Requirements

​

Kubernetes

• Version: 1.27 or newer. We test against 1.29 + 1.30.
• Architecture: The official Hub and Web 1.1.0 images are linux/amd64 only. ARM-only control-plane clusters are unsupported for this release. On a mixed-architecture cluster, schedule both workloads onto amd64 nodes:
  hub:
    nodeSelector:
      kubernetes.io/os: linux
      kubernetes.io/arch: amd64
  web:
    nodeSelector:
      kubernetes.io/os: linux
      kubernetes.io/arch: amd64
  
• Resources reserved for the control plane:
  • radar-hub (Go API + tunnel terminator): 100m CPU / 256Mi memory request, 1 CPU / 1Gi limit. Single replica is fine for hundreds of clusters.
  • radar-hub-web (nginx + web app bundle): 50m / 64Mi request.
  • Migration initContainer: shares the radar-hub image and runs to completion in the same Pod before the main hub container starts, so it doesn’t need its own resource budget.
• Storage: the control plane is stateless; durable state lives in your Postgres. No PVC claims from the chart.
• Ingress class: any (nginx, contour, traefik, gateway-api). Sample annotations in the install doc target nginx.

​

Helm

• Version: 3.14 or newer. The configuration-changing upgrade examples use --reset-then-reuse-values, introduced in Helm 3.14, so new chart defaults apply without dropping the release’s existing user-supplied values.

​

Postgres

The chart does NOT install Postgres. You must provide one of: Version: Postgres 14 or newer. We test against 16 + 17. Sizing: the control plane’s working set is tiny - a few thousand rows for clusters + members + audit. 1 vCPU / 2Gi RAM is plenty for hundreds of customer clusters; the bottleneck is audit-log retention, sized at RADAR_HUB_AUDIT_RETENTION_DAYS * average events/day. Connection string: any standard postgres://user:pass@host:5432/db?sslmode=require URL. We recommend sslmode=require or stricter for managed databases.

​

Network

The control plane needs:

• Inbound: browsers (your team) and customer in-cluster Radars reach <hub.publicURL> over HTTPS.
• Outbound:
  • api.radarhq.io for the license heartbeat (on by default; disable via chart values if outbound HTTPS is forbidden).
  • Your IdP discovery endpoint for OIDC.
  • ghcr.io (or your private mirror) for image pulls.

The control plane does NOT need to reach customer clusters - the in-cluster Radar always initiates the WebSocket tunnel outbound.

​

Browser

• Same matrix as the hosted Cloud: latest Chrome / Edge / Firefox / Safari. No IE.

​

DNS + TLS

• One DNS record (e.g. radar.acme.example) pointing at your Ingress. This URL must be set as hub.publicURL in the Helm values - the control plane fails fast at boot if it’s not configured. Used for sign-in redirects, agent tunnel registration, OAuth-MCP resource publishing, and any other canonical-URL surface.
• A TLS cert via cert-manager / your existing wildcard / a manually-provisioned Secret. The chart’s Ingress template accepts a pre-provisioned tls.secretName and is unopinionated about the cert source.

​

Auth provider (one of)

• OIDC IdP with client credentials registered for <hub.publicURL>/api/auth/oidc/callback as a redirect URI. Tested against Okta, Auth0, Google Workspace, Azure AD.
• Break-glass admin only for evaluation pilots; configurable via env vars. Permanent escape hatch even when OIDC is enabled.

​

License

A signed JWT issued by Skyhook. We mint one at deal close and rotate per the renewal schedule in your contract. Without a license the control plane still boots but renders a warn-only banner; see Licensing.