Skip to main content

​
What runs

Radar Cloud Self-Managed architecture: your Ingress or Gateway API HTTPRoute routes to radar-hub-web, which serves the web app and reverse-proxies to the radar-hub Go API; radar-hub connects to Postgres and terminates the in-cluster Radar tunnels. Three workloads in your cluster: the web app, the control plane, and Postgres (bundled for evaluation, or your own). Every Radar agent in your fleet connects outbound to the control plane; the control plane never connects into your clusters. Run one replica of the control plane. If you need more than one, contact support.

​
What connects to what

Terminate TLS at your Ingress or Gateway. The agents refuse a plaintext tunnel to anything but localhost.

​
What protects each connection

​
What leaves your network

A cloud-managed deployment sends licensing and deployment metadata to Skyhook. Automatic license renewal sends the license and Hub version. A separate sync reports the hub address and connection settings, cluster count, and cluster migration IDs and status. These requests do not include workload contents. An air-gapped deployment sends nothing of its own. Skyhook does not have your cluster data, your users’ identities, your audit log, or your tunnel traffic. Those stay in your cluster and your Postgres. The exception is anything you connect yourself: an AI model provider receives what an investigation reads, and your identity provider sees sign-ins.