Configuration reference

The chart’s values.yaml is the source of truth for every setting; this page mirrors it and adds the env var each value lands as inside the radar-hub container.

Required

values.yaml	Env var	Notes
`hub.publicURL`	`RADAR_HUB_PUBLIC_URL`, `HUB_FRONTEND_URL`, `HUB_ALLOWED_ORIGINS`	The single public URL for the web app + tunnel. No trailing slash. Required - the hub fails fast at boot if `RADAR_HUB_PUBLIC_URL` is empty in self-hosted mode.
`hub.cookiePassword` (or `cookiePasswordExistingSecret`)	`HUB_COOKIE_PASSWORD`	32+ bytes. `openssl rand -base64 48`.
Auth: `auth.breakGlass.email` + `password` (or `passwordHash`)	`RADAR_HUB_BOOTSTRAP_ADMIN_EMAIL`, `RADAR_HUB_BOOTSTRAP_ADMIN_PASSWORD`, `RADAR_HUB_BOOTSTRAP_ADMIN_PASSWORD_HASH`	Always-available bootstrap. Permanent, not a stopgap.

Postgres is not in this table because the chart ships a bundled eval Postgres that runs by default - see Postgres below. A license is required to use the hub, but the chart installs without it (helm won’t fail) - see License.

Why are the value keys still under hub.* and the env vars HUB_* / RADAR_HUB_*? radar-hub is the actual Go binary’s name - these are real identifiers, not user-facing prose. The chart key hub.publicURL configures the running radar-hub Pod; the binary reads it through RADAR_HUB_PUBLIC_URL, HUB_FRONTEND_URL, and HUB_ALLOWED_ORIGINS for the separate canonical-origin, redirect, and CORS checks. Renaming would break existing dotfiles and runbooks.

Postgres

The hub reads its DSN from HUB_DB_DSN. Configure exactly one source:

values.yaml	Notes
`postgres.bundled.*`	A bundled eval Postgres (single instance, no HA, no backups). On by default (`postgres.bundled.enabled=true`) - a DB is not a required input for a pilot. Tune `postgres.bundled.image`, `auth.{database,username,password}`, `persistence.{size,storageClass}`, `resources`. It always claims a 10Gi ReadWriteOnce PVC from the default StorageClass - set `persistence.storageClass` on clusters without a default (e.g. EKS), or the PVC stays `Pending`.
`postgres.external.existingSecret`	Point at your own Postgres via a Secret you provision (key `dsn`). The production path.
`postgres.external.cnpgCluster`	Read a CloudNativePG `Cluster`’s app-user Secret directly (key `uri` by default; override with `postgres.external.secretKey`).

Set postgres.bundled.enabled=false and one of the postgres.external.* options for production. The bundled eval Postgres is fine for pilots but has no HA or backups.

License

values.yaml	Env var	Notes
`license.key` (or `license.existingSecret`)	`RADAR_HUB_LICENSE_KEY`	Skyhook-issued license. Required to use the hub. The chart installs and boots without it (so `helm install` never hard-fails), but the web app stays on a full-screen license-required screen until you supply one. See Licensing.

Branding

Surfaced by GET /api/config and rendered by the web app’s TopBar / help menu / Tokens wizard.

values.yaml	Env var	Default
`branding.brandName`	`RADAR_HUB_BRAND_NAME`	`Radar`
`branding.docsURL`	`RADAR_HUB_BRAND_DOCS_URL`	`https://radarhq.io/docs`
`branding.supportEmail`	`RADAR_HUB_BRAND_SUPPORT_EMAIL`	`support@radarhq.io`
`branding.feedbackEmail`	`RADAR_HUB_BRAND_FEEDBACK_EMAIL`	`feedback@radarhq.io`

brandName controls the wordmark in the web app’s sidebar. Override to your own company name to white-label the deployment surface. The “Powered by Radar” footer remains visible per EULA terms.

Audit retention

values.yaml	Env var	Default
`hub.auditRetentionDays`	`RADAR_HUB_AUDIT_RETENTION_DAYS`	`365`

Self-hosted ignores plan-tiered retention (Cloud’s Free 7d / Team 30d / Enterprise 365d) and uses this single value. Backed by query-time filtering only - rows are not actively swept.

OIDC

Set together; partial config is a fatal misconfiguration at boot.

values.yaml	Env var
`auth.oidc.issuer`	`RADAR_HUB_OIDC_ISSUER`
`auth.oidc.clientID`	`RADAR_HUB_OIDC_CLIENT_ID`
`auth.oidc.clientSecret`	`RADAR_HUB_OIDC_CLIENT_SECRET`
`auth.oidc.callbackURL`	`RADAR_HUB_OIDC_CALLBACK_URL` (auto-derives from `hub.publicURL` + `/api/auth/oidc/callback` when empty; override only for split-origin Ingress setups)
`auth.oidc.defaultRole`	`RADAR_HUB_OIDC_DEFAULT_ROLE` (one of `owner` / `member` / `viewer`; default `member`) - the role assigned to every new non-bootstrap user. The first user to sign in bootstraps as `owner`; owners manage roles from Settings → Members. Roles are not derived from IdP groups.

See Authentication for IdP-specific recipes.

Singleton org name

values.yaml	Env var	Default
`hub.orgName`	`RADAR_HUB_ORG_NAME`	`Default`

Used only for the very first login (when the singleton is seeded). Renaming the org later happens through the web app’s Settings → Organization page; this value is not re-applied on subsequent boots.

Mode flag

The chart hardcodes RADAR_HUB_MODE=self_hosted in the radar-hub Deployment - you don’t set it directly. The mode controls every Cloud-vs-self-hosted seam (single-org gate, billing impl, audit retention source, /api/config response shape).

Version + cluster domain

values.yaml	Env var	Default
(auto - from `Chart.AppVersion`, override via `image.hub.tag`)	`RADAR_HUB_VERSION`	the chart’s appVersion
`clusterDomain`	(used by chart template only)	`cluster.local`

RADAR_HUB_VERSION is what /api/config reports as version.current and what the help menu surfaces in the web app. Override only if you need a custom build identifier. clusterDomain is the in-cluster DNS suffix the chart uses to build HUB_UPSTREAM for the web container’s nginx (<svc>.<ns>.svc.<clusterDomain>). The default works for every standard Kubernetes cluster; override if your cluster uses a non-default domain (some kubeadm setups or multi-cluster meshes do).

Resource sizing

hub:
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: 1
      memory: 1Gi
  replicas: 1

Single replica is correct for the operational load - the tunnel session registry is in-memory, so a second replica without a sticky-routing layer would split tunnels across pods. The control plane is intentionally single-instance; if you outgrow it, talk to us.

AI diagnosis (hosted Diagnose)

Hosted Diagnose runs each investigation turn as a sandboxed Job that reaches the model through a sidecar broker. On self-hosted Hubs it is strictly opt-in and currently AWS Bedrock only - you bring your own Bedrock account, and the broker forwards invocations of exactly the model you configure, refusing everything else fail-closed.

The chart does not expose these settings yet and the sandbox Job image is not published to a public registry, so hosted Diagnose is not turnkey on self-hosted installs today. The environment contract below is what the Hub already enforces; chart values and a public image are coming. Until then, the local BYO-agent form works against any cluster you have a kubeconfig for.

Env var	Required	Notes
`HUB_DIAGNOSE_JOB_IMAGE`	to enable	Sandbox image for the per-turn Job. Non-empty enables the feature; empty disables AI diagnosis entirely
`HUB_DIAGNOSE_JOB_NAMESPACE`	optional	Namespace the per-turn Jobs run in (default `agent-sandbox`)
`HUB_DIAGNOSE_BEDROCK_REGION`	yes	AWS region for the `bedrock-runtime` endpoint. No default on self-hosted: boot fails if the feature is enabled and this is unset, rather than sending cluster data to a region you didn’t choose
`HUB_DIAGNOSE_BEDROCK_MODEL`	yes	Bedrock inference-profile id (e.g. `us.anthropic.claude-sonnet-4-6`). Doubles as the broker’s allowlist - only invocations of this model are forwarded. No default on self-hosted, since the model entitlement lives in your AWS account
`HUB_DIAGNOSE_BEDROCK_KEY_SECRET`	yes	Name of a Kubernetes Secret (key `api-key`) holding a Bedrock API key - an IAM service-specific credential for `bedrock.amazonaws.com`. Defaults to `diagnose-bedrock-key`. A literal `HUB_DIAGNOSE_BEDROCK_API_KEY` also exists, but the Secret form keeps the key out of Job objects
`HUB_DIAGNOSE_POD_DB_DSN_SECRET`	yes	Name of a Secret (key `dsn`) in the Job namespace holding the Postgres DSN as the Job pod reaches it (event transport). Defaults to `diagnose-pod-db`. The literal `HUB_DIAGNOSE_POD_DB_DSN` form lands in the Job object - prefer the Secret

The Job’s agent container holds no credentials: the sidecar injects the Bedrock key, and the broker refuses every bedrock-runtime operation except invoking the configured model. See Diagnose for the architecture and privacy model.

Image overrides

The chart defaults to ghcr.io/skyhook-dev/radar-hub:<appVersion> and radar-hub-web:<appVersion>. To pin or repoint at a private mirror:

image:
  hub:
    repository: my-mirror.example/skyhook/radar-hub
    tag: MATCHING_RELEASE_TAG
  web:
    repository: my-mirror.example/skyhook/radar-hub-web
    tag: MATCHING_RELEASE_TAG
imagePullSecrets:
  - name: my-mirror-pull-secret

Replace MATCHING_RELEASE_TAG with the selected radar-hub chart’s appVersion, after confirming that tag is published for both Hub and Web. Keep the two tags identical.

Exposing the hub publicly

Expose the hub the way you already publish internal web apps on your cluster’s edge: a traditional Ingress or a Gateway API HTTPRoute, with the DNS record and TLS certificate you manage. The two are mutually exclusive. Both terminate on the radar-hub-web Service, which serves the web app and reverse-proxies /api, /agent, /c/{id}/api/*, /c/{id}/mcp, and /mcp to the radar-hub Service via in-cluster DNS. Other /c/{id} paths are client-side routes served by the web app’s index.html fallback. If you would rather not provision a certificate for a short pilot, the chart can instead expose a cloud LoadBalancer and serve a self-signed certificate - see LoadBalancer (pilot, self-signed TLS) below.

Ingress

Any IngressClass (nginx, traefik, contour, …). hosts and tls are lists:

ingress:
  enabled: true
  className: nginx
  annotations:
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
  hosts:
    - host: radar.acme.example
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: radar-acme-tls
      hosts: [radar.acme.example]

Gateway API (HTTPRoute)

If you run a Gateway API implementation (Istio, Envoy Gateway, Cilium, …), attach an HTTPRoute to a Gateway you already manage. The Gateway and its TLS listener live outside this chart; the route just attaches to it.

httpRoute:
  enabled: true
  parentRefs:
    - name: my-gateway
      namespace: gateway-system
      sectionName: https      # the Gateway's TLS listener
  hostnames: [radar.acme.example]

On an older Gateway API, set httpRoute.apiVersion: gateway.networking.k8s.io/v1beta1. For multiple path prefixes, per-route timeouts, filters, or alternate backends, set httpRoute.rules - your rules pass through unchanged and replace the default / route. httpRoute.annotations and httpRoute.labels attach metadata to the route. Customers wanting api.acme.example + app.acme.example split origins should disable both and write their own routing.

LoadBalancer (pilot, self-signed TLS)

For a short pilot where you would rather not provision a certificate, the chart can expose the hub through a cloud LoadBalancer and serve a self-signed certificate, making it reachable over HTTPS with no ingress controller or cert-manager.

service:
  web:
    type: LoadBalancer
web:
  tls:
    selfSigned: true

Or via --set on install:

helm install radar-hub skyhook/radar-hub \
  --namespace radar-hub --create-namespace \
  --set hub.publicURL=https://radar.acme.example \
  --set service.web.type=LoadBalancer \
  --set web.tls.selfSigned=true \
  ... # license, cookiePassword, break-glass, Postgres as above

After install, read the load balancer’s address and point your Hub URL’s DNS at it:

kubectl get svc radar-hub-web -n radar-hub

Self-signed TLS is encrypted but not authenticated - clients trust the certificate without verifying it, so the connection is exposed to man-in-the-middle interception. Use it for pilots only. For production, use an Ingress or Gateway with a certificate you manage (for example via cert-manager), as above.

Connecting clusters. Connect clusters to a self-signed hub through the web app’s Connect a cluster wizard, which generates a Helm command that adds --set cloud.insecureSkipVerify=true so the in-cluster connector trusts the self-signed certificate. The radar cloud install CLI expects a browser-trusted certificate, so use the wizard’s command for self-signed pilots.

Skipping the chart’s Secret

If your security model forbids any secret material in values.yaml, every credential supports an existingSecret ref:

values key	existingSecret ref	Required Secret key
`hub.cookiePassword`	`hub.cookiePasswordExistingSecret`	`cookie-password`
`license.key`	`license.existingSecret`	`license`
`auth.oidc.clientSecret`	`auth.oidc.clientSecretExistingSecret`	`client-secret`
`auth.breakGlass.passwordHash`	`auth.breakGlass.passwordHashExistingSecret`	`password-hash`
(external Postgres)	`postgres.external.existingSecret`	`dsn`
(CNPG)	`postgres.external.cnpgCluster`	`uri` (CNPG default; override with `postgres.external.secretKey`)

Get started

Views

In-cluster capabilities

Integrations

Self-hosted setup

Cloud

Reference

Configuration reference

Required

Postgres

License

Branding

Audit retention

OIDC

Singleton org name

Mode flag

Version + cluster domain

Resource sizing

AI diagnosis (hosted Diagnose)

Image overrides

Exposing the hub publicly

Ingress

Gateway API (HTTPRoute)

LoadBalancer (pilot, self-signed TLS)

Skipping the chart’s Secret

​Required

​Postgres

​License

​Branding

​Audit retention

​OIDC

​Singleton org name

​Mode flag

​Version + cluster domain

​Resource sizing

​AI diagnosis (hosted Diagnose)

​Image overrides

​Exposing the hub publicly

​Ingress

​Gateway API (HTTPRoute)

​LoadBalancer (pilot, self-signed TLS)

​Skipping the chart’s Secret

Required

Postgres

License

Branding

Audit retention

OIDC

Singleton org name

Mode flag

Version + cluster domain

Resource sizing

AI diagnosis (hosted Diagnose)

Image overrides

Exposing the hub publicly

Ingress

Gateway API (HTTPRoute)

LoadBalancer (pilot, self-signed TLS)

Skipping the chart’s Secret