What's New in Datasance PoT
v3.9.2 stays on the same Controller database. There is no schema or API change. No Control Plane YAML key was removed.
From v3.9.1 or v3.9.0, bump image tags and roll Edgelet v1.1.2. From v3.8.0, use the same tags and move straight to v3.9.2. You also pick up the v3.9 catalogs and registry fields.
If your external issuer certificate is signed by a private CA, set auth.issuerCa before you roll the operator. A public CA needs no new field. On Kubernetes, rewrite a saved Helm values file to the flat 3.9.2 keys before helm upgrade.
See Upgrading to v3.9.2. v3.7.x and older still move to v3.8.0 first: Migrating to v3.8.0.
v3.9.2 is a security patch on the v3.9 train. Pair Controller v3.9.2, potctl v3.9.2, Edgelet v1.1.2, Operator v3.9.2, Router v3.9.2, and NATS wrapper 2.15.1-1. EdgeOps Console stays v1.1.1.
- Platform train v3.9.2 lists the pins.
- Security rebuild rebuilds Go components on Go 1.26.10 and tightens Controller and operator checks.
- Private issuer CA adds optional
auth.issuerCa. Certificate checks stay on. - Helm values are a flat install form.
values.schema.jsonis gone. - NATS 2.15.1-1 rebuilds the wrapper. Embedded NATS Server stays 2.15.1.
- Edgelet v1.1.2 passes
issuerCainto the Controller. No Edgelet API change. - EdgeOps Console stays v1.1.1.
- v3.9 features (Model and Knowledge catalogs, registry
type, container fields) still apply when you come from v3.8.0. - Upgrade and migration paths summarize who can move in place.
- v3.8 foundation (Edgelet-only nodes, embedded OIDC, WebSocket exec) remains documented in the v3.8.0 snapshot.
Platform train v3.9.2
| Component | v3.9.2 default |
|---|---|
| Platform | v3.9.2 |
| Controller | v3.9.2 |
| potctl | v3.9.2 |
| Operator | v3.9.2 (Helm chart 3.9.2) |
| Router (wrapper image) | v3.9.2 (Skupper 3.5.3 inside) |
| NATS (wrapper image) | 2.15.1-1 (upstream NATS 2.15.1) |
| Edgelet | v1.1.2 (image 1.1.2) |
| EdgeOps Console | v1.1.1 (unchanged) |
| Go SDK | v3.9.2 |
Pins and YAML keys: Control plane. Steps: Upgrading to v3.9.2.
Security patch
Control plane images, potctl, the operator, the Router wrapper, Edgelet, the Go SDK, and the NATS wrapper are rebuilt on Go 1.26.10. That toolchain clears GO-2026-6809 (crypto/x509 distrust of compromised intermediate certificates).
The Controller image is Node.js. This patch does two checks there:
- User exec and log WebSocket upgrades verify the access token (signature, issuer, audience, and expiry) before RBAC. Agent sockets still use the fog token.
- Liquid substitution on
POST,PUT, andPATCHruns only after RBAC. The engine refuses template file reads, and it rejects arangewider than 10,000 or a render that passes 100,000foriterations.
The operator verifies TLS on Controller API calls and on external issuer login. The minimum version is TLS 1.2. When controller.https is set, the certificate must match the publicUrl host. The operator still dials the in-cluster Service.
No YAML keys were removed. The new field is optional. The Controller API and Edgelet API pages stay on those paths.
Private issuer CA
External mode can trust an HTTPS issuer signed by a private CA without turning certificate checks off.
Set auth.issuerCa to the standard base64 of a PEM CA, or of a concatenated PEM bundle. Leave it empty for a public CA. Embedded mode ignores the field.
| Surface | Field | Controller setting |
|---|---|---|
ControlPlane custom resource, Helm auth.issuerCa, and potctl YAML | auth.issuerCa | OIDC_ISSUER_TLS_BASE64_CA |
| Edgelet control-plane manifest | spec.auth.issuerCa | OIDC_ISSUER_TLS_BASE64_CA |
| Controller config file | auth.issuer.tls.path.ca or auth.issuer.tls.base64.ca | OIDC_ISSUER_TLS_PATH_CA or OIDC_ISSUER_TLS_BASE64_CA. Path wins when both are set |
potctl v3.9.2 passes issuerCa on Kubernetes, local, and remote control plane YAML. There are no new CLI commands.
Find out more!, Controller configuration, and Control plane YAML.
Helm values
Helm chart 3.9.2 takes a flat values file. auth, images, database, services, controller, nats, vault, and events are top-level keys. The chart always installs the CRD, RBAC, and one ControlPlane.
values.schema.json is removed. marketplace-values.yaml is the marketplace form. Do not pass it as a second -f file.
A values file from chart 3.9.1 uses controlplane.spec. Rewrite it before helm upgrade. services.nats.type now defaults to LoadBalancer. services.natsServer.type defaults to ClusterIP, so the non-TLS client port is not published. nats.memoryStoreSize and nats.storageSize are whole numbers of Gi.
AI Model and Knowledge catalogs
v3.9 adds fleet kind: Model and kind: Knowledge resources. The Controller pulls weights or datasets from type: hf or type: oci registries, tracks attach state per Edgelet node, and mounts ready content into microservices.
| Catalog | Purpose | Microservice bind |
|---|---|---|
| Model | LLM and inference weights (GGUF, safetensors, OCI model-spec) | spec.models.items[] |
| Knowledge | RAG corpora, Hub datasets, OCI document bundles | spec.knowledge.items[] |
Console path: Config → AI Model Catalog and Config → AI Knowledge Catalog. CLI: deploy, describe model, attach model, and the matching knowledge commands.
Edgelet nodes can also hold local edgelet.iofog.org/v1 models for lab workflows. Fleet operators usually use the Controller catalog.
Find out more!, AI Knowledge Catalog, and Microservices - models and knowledge.
Registries (OCI and Hugging Face)
Registry rows now declare a backend with spec.type: oci (container registries) or hf (Hugging Face Hub). Private Hub pulls use a token in password.
v3.9 removes requiresCert, certificate, and isSecure. Use optional ca (PEM or base64) and insecure for lab TLS instead.
Microservices and catalog items reference registries by numeric ID or aliases remote / local.
Find out more! and Catalog microservices.
Microservice container fields
spec.container on microservices expands for parity with OCI runtime options:
- Resource limits:
cpus,memoryReservation,memorySwap,shmSize - Security:
runAsGroup,readOnlyRootFilesystem,capAdd/capDrop - Devices and mounts:
devices,tmpfs,cdiDevices, volumescopefor named volumes - Process:
workingDir,entrypoint,commands,ulimits,sysctls
Wasm and alternate runtimes still use container.platform and container.runtime with runtime classes.
Find out more! and Microservice fields.
Edgelet v1.1.2
Edgelet v1.1.2 pairs with Controller v3.9.2. Upgrade fleet nodes after you roll the control plane. Default image: edgelet:1.1.2 on your flavor registry. There is no Edgelet API change in this patch.
On an Edgelet control-plane manifest, optional spec.auth.issuerCa sets OIDC_ISSUER_TLS_BASE64_CA on the Controller container. The field is redacted in edgelet controlplane get --manifest.
A later install.sh --upgrade on the host keeps the CLI flavor's Edgelet repository.
Agent YAML changes when you move from v3.8.0:
- Removed:
deviceScanFrequency,bluetoothEnabled,abstractedHardwareEnabled - Use
edgeGuardFrequencywhen you need hardware attestation (EdgeGuard)
Upgrade on a node:
sudo sh /usr/share/edgelet/install.sh --upgrade --version=v1.1.2
Or use upgrade agent as described in Upgrade and rollback Edgelet.
Find out more!, Edgelet introduction, and Edgelet management.
EdgeOps Console
EdgeOps Console v1.1.1 is unchanged in this patch. It still ships embedded in the Controller image (default port 8008). The API tab loads Scalar.
v3.9 still includes editors for AI catalogs, registry type, and cluster config flows.
Open with potctl view or controller.consoleUrl.
Find out more!, Console features, and Operate overview.
NATS and Router pins
NATS wrapper image tag 2.15.1-1 rebuilds the wrapper and embedded NATS Server 2.15.1 with Go 1.26.10. The embedded server version is unchanged. Volume mounts, JWT provisioning, and NATS_* settings match v3.9.1.
On Kubernetes, an empty services.natsServer.type is ClusterIP. The non-TLS client port is not published when you omit the type.
Router wrapper image tag 3.9.2 embeds Skupper Router 3.5.3 (unchanged from v3.9.1). The wrapper behavior is unchanged.
Find out more!, Router, and Message bus in Learn.
Upgrade and migration paths
| Starting version | Path |
|---|---|
| v3.9.1 or v3.9.0 | In-place tag bump: Upgrading to v3.9.2 |
| v3.8.0 | In-place upgrade: Upgrading to v3.9.2 |
| v3.7.x or v1.6.x | Greenfield to v3.8 first: Migrating to v3.8.0, Documentation archive |
| Greenfield v3.9.2 | Quick start (local) or Platform deployment |
After upgrade, reconcile stalled platform microservices on Controller hosts if Router or NATS pods look stale: Reconcile.
v3.8 foundation
v3.8.0 introduced Edgelet-only nodes, embedded OIDC, EdgeOps Console in the Controller image, WebSocket exec, multi-arch images[] catalogs, and the greenfield migration from v3.7. That behavior still applies on v3.9. The v3.8.0 docs snapshot keeps the full v3.8 release narrative and greenfield warnings.
New to the platform? Start with Welcome, Learn, and the Acme Smart Plant tutorial on pot-edge-patterns v1.1.1 images.
CLI and Go SDK
potctl v3.9.2 is the same CLI as v3.9.1, rebuilt for the Go 1.26.10 security fixes. It passes auth.issuerCa through on control plane deploy YAML. Catalog commands for Model and Knowledge, registry describe output with type, and deploy validation for v3.9 YAML are unchanged. Config directory remains ~/.iofog/v3.
Go SDK v3.9.2 tracks the same Controller API and catalog kinds. The module rebuild picks up the same Go 1.26.10 fix.
Find out more!, potctl getting familiar, and Go SDK.