Configuration reference

The chart’s values.yaml is the source of truth for every setting; this page mirrors it and adds the env var each value lands as inside the radar-hub container.

Required

values.yaml	Env var	Notes
`hub.publicURL`	`RADAR_HUB_PUBLIC_URL`, `HUB_FRONTEND_URL`, `HUB_ALLOWED_ORIGINS`	The single public URL for the web app + tunnel. Must be `https://` - see below. No trailing slash. Required - the hub fails fast at boot if `RADAR_HUB_PUBLIC_URL` is empty in self-managed mode.
`hub.cookiePassword` (or `cookiePasswordExistingSecret`)	`HUB_COOKIE_PASSWORD`	32+ bytes. `openssl rand -base64 48`.
Auth: `auth.breakGlass.email` + `password` (or `passwordHash`)	`RADAR_HUB_BOOTSTRAP_ADMIN_EMAIL`, `RADAR_HUB_BOOTSTRAP_ADMIN_PASSWORD`, `RADAR_HUB_BOOTSTRAP_ADMIN_PASSWORD_HASH`	Always-available bootstrap. Permanent, not a stopgap.

Postgres is not in this table because the chart ships a bundled eval Postgres that runs by default - see Postgres below. A license is required to use the hub, but the chart installs without it (helm won’t fail) - see License.

hub.publicURL must use https://. An http:// URL installs cleanly and passes readiness, but nothing can sign in and no cluster can connect:

The hub’s OIDC state cookie uses the __Host- prefix, which requires the Secure attribute. A Secure cookie is never sent back over plain HTTP, so the callback cannot find the state it needs. Every sign-in bounces to /login?error=session_expired, and the hub logs OIDC callback: state cookie missing - which does not look like a TLS problem.
In-cluster Radar refuses a ws:// tunnel to any non-loopback host: cloud WebSocket URL must use wss:// unless the host is localhost or a loopback address.

Terminate TLS at your Ingress, or use the chart’s self-signed option (web.tls.selfSigned=true) for a trial. The connect command the web app generates then sets cloud.insecureSkipVerify=true for the agent. To use the Radar CLI against a self-signed hub, trust its certificate on your workstation first: the certificate names your public host, so once trusted it verifies. The chart does not reject an http:// value, so this is on you to get right.

Why are the value keys still under hub.* and the env vars HUB_* / RADAR_HUB_*? radar-hub is the actual Go binary’s name - these are real identifiers, not user-facing prose. The chart key hub.publicURL configures the running radar-hub Pod; the binary reads it through RADAR_HUB_PUBLIC_URL, HUB_FRONTEND_URL, and HUB_ALLOWED_ORIGINS for the separate canonical-origin, redirect, and CORS checks. Renaming would break existing dotfiles and runbooks.

Postgres

The hub reads its DSN from HUB_DB_DSN. Configure exactly one source:

values.yaml	Notes
`postgres.bundled.*`	A bundled eval Postgres (single instance, no HA, no backups). On by default (`postgres.bundled.enabled=true`) - a DB is not a required input for a pilot. Tune `postgres.bundled.image`, `auth.{database,username,password}`, `persistence.{size,storageClass}`, `resources`. It always claims a 10Gi ReadWriteOnce PVC from the default StorageClass - set `persistence.storageClass` on clusters without a default (e.g. EKS), or the PVC stays `Pending`.
`postgres.external.existingSecret`	Point at your own Postgres via a Secret you provision (key `dsn`). The production path.
`postgres.external.cnpgCluster`	Read a CloudNativePG `Cluster`’s app-user Secret directly (key `uri` by default; override with `postgres.external.secretKey`).

Set postgres.bundled.enabled=false and one of the postgres.external.* options for production. The bundled eval Postgres is fine for pilots but has no HA or backups.

License

values.yaml	How it reaches the hub	Notes
`license.key` (or `license.existingSecret`)	Mounted file at `/etc/radar-hub/license`	Skyhook-issued license. Required to use the hub. The chart installs and boots without it (so `helm install` never hard-fails), but the web app stays on a full-screen license-required screen until you supply one. See Licensing.
`hub.airGapped`	`RADAR_HUB_AIR_GAPPED`	Turns off both calls the hub makes on its own initiative - the daily license renewal and the hourly version check. For deployments that must make no outbound connections at all. An air-gapped license is issued by hand and cannot renew itself, so this is a Custom-contract variant. The chart refuses to render against a hub image that does not read this setting, rather than installing one that keeps calling out.
`hub.latestRadarVersion`	`HUB_LATEST_RADAR_VERSION`	Pins the Radar version offered to your clusters instead of resolving it from `api.github.com` hourly. Required in practice when `hub.airGapped` is set, or the hub reports no latest version at all.
`hub.licenseServer`	`RADAR_HUB_LICENSE_SERVER`	Where the daily license renewal goes. Defaults to `https://api.radarhq.io`; ignored entirely when `hub.airGapped` is set.

The license is delivered as a file, not an environment variable. That is what lets it be replaced without restarting the pod - the hub re-reads the mount within a minute. RADAR_HUB_LICENSE_KEY is still honoured and takes precedence when set, but an environment variable is fixed for the life of a process, so supplying it that way turns a hot swap back into a redeploy.

Branding

Surfaced by GET /api/config and rendered by the web app’s TopBar / help menu / Tokens wizard.

values.yaml	Env var	Default
`branding.brandName`	`RADAR_HUB_BRAND_NAME`	`Radar`
`branding.docsURL`	`RADAR_HUB_BRAND_DOCS_URL`	`https://radarhq.io/docs`
`branding.supportEmail`	`RADAR_HUB_BRAND_SUPPORT_EMAIL`	`support@radarhq.io`
`branding.feedbackEmail`	`RADAR_HUB_BRAND_FEEDBACK_EMAIL`	`feedback@radarhq.io`

brandName controls the wordmark in the web app’s sidebar. Override to your own company name to white-label the deployment surface. The “Powered by Radar” footer remains visible per EULA terms.

Audit retention

values.yaml	Env var	Default
`hub.auditRetentionDays`	`RADAR_HUB_AUDIT_RETENTION_DAYS`	`365`

Self-Managed uses this single retention window for both visibility and deletion. The audit sweeper runs at startup and daily to delete older rows.

OIDC

Set together; partial config is a fatal misconfiguration at boot.

values.yaml	Env var
`auth.oidc.issuer`	`RADAR_HUB_OIDC_ISSUER`
`auth.oidc.clientID`	`RADAR_HUB_OIDC_CLIENT_ID`
`auth.oidc.clientSecret`	`RADAR_HUB_OIDC_CLIENT_SECRET`
`auth.oidc.callbackURL`	`RADAR_HUB_OIDC_CALLBACK_URL` (auto-derives from `hub.publicURL` + `/api/auth/oidc/callback` when empty; override only for split-origin Ingress setups)
`auth.oidc.defaultRole`	`RADAR_HUB_OIDC_DEFAULT_ROLE` (one of `owner` / `member` / `viewer`; default `member`) - the role assigned to every new non-bootstrap user. The first user to sign in bootstraps as `owner`; owners manage roles from Settings → Organization → Members. Roles are not derived from IdP groups.
`auth.oidc.groupsClaim`	`RADAR_HUB_OIDC_GROUP_CLAIM` (default `groups`; empty turns group passthrough off)
`auth.oidc.scopes`	`RADAR_HUB_OIDC_SCOPES` (comma-joined; extra scopes on top of `openid` + `email`. A scope your IdP does not define fails every sign-in)
`auth.oidc.useRefreshToken`	`RADAR_HUB_OIDC_USE_REFRESH_TOKEN` (chart default `true`) - keep the IdP refresh token and refresh the ID token before it expires. Without a refresh token, a session carrying IdP groups ends when its ID token expires. See refresh tokens.
`auth.oidc.clusterAccess`	`RADAR_HUB_OIDC_CLUSTER_ACCESS` (`""`, `roles` or `idp`; default `""` = `idp` while group passthrough is on) - whether new cluster installs keep the chart’s role bindings or leave access to the bindings you write. See cluster access.

See Authentication for IdP-specific recipes.

Sessions

Apply to OIDC and break-glass sessions alike. Empty uses the hub default. Go duration syntax (168h, not 7d).

values.yaml	Env var	Default
`auth.session.maxLifetime`	`RADAR_HUB_SESSION_MAX_LIFETIME`	`168h` - absolute lifetime from sign-in
`auth.session.maxInactive`	`RADAR_HUB_SESSION_MAX_INACTIVE`	`24h` - signed out after this long unused. Minimum `20m`; lower values stop the hub at boot.

See Sessions.

Singleton org name

values.yaml	Env var	Default
`hub.orgName`	`RADAR_HUB_ORG_NAME`	`Default`

Used only for the very first login (when the singleton is seeded). Renaming the org later happens through the web app’s Settings → Organization page; this value is not re-applied on subsequent boots.

Mode flag

The chart hardcodes RADAR_HUB_MODE=self_hosted in the radar-hub Deployment - you don’t set it directly. The mode controls every hosted-vs-self-managed seam (single-org gate, billing impl, audit retention source, /api/config response shape).

Version + cluster domain

values.yaml	Env var	Default
(auto - from `Chart.AppVersion`, override via `image.hub.tag`)	`RADAR_HUB_VERSION`	the chart’s appVersion
`clusterDomain`	(used by chart template only)	`cluster.local`

RADAR_HUB_VERSION is what /api/config reports as version.current and what the help menu surfaces in the web app. Override only if you need a custom build identifier. clusterDomain is the in-cluster DNS suffix the chart uses to build HUB_UPSTREAM for the web container’s nginx (<svc>.<ns>.svc.<clusterDomain>). The default works for every standard Kubernetes cluster; override if your cluster uses a non-default domain (some kubeadm setups or multi-cluster meshes do).

Resource sizing

hub:
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: 1
      memory: 1Gi
  replicas: 1

Single replica is correct for the operational load - the tunnel session registry is in-memory, so a second replica without a sticky-routing layer would split tunnels across pods. The control plane is intentionally single-instance; if you outgrow it, talk to us.

Hosted AI investigations

Hosted AI investigations are opt-in on self-managed installs and use your own Anthropic, Amazon Bedrock, or Google Vertex AI account. Every setting lives under hub.agent:

values.yaml	Default	Notes
`hub.agent.enabled`	`false`	Creates the sandbox namespace, Secret, NetworkPolicy, and Role, and turns the engine on.
`hub.agent.provider`	`anthropic`	`anthropic`, `bedrock`, or `vertex`.
`hub.agent.credentials.apiKey` / `serviceAccountJSON` / `existingSecret` / `podDSN`		The model credential and the DSN the sandbox pod uses.
`hub.agent.anthropic.`, `hub.agent.bedrock.`, `hub.agent.vertex.*`		Model, region, and project per provider.
`hub.agent.sandbox.*`		Sandbox namespace and NetworkPolicy.
`hub.agent.alertAnalysis`	`false`	Lets alert rules attach an AI analysis to the issues they match. Needs `hub.agent.enabled`.

With the bundled eval Postgres, the agent also needs postgres.bundled.auth.password set explicitly. See AI investigations for each provider, enabling it on a new or existing install, and troubleshooting.

Image overrides

The chart defaults to ghcr.io/skyhook-dev/radar-hub:<appVersion> and radar-hub-web:<appVersion>. To pin or repoint at a private mirror:

image:
  hub:
    repository: my-mirror.example/skyhook/radar-hub
    tag: MATCHING_RELEASE_TAG
  web:
    repository: my-mirror.example/skyhook/radar-hub-web
    tag: MATCHING_RELEASE_TAG
imagePullSecrets:
  - name: my-mirror-pull-secret

Replace MATCHING_RELEASE_TAG with the selected radar-hub chart’s appVersion, after confirming that tag is published for both Hub and Web. Keep the two tags identical.

Exposing the hub publicly

Expose the hub the way you already publish internal web apps on your cluster’s edge: a traditional Ingress or a Gateway API HTTPRoute, with the DNS record and TLS certificate you manage. The two are mutually exclusive. Both terminate on the radar-hub-web Service, which serves the web app and reverse-proxies /api, /agent, /c/{id}/api/*, /c/{id}/mcp, and /mcp to the radar-hub Service via in-cluster DNS. Other /c/{id} paths are client-side routes served by the web app’s index.html fallback. If you would rather not provision a certificate for a short pilot, the chart can instead expose a cloud LoadBalancer and serve a self-signed certificate - see LoadBalancer (pilot, self-signed TLS) below.

Connection requirements

Your ingress or gateway must pass WebSocket upgrades for /agent and pod terminals, and allow long-lived HTTP responses for live views and log follow. The cluster tunnel sends a keepalive every 30 seconds, so give its idle timeout headroom (at least 60 seconds). Quiet log-follow streams do not send heartbeats; use a longer idle timeout for those, as in the Ingress example below. A maximum connection duration can still force the tunnel to reconnect. Timeout behavior depends on the controller and load-balancer type. Check its streaming and WebSocket guidance; Google Cloud’s modes have different limits.

Ingress

Any IngressClass (nginx, traefik, contour, …). hosts and tls are lists:

ingress:
  enabled: true
  className: nginx
  annotations:
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
  hosts:
    - host: radar.acme.example
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: radar-acme-tls
      hosts: [radar.acme.example]

Gateway API (HTTPRoute)

If you run a Gateway API implementation (Istio, Envoy Gateway, Cilium, …), attach an HTTPRoute to a Gateway you already manage. The Gateway and its TLS listener live outside this chart; the route just attaches to it.

httpRoute:
  enabled: true
  defaultTimeout: "0s"     # allow streaming HTTP responses
  parentRefs:
    - name: my-gateway
      namespace: gateway-system
      sectionName: https      # the Gateway's TLS listener
  hostnames: [radar.acme.example]

defaultTimeout: "0s" disables the request timeout on the chart’s default rule, which keeps streamed HTTP responses open with controllers such as Envoy Gateway. It does not configure a WebSocket idle timeout. If you supply httpRoute.rules, set timeouts.request: "0s" in each streaming rule instead; custom rules replace the default rule. On an older Gateway API, set httpRoute.apiVersion: gateway.networking.k8s.io/v1beta1. For multiple path prefixes, per-route timeouts, filters, or alternate backends, set httpRoute.rules - your rules pass through unchanged and replace the default / route. httpRoute.annotations and httpRoute.labels attach metadata to the route. Customers wanting api.acme.example + app.acme.example split origins should disable both and write their own routing.

LoadBalancer (pilot, self-signed TLS)

For a short pilot where you would rather not provision a certificate, the chart can expose the hub through a cloud LoadBalancer and serve a self-signed certificate, making it reachable over HTTPS with no ingress controller or cert-manager.

service:
  web:
    type: LoadBalancer
web:
  tls:
    selfSigned: true

Or via --set on install:

helm install radar-hub skyhook/radar-hub \
  --namespace radar-hub --create-namespace \
  --set hub.publicURL=https://radar.acme.example \
  --set service.web.type=LoadBalancer \
  --set web.tls.selfSigned=true \
  ... # license, cookiePassword, break-glass, Postgres as above

After install, read the load balancer’s address and point your Hub URL’s DNS at it:

kubectl get svc radar-hub-web -n radar-hub

Self-signed TLS is encrypted but not authenticated - clients trust the certificate without verifying it, so the connection is exposed to man-in-the-middle interception. Use it for pilots only. For production, use an Ingress or Gateway with a certificate you manage (for example via cert-manager), as above.

Connecting clusters. Connect clusters to a self-signed hub through the web app’s Connect a cluster wizard, which generates a Helm command that adds --set cloud.insecureSkipVerify=true so the in-cluster connector trusts the self-signed certificate. The radar cloud install CLI expects a browser-trusted certificate, so use the wizard’s command for self-signed pilots.

Skipping the chart’s Secret

If your security model forbids any secret material in values.yaml, every credential supports an existingSecret ref:

values key	existingSecret ref	Required Secret key
`hub.cookiePassword`	`hub.cookiePasswordExistingSecret`	`cookie-password`
`license.key`	`license.existingSecret`	`license`
`auth.oidc.clientSecret`	`auth.oidc.clientSecretExistingSecret`	`client-secret`
`auth.breakGlass.passwordHash`	`auth.breakGlass.passwordHashExistingSecret`	`password-hash`
(external Postgres)	`postgres.external.existingSecret`	`dsn`
(CNPG)	`postgres.external.cnpgCluster`	`uri` (CNPG default; override with `postgres.external.secretKey`)
`hub.agent.credentials.*`	`hub.agent.credentials.existingSecret` (in the sandbox namespace)	`HUB_AGENT_DB_DSN` plus the provider’s key - see AI investigations

Get started

Views

In-cluster capabilities

Integrations

Local & in-cluster setup

Cloud

Reference

Configuration reference

Required

Postgres

License

Branding

Audit retention

OIDC

Sessions

Singleton org name

Mode flag

Version + cluster domain

Resource sizing

Hosted AI investigations

Image overrides

Exposing the hub publicly

Connection requirements

Ingress

Gateway API (HTTPRoute)

LoadBalancer (pilot, self-signed TLS)

Skipping the chart’s Secret

​Required

​Postgres

​License

​Branding

​Audit retention

​OIDC

​Sessions

​Singleton org name

​Mode flag

​Version + cluster domain

​Resource sizing

​Hosted AI investigations

​Image overrides

​Exposing the hub publicly

​Connection requirements

​Ingress

​Gateway API (HTTPRoute)

​LoadBalancer (pilot, self-signed TLS)

​Skipping the chart’s Secret

Required

Postgres

License

Branding

Audit retention

OIDC

Sessions

Singleton org name

Mode flag

Version + cluster domain

Resource sizing

Hosted AI investigations

Image overrides

Exposing the hub publicly

Connection requirements

Ingress

Gateway API (HTTPRoute)

LoadBalancer (pilot, self-signed TLS)

Skipping the chart’s Secret