iriswebapp-helm-repo

Incident Response Investigation System
Helm Chart for Kubernetes Deployment (App v2.4.26, Chart v0.2.4)
Official Documentation

IRIS Helm Chart — iris-webapp

License: Apache 2.0

This repository provides a Helm chart for deploying IRIS (Incident Response Investigation System) on Kubernetes.

IRIS is a collaborative DFIR platform designed to help incident responders share technical details during investigations, manage cases, and process indicators of compromise (IOCs) in a secure, scalable, cloud-native environment.

This chart deploys a full production stack including NGINX Ingress, PostgreSQL, RabbitMQ, the IRIS web application, and background workers.

Table of contents

Getting Started

The IRIS Helm chart deploys the platform as Kubernetes-native services:

This chart is suitable for local testing, staging, and production clusters.

Prerequisites

Add Helm Repository

helm repo add iris https://YOUR_HELM_REPO_URL
helm repo update

Verify the chart is available:

helm search repo iris

Install IRIS

Create a dedicated namespace:

kubectl create namespace iris

Install the chart:

helm install iris iris/iris-webapp \
  --namespace iris

Accessing IRIS

If Ingress is enabled, IRIS will be available at:

https://<your-domain>

Administrator Account

On first startup, IRIS automatically creates an administrator account.

Retrieve the generated password from the application logs:

kubectl logs -n iris deploy/iris-webapp-app | grep create_safe_admin

The password is printed only once during the initial startup.

Configuration

There are three supported configuration layers (in priority order):

  1. External secret managers (e.g., Azure Key Vault, HashiCorp Vault)
  2. Kubernetes Secrets / Environment Variables
  3. Configuration Files

If a setting is not found, IRIS falls back to the next available layer.

For all available configuration options, see:

https://docs.dfir-iris.org/operations/configuration/

Example Production Configuration

Create a file named values-prod.yaml:

ingress:
  enabled: true
  className: nginx
  hosts:
    - host: iris.company.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: iris-tls
      hosts:
        - iris.company.com

postgres:
  persistence:
    enabled: false

worker:
  replicaCount: 2

resources:
  app:
    limits:
      cpu: "1"
      memory: "2Gi"
    requests:
      cpu: "250m"
      memory: "512Mi"

Deploy using:

helm upgrade --install iris iris/iris-webapp \
  --namespace iris \
  -f values-prod.yaml

Architecture

alt text

Versioning

Starting from version 2.0.0, IRIS follows the Semantic Versioning 2.0 guidelines.

The Helm chart version tracks deployment and infrastructure changes, while appVersion reflects the IRIS application version.

Avoid using development branches or pre-release versions in production environments.

Documentation

A comprehensive documentation is available at:

https://docs.dfir-iris.org

Upgrades

Check available chart versions:

helm search repo iris --versions

Upgrade your deployment:

helm upgrade iris iris/iris-webapp -n iris

Always review release notes before upgrading across minor or major versions.

API

The API reference is available at:

Help

You can reach the IRIS community through:

Considerations

IRIS can be used in production, but the following best practices are strongly recommended:

License

The Helm chart is distributed under the Apache 2.0 License.

The IRIS application itself is licensed under the LGPL v3.

Sponsoring

Special thanks to Deutsche Telekom Security GmbH for sponsoring the IRIS project.

Maintainers