Skip to main content

​
Kubernetes

  • Version: 1.27 or newer. We test against 1.29 + 1.30.
  • Architecture: The official Hub and Web images are published for both linux/amd64 and linux/arm64, so Graviton, Ampere and mixed-architecture clusters are supported. The chart pins only the OS by default and does not restrict the architecture.
  • Resources reserved for the control plane:
    • radar-hub (Go API + tunnel terminator): 100m CPU / 256Mi memory request, 1 CPU / 1Gi limit. Single replica is fine for hundreds of clusters.
    • radar-hub-web (nginx + web app bundle): 50m / 64Mi request.
    • Migration initContainer: shares the radar-hub image and runs to completion in the same Pod before the main hub container starts, so it doesn’t need its own resource budget.
  • Storage: the control plane itself is stateless; durable state lives in Postgres, and production installs (external Postgres) claim no PVCs. The bundled eval Postgres (on by default) is the exception - its StatefulSet requests a ReadWriteOnce PVC (10Gi from your default StorageClass unless you set postgres.bundled.persistence.size / .storageClass). GKE and AKS ship a default StorageClass, so this works out of the box. A fresh EKS cluster often has none: install the EBS CSI driver add-on and set a default class, or set postgres.bundled.persistence.storageClass explicitly (e.g. gp3) - otherwise the PVC stays Pending and Postgres never starts. EKS Auto Mode uses the ebs.csi.eks.amazonaws.com driver, which the legacy gp2 class doesn’t use - see Troubleshooting for a StorageClass that works.
  • AI investigations (optional): each investigation turn runs as a short-lived Job in a sandbox namespace and needs a CNI that enforces NetworkPolicy plus egress to your model provider. See AI investigations.
  • Ingress class: any (nginx, contour, traefik, gateway-api). Sample annotations in the install doc target nginx.

​
Helm

  • Version: 3.14 or newer. The configuration-changing upgrade examples use --reset-then-reuse-values, introduced in Helm 3.14, so new chart defaults apply without dropping the release’s existing user-supplied values.

​
Postgres

The chart ships a bundled eval Postgres that runs by default (postgres.bundled.enabled=true), so a DB is not a required input for a pilot. For production, disable it and point the chart at your own via postgres.external.*. Options: Version: Postgres 14 or newer. We test against 16 + 17. Sizing: the control plane’s working set is tiny - a few thousand rows for clusters + members + audit. 1 vCPU / 2Gi RAM is plenty for hundreds of customer clusters; the bottleneck is audit-log retention, sized at RADAR_HUB_AUDIT_RETENTION_DAYS * average events/day. Connection string: any standard postgres://user:pass@host:5432/db?sslmode=require URL. We recommend sslmode=require or stricter for managed databases.

​
Network

The control plane needs:
  • Inbound: browsers (your team) and customer in-cluster Radars reach <hub.publicURL> over HTTPS.
  • Outbound:
    • Your IdP discovery endpoint for OIDC.
    • ghcr.io (or your private mirror) for image pulls.
    • api.radarhq.io for the daily license renewal, on a cloud-managed deployment. This one is easy to leave out of an egress policy and the failure is quiet: the license stops renewing, and thirty days after it expires the web console stops accepting sign-ins. An air-gapped deployment (hub.airGapped=true) makes no outbound calls at all and does not need it - see Licensing.
    • api.github.com, hourly, to resolve the latest Radar version offered to your clusters. Optional: pin hub.latestRadarVersion and it is never called.
The control plane does NOT need to reach customer clusters - the in-cluster Radar always initiates the WebSocket tunnel outbound.

​
Browser

  • Same matrix as the hosted Cloud: latest Chrome / Edge / Firefox / Safari. No IE.

​
DNS + TLS

  • One DNS record (e.g. radar.acme.example) pointing at your Ingress. This URL must be set as hub.publicURL in the Helm values - the control plane fails fast at boot if it’s not configured. Used for sign-in redirects, agent tunnel registration, OAuth-MCP resource publishing, and any other canonical-URL surface.
  • A TLS cert via cert-manager / your existing wildcard / a manually-provisioned Secret. The chart’s Ingress template accepts a pre-provisioned tls.secretName and is unopinionated about the cert source.

​
Auth provider (one of)

  • OIDC IdP with client credentials registered for <hub.publicURL>/api/auth/oidc/callback as a redirect URI. Tested against Okta, Auth0, Google Workspace, Azure AD.
  • Break-glass admin only for evaluation pilots; configurable via env vars. Permanent escape hatch even when OIDC is enabled.

​
License

A license from Skyhook, required to use the hub. The chart installs and boots without it, but the app stays on a license-required screen until you supply one. Enterprise organizations generate their own from Settings → Self-Managed in Radar Cloud; Custom contracts are issued by hand. See Licensing.