> ## Documentation Index
> Fetch the complete documentation index at: https://radarhq.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Requirements

> What you need before installing self-hosted Radar Cloud.

## Kubernetes

* **Version:** 1.27 or newer. We test against 1.29 + 1.30.
* **Architecture:** The official Hub and Web 1.1.0 images are `linux/amd64` only. ARM-only control-plane clusters are unsupported for this release. On a mixed-architecture cluster, schedule both workloads onto amd64 nodes:

  ```yaml theme={null}
  hub:
    nodeSelector:
      kubernetes.io/os: linux
      kubernetes.io/arch: amd64
  web:
    nodeSelector:
      kubernetes.io/os: linux
      kubernetes.io/arch: amd64
  ```
* **Resources reserved for the control plane:**
  * `radar-hub` (Go API + tunnel terminator): 100m CPU / 256Mi memory request, 1 CPU / 1Gi limit. Single replica is fine for hundreds of clusters.
  * `radar-hub-web` (nginx + web app bundle): 50m / 64Mi request.
  * Migration initContainer: shares the `radar-hub` image and runs to completion in the same Pod before the main hub container starts, so it doesn't need its own resource budget.
* **Storage:** the control plane is stateless; durable state lives in your Postgres. No PVC claims from the chart.
* **Ingress class:** any (nginx, contour, traefik, gateway-api). Sample annotations in the install doc target nginx.

## Helm

* **Version:** 3.14 or newer. The configuration-changing upgrade examples use `--reset-then-reuse-values`, introduced in Helm 3.14, so new chart defaults apply without dropping the release's existing user-supplied values.

## Postgres

The chart does NOT install Postgres. You must provide one of:

| Option                                                   | Best for                                                                 |
| -------------------------------------------------------- | ------------------------------------------------------------------------ |
| Managed Postgres (RDS, Cloud SQL, Azure Flexible Server) | Production. Zero ops impact on your cluster.                             |
| CloudNativePG `Cluster` in the same / nearby namespace   | If you already operate CNPG. Chart reads its connection Secret directly. |
| Crunchy / Zalando operator                               | Same shape as CNPG - point at the operator-generated Secret.             |
| Hand-rolled `postgres:17` Pod or external VM             | Evaluation only. Not recommended past pilot.                             |

**Version:** Postgres 14 or newer. We test against 16 + 17.

**Sizing:** the control plane's working set is tiny - a few thousand rows for clusters + members + audit. 1 vCPU / 2Gi RAM is plenty for hundreds of customer clusters; the bottleneck is audit-log retention, sized at `RADAR_HUB_AUDIT_RETENTION_DAYS` \* average events/day.

**Connection string:** any standard `postgres://user:pass@host:5432/db?sslmode=require` URL. We recommend `sslmode=require` or stricter for managed databases.

## Network

The control plane needs:

* **Inbound:** browsers (your team) and customer in-cluster Radars reach `<hub.publicURL>` over HTTPS.
* **Outbound:**
  * `api.radarhq.io` for the license heartbeat (on by default; disable via chart values if outbound HTTPS is forbidden).
  * Your IdP discovery endpoint for OIDC.
  * `ghcr.io` (or your private mirror) for image pulls.

The control plane does NOT need to reach customer clusters - the in-cluster Radar always initiates the WebSocket tunnel outbound.

## Browser

* Same matrix as the hosted Cloud: latest Chrome / Edge / Firefox / Safari. No IE.

## DNS + TLS

* One DNS record (e.g. `radar.acme.example`) pointing at your Ingress. This URL **must** be set as `hub.publicURL` in the Helm values - the control plane fails fast at boot if it's not configured. Used for sign-in redirects, agent tunnel registration, OAuth-MCP resource publishing, and any other canonical-URL surface.
* A TLS cert via cert-manager / your existing wildcard / a manually-provisioned Secret. The chart's Ingress template accepts a pre-provisioned `tls.secretName` and is unopinionated about the cert source.

## Auth provider (one of)

* **OIDC IdP** with client credentials registered for `<hub.publicURL>/api/auth/oidc/callback` as a redirect URI. Tested against Okta, Auth0, Google Workspace, Azure AD.
* **Break-glass admin only** for evaluation pilots; configurable via env vars. Permanent escape hatch even when OIDC is enabled.

## License

A signed JWT issued by Skyhook. We mint one at deal close and rotate per the renewal schedule in your contract. Without a license the control plane still boots but renders a warn-only banner; see [Licensing](/docs/cloud/self-hosted/licensing).