retargeted across AI-Features,
Dependency-Policy, IOC-Correlation, Changelog and Kubernetes.
Changelog gains the two UI dependency advisories cleared in v1.1.1
(brace-expansion, socket.io-parser) and links the release.
Kubernetes: chart 0.5.1, appVersion IRIS-NG-v1.1.1, pull commands updated.
Correlation scoring rewrite, AI troubleshooting, dependency policy
Changelog: adds IRIS-NG-v1.0.2, and IRIS-NG-v1.1.0 marked pending release.
Records that IRIS-NG-v1.0.3 was never released — the version was staged on
main but no tag, release or images were produced, so nothing shipped under
that number and its changes land in v1.1.0.
IOC Correlation: the scoring sections described algorithms that no longer
match the code, and the how-it-works step repeated a misconception the
control's own label encouraged — that "Min shared IOCs" counts cases an
indicator appears in. It counts indicators a case PAIR must share. Rewritten
to state that plainly, with the consequence spelled out: an indicator's fate
is decided by its neighbours, not by itself, so two indicators each present
in exactly two cases can be treated differently.
Decay and confidence rewritten to match what ships in v1.1.0 — tags scale
the half-life rather than the score, age comes from the most recent sighting,
TLP no longer participates, and confidence weighs rarity and credibility
rather than counting indicators. Flags that figures will read lower than
earlier releases, which is a real change analysts will notice.
AI Features: per-surface timeout table replacing the stale 60-90s note, plus
a Troubleshooting section covering the three failures that are hard to tell
apart — an unrecognised model identifier, a model declining security content,
and a timeout — since before v1.1.0 all three displayed the same JSON parse
error.
New Dependency Policy page: why PostgreSQL, jQuery, Node, marshmallow and the
report generator stack are held back, and how to verify a dependency change.
A green build is not evidence a Python upgrade worked; the pkg_resources case
is the reference example, where the image builds cleanly and the application
dies at startup.
IRIS-NG-v1.0.1: chart image tags follow appVersion
The chart attached to IRIS-NG-v1.0.0 was labelled appVersion IRIS-NG-v1.0.0 but
pinned the previous release's images, so installing from that asset deployed
v2.5.0-beta.1+iris-ng.7 without the Sponsor tab or IOC History. An ordering
trap, not a slip: a release's images do not exist until its tag has built, so
hardcoded pins can only be corrected after tagging.
Kubernetes page now documents that the chart does not pin, with a warning about
the v1.0.0 asset. Changelog gains the v1.0.1 row.
Version scheme IRIS-NG-v1.0.0; document the Sponsor tab and IOC history
Changelog: version-scheme section rewritten for IRIS-NG-v<x.y.z>, stating
plainly that the string is not SemVer-parseable and that 1.0.0 sorts below
every prior release, and that the upstream compatibility range moved to
Settings -> System rather than disappearing. The older +iris-ng.<build> scheme
is kept as a note since those releases are still published. New v1.0.0 row.
Kubernetes: chart 0.3.1 / appVersion IRIS-NG-v1.0.0, image tags repointed to
the IRIS-NG-v1.0.0 images now that they exist, and the "+ becomes -" note
reframed as applying to the older scheme only.
Home: Sponsor tab and IOC history added to the feature list.
Kubernetes: deploy-tested on kind — add Test results, correct a wrong claim
Installed chart 0.2.0 on kind (Kubernetes 1.34, single node) with shipped
defaults: 5/5 pods Running, PVC bound, 95 tables with Alembic at head, HTTP 200
on /login locally and cross-pod, ai_worker bound to ai_queue at concurrency 1,
and pg_hba showing scram-sha-256 while the app authenticates — which is only
possible because the POSTGRES_PASSWORDD typo is fixed.
Also corrects the TLS-material section. It claimed empty cert Secrets leave pods
stuck in ContainerCreating; the live test showed that is wrong. Pods start and
the app serves fine, but the subPath mount produces an empty directory where the
CA file should be, so the breakage is silent rather than loud. Defaulting
certificates.enabled to false is still right, for a different reason.
Single-node only: node rescheduling, a real CSI driver and a cloud load balancer
are untested.
Kubernetes: chart 0.2.0 brought forward — rewrite the page around it
The two documented gaps are fixed in the chart, plus two more found while
working on it, so the page no longer reads as a list of things to work around.
- images, ai_worker and placeholder values are handled by the chart's defaults
- persistence section: the chart previously hardcoded a hostPath PV with
ReadWriteMany, which loses the database on reschedule and is unsupported by
most block-storage CSI drivers; now requests the cluster default StorageClass
- database auth: POSTGRES_HOST_AUTH_METHOD was hardcoded to trust
- new "What you must change" (hostname, secrets, size) and "Known gaps"
sections, including that the chart is not deploy-tested on a live cluster
Kubernetes: images are published now — three gaps become two
v2.5.0-beta.1+iris-ng.7 published iriswebapp_{app,db,nginx} to GHCR, so the
build-your-own-images prerequisite is gone. Replaces it with pull commands, a
values.yaml snippet pointing at the published images, and a note that the Docker
tag uses a dash where the version uses a plus.
Kubernetes: drop the paying-customer clause from the referral note
Add Kubernetes page with DigitalOcean referral; link from Home and Getting Started
The Helm chart at deploy/kubernetes exists but is inherited from upstream and
is not deployable as committed. The page documents the three gaps rather than
implying a working one-command install:
- no images are published (the ghcr workflows fire only on a v*.*.* tag, and
no container packages currently exist), so users must build and push first
- values.yaml ships literal placeholders (<irisapp_image>, <host_name>, ...)
- the chart has no ai_worker, so AI summary and chat jobs enqueue and are
never consumed -- a silent failure, not an error
Also covers installing, persistence, sizing, and points at Docker Compose on a
single host as the tested path for evaluation. The DigitalOcean link is
disclosed as a referral link at both the wiki and README.