radar (or kubectl radar when installed via Krew) accepts the flags below. Defaults come from ~/.radar/config.json if present - see Configuration files.
General
| Flag | Default | Description |
|---|---|---|
--port | 9280 | HTTP port the UI / API serve on. |
--no-browser | false | Don’t auto-open the browser. |
--browser | "" | Browser to open the UI in, overriding the OS default launcher. Local runs only (in-cluster and Cloud can’t open a user browser). On macOS, app names and .app bundles work, e.g. --browser Safari or --browser "Google Chrome". Empty uses the OS default. |
--namespace | "" | Initial namespace filter (empty = all namespaces). |
--version | - | Print version and exit. |
--debug-events | false | Verbose event-drop logging. |
Cluster connection
| Flag | Description |
|---|---|
--kubeconfig | Path to a kubeconfig file. Falls back to KUBECONFIG env or ~/.kube/config. |
--kubeconfig-dir | Comma-separated directories whose kubeconfigs are merged. Mutually exclusive with --kubeconfig. |
Timeline storage
| Flag | Default | Description |
|---|---|---|
--timeline-storage | memory | memory or sqlite. SQLite persists across restarts. |
--timeline-db | ~/.radar/timeline.db | Path to the SQLite database when --timeline-storage=sqlite. |
--history-limit | 10000 | Max events retained in the timeline (memory mode). |
--timeline-max-size | 1Gi | Max SQLite timeline size (DB + WAL) before the oldest events are pruned, e.g. 800Mi, 8Gi. 0 disables size-based pruning. |
Metrics & traffic
| Flag | Description |
|---|---|
--prometheus-url | Manual Prometheus / VictoriaMetrics URL. Skips auto-discovery (handy for out-of-cluster Prometheus). |
--prometheus-header | HTTP header to send with Prometheus requests, e.g. 'Authorization=Bearer <token>' (repeatable). Required for auth-protected backends. |
--prometheus-header-from-env | Like --prometheus-header, but the value is read from an env var, e.g. 'Authorization=PROMETHEUS_TOKEN' (repeatable) - keeps secrets out of ps. |
Feature toggles
| Flag | Effect |
|---|---|
--no-mcp | Disable the MCP server (AI tools won’t be able to connect). |
--mcp-catalog-only | Start only the MCP endpoint for registry / inspector catalog introspection (e.g. Glama); skips Kubernetes initialization. |
--mcp-catalog-stdio | Start only the MCP catalog over stdio for registry / inspector introspection; skips Kubernetes initialization. |
--disable-helm-write | Read-only Helm: hide install / upgrade / rollback / uninstall buttons. |
--disable-exec | No pod terminal / debug shell. |
--disable-local-terminal | Disable the local-machine terminal pane. |
--pod-shell-default | Override the default pod exec shell (runs as sh -c <value>; empty falls back to bash -il → ash → sh). |
--debug-image | Image for ephemeral debug containers and node debug pods. Defaults to busybox:latest; point at a mirror for air-gapped / private-registry clusters. |
--list-page-size | Paginate the initial LIST of high-cardinality kinds (Pods, ReplicaSets) at this size. Defaults to 0 (single LIST). Helps very large clusters whose initial sync fails; only used when WatchList streaming is unavailable on the apiserver. Try 2000. |
--namespace-scope | Pin namespaced informer caches to a single namespace instead of watching the whole cluster - for very large clusters where cluster-wide caches are too heavy. Cluster-scoped resources (Nodes, Namespaces, PVs, and cluster-scoped CRDs) still load cluster-wide. Requires --namespace, a namespace on the kubeconfig context, or a saved local pick. Scoping to multiple namespaces is not supported yet. Local sessions can switch the scoped namespace from the picker (rebuilds the cache in place); auth / shared deployments lock it to the startup namespace so one user can’t reshape the shared cache for everyone. |
Tuning for slow or large clusters
Clusters reached over high-latency tunnels, or with thousands of namespaces, can trip Radar’s default deadlines. Each flag also reads from the matchingRADAR_* env var.
| Flag | Default | Env | Description |
|---|---|---|---|
--context-switch-timeout | 30s | RADAR_CONTEXT_SWITCH_TIMEOUT | Max time a kubeconfig context switch may take. Widen to 120s+ for clusters over high-latency tunnels. |
--first-paint-backstop | 5m | RADAR_FIRST_PAINT_BACKSTOP | Hard upper bound on the initial critical-cache sync wait before Radar falls through to a partial-data render. |
--namespace-list-timeout | 5s | RADAR_NAMESPACE_LIST_TIMEOUT | Timeout for the cluster-wide namespace LIST that decides if you’re RBAC-namespace-restricted. Widen to 30s+ on slow control planes - a timeout here is otherwise misreported as “Limited list - RBAC”. |
--max-scope-candidates | 20 | RADAR_MAX_SCOPE_CANDIDATES | Cap on the namespace-fallback probe fanout for users who can list namespaces cluster-wide but not a specific kind. Raise above 20 for clusters with more namespaces to avoid silently marking kinds denied. |
Authentication
See Authentication for the full setup. Common flags:| Flag | Description |
|---|---|
--auth-mode | none (default), proxy, or oidc. |
--auth-secret | HMAC secret for session cookies. Auto-generated when empty - set this for multi-replica deployments. |
--auth-cookie-ttl | Sliding session TTL. Default 4h. |
| Flag | Default | Description |
|---|---|---|
--auth-user-header | X-Forwarded-User | Header carrying the username. |
--auth-groups-header | X-Forwarded-Groups | Header carrying the comma-separated groups. |
| Flag | Description |
|---|---|
--auth-oidc-issuer | OIDC issuer URL. |
--auth-oidc-client-id | Client ID from your IdP. |
--auth-oidc-client-secret | Client secret. |
--auth-oidc-redirect-url | The /auth/callback URL registered with the IdP. |
--auth-oidc-groups-claim | JWT claim that carries groups. Default groups. |
--auth-oidc-post-logout-redirect-url | URL to redirect to after IdP logout (must be registered with the IdP). |
--auth-oidc-username-prefix | Username prefix for K8s impersonation - must match kube-apiserver’s --oidc-username-prefix. |
--auth-oidc-groups-prefix | Groups prefix for K8s impersonation - must match kube-apiserver’s --oidc-groups-prefix. |
--auth-oidc-insecure-skip-verify | Skip TLS verification on the IdP (dev / test only). |
--auth-oidc-ca-cert | Path to a custom CA bundle for the IdP. |
--auth-oidc-backchannel-logout | Enable the back-channel logout endpoint. Single-replica only. |
Radar Cloud
These flags wire an in-cluster Radar to a hosted Radar Cloud. Each is also readable from the matchingRADAR_CLOUD_* env var (so secrets stay out of ps).
| Flag | Env | Description |
|---|---|---|
--cloud-url | RADAR_CLOUD_URL | Cloud WS endpoint (e.g. wss://api.radarhq.io/agent). Empty = local-only. |
--cloud-token | RADAR_CLOUD_TOKEN | Cluster token from the Cloud install wizard (rhc_<random>). |
--cluster-name | RADAR_CLOUD_CLUSTER_NAME | Human-readable name (required with --cloud-url). |
RADAR_CLOUD_MODE=true additionally forces --auth-mode=proxy and pins X-Forwarded-User / X-Forwarded-Groups so the in-cluster Radar impersonates the Cloud-authenticated user against the K8s API. Don’t set this for local installs.
Internal / development
| Flag | Description |
|---|---|
--dev | Serve the frontend from disk instead of the embedded bundle. |
--fake-in-cluster | Pretend Radar is running in-cluster (useful for testing the in-cluster UX off-cluster). |