CLI flags

radar (or kubectl radar when installed via Krew) accepts the flags below. Defaults come from ~/.radar/config.json if present - see Configuration files.

General

Flag	Default	Description
`--port`	`9280`	HTTP port the UI / API serve on.
`--no-browser`	`false`	Don’t auto-open the browser.
`--browser`	`""`	Browser to open the UI in, overriding the OS default launcher. Local runs only (in-cluster and Cloud can’t open a user browser). On macOS, app names and `.app` bundles work, e.g. `--browser Safari` or `--browser "Google Chrome"`. Empty uses the OS default.
`--namespace`	`""`	Initial namespace filter (empty = all namespaces).
`--version`	-	Print version and exit.
`--debug-events`	`false`	Verbose event-drop logging.

Cluster connection

Flag	Description
`--kubeconfig`	Path to a kubeconfig file. Falls back to `KUBECONFIG` env or `~/.kube/config`.
`--kubeconfig-dir`	Comma-separated directories whose kubeconfigs are merged. Mutually exclusive with `--kubeconfig`.

Timeline storage

Flag	Default	Description
`--timeline-storage`	`memory`	`memory` or `sqlite`. SQLite persists across restarts.
`--timeline-db`	`~/.radar/timeline.db`	Path to the SQLite database when `--timeline-storage=sqlite`.
`--history-limit`	`10000`	Max events retained in the timeline (memory mode).
`--timeline-max-size`	`1Gi`	Max SQLite timeline size (DB + WAL) before the oldest events are pruned, e.g. `800Mi`, `8Gi`. `0` disables size-based pruning.

Metrics & traffic

Flag	Description
`--prometheus-url`	Manual Prometheus / VictoriaMetrics URL. Skips auto-discovery (handy for out-of-cluster Prometheus).
`--prometheus-header`	HTTP header to send with Prometheus requests, e.g. `'Authorization=Bearer <token>'` (repeatable). Required for auth-protected backends.
`--prometheus-header-from-env`	Like `--prometheus-header`, but the value is read from an env var, e.g. `'Authorization=PROMETHEUS_TOKEN'` (repeatable) - keeps secrets out of `ps`.

Feature toggles

Flag	Effect
`--no-mcp`	Disable the MCP server (AI tools won’t be able to connect).
`--mcp-catalog-only`	Start only the MCP endpoint for registry / inspector catalog introspection (e.g. Glama); skips Kubernetes initialization.
`--mcp-catalog-stdio`	Start only the MCP catalog over stdio for registry / inspector introspection; skips Kubernetes initialization.
`--disable-helm-write`	Read-only Helm: hide install / upgrade / rollback / uninstall buttons.
`--disable-exec`	No pod terminal / debug shell.
`--disable-local-terminal`	Disable the local-machine terminal pane.
`--pod-shell-default`	Override the default pod exec shell (runs as `sh -c <value>`; empty falls back to `bash -il → ash → sh`).
`--debug-image`	Image for ephemeral debug containers and node debug pods. Defaults to `busybox:latest`; point at a mirror for air-gapped / private-registry clusters.
`--list-page-size`	Paginate the initial LIST of high-cardinality kinds (Pods, ReplicaSets) at this size. Defaults to `0` (single LIST). Helps very large clusters whose initial sync fails; only used when WatchList streaming is unavailable on the apiserver. Try `2000`.
`--namespace-scope`	Pin namespaced informer caches to a single namespace instead of watching the whole cluster - for very large clusters where cluster-wide caches are too heavy. Cluster-scoped resources (Nodes, Namespaces, PVs, and cluster-scoped CRDs) still load cluster-wide. Requires `--namespace`, a namespace on the kubeconfig context, or a saved local pick. Scoping to multiple namespaces is not supported yet. Local sessions can switch the scoped namespace from the picker (rebuilds the cache in place); auth / shared deployments lock it to the startup namespace so one user can’t reshape the shared cache for everyone.

Tuning for slow or large clusters

Clusters reached over high-latency tunnels, or with thousands of namespaces, can trip Radar’s default deadlines. Each flag also reads from the matching RADAR_* env var.

Flag	Default	Env	Description
`--context-switch-timeout`	`30s`	`RADAR_CONTEXT_SWITCH_TIMEOUT`	Max time a kubeconfig context switch may take. Widen to `120s`+ for clusters over high-latency tunnels.
`--first-paint-backstop`	`5m`	`RADAR_FIRST_PAINT_BACKSTOP`	Hard upper bound on the initial critical-cache sync wait before Radar falls through to a partial-data render.
`--namespace-list-timeout`	`5s`	`RADAR_NAMESPACE_LIST_TIMEOUT`	Timeout for the cluster-wide namespace LIST that decides if you’re RBAC-namespace-restricted. Widen to `30s`+ on slow control planes - a timeout here is otherwise misreported as “Limited list - RBAC”.
`--max-scope-candidates`	`20`	`RADAR_MAX_SCOPE_CANDIDATES`	Cap on the namespace-fallback probe fanout for users who can list namespaces cluster-wide but not a specific kind. Raise above 20 for clusters with more namespaces to avoid silently marking kinds denied.

Authentication

See Authentication for the full setup. Common flags:

Flag	Description
`--auth-mode`	`none` (default), `proxy`, or `oidc`.
`--auth-secret`	HMAC secret for session cookies. Auto-generated when empty - set this for multi-replica deployments.
`--auth-cookie-ttl`	Sliding session TTL. Default `4h`.

Proxy mode (oauth2-proxy / Pomerium / etc.):

Flag	Default	Description
`--auth-user-header`	`X-Forwarded-User`	Header carrying the username.
`--auth-groups-header`	`X-Forwarded-Groups`	Header carrying the comma-separated groups.

OIDC mode (Google / Okta / Keycloak / etc.):

Flag	Description
`--auth-oidc-issuer`	OIDC issuer URL.
`--auth-oidc-client-id`	Client ID from your IdP.
`--auth-oidc-client-secret`	Client secret.
`--auth-oidc-redirect-url`	The `/auth/callback` URL registered with the IdP.
`--auth-oidc-groups-claim`	JWT claim that carries groups. Default `groups`.
`--auth-oidc-post-logout-redirect-url`	URL to redirect to after IdP logout (must be registered with the IdP).
`--auth-oidc-username-prefix`	Username prefix for K8s impersonation - must match kube-apiserver’s `--oidc-username-prefix`.
`--auth-oidc-groups-prefix`	Groups prefix for K8s impersonation - must match kube-apiserver’s `--oidc-groups-prefix`.
`--auth-oidc-insecure-skip-verify`	Skip TLS verification on the IdP (dev / test only).
`--auth-oidc-ca-cert`	Path to a custom CA bundle for the IdP.
`--auth-oidc-backchannel-logout`	Enable the back-channel logout endpoint. Single-replica only.

Radar Cloud

These flags wire an in-cluster Radar to a hosted Radar Cloud. Each is also readable from the matching RADAR_CLOUD_* env var (so secrets stay out of ps).

Flag	Env	Description
`--cloud-url`	`RADAR_CLOUD_URL`	Cloud WS endpoint (e.g. `wss://api.radarhq.io/agent`). Empty = local-only.
`--cloud-token`	`RADAR_CLOUD_TOKEN`	Cluster token from the Cloud install wizard (`rhc_<random>`).
`--cluster-name`	`RADAR_CLOUD_CLUSTER_NAME`	Human-readable name (required with `--cloud-url`).

Setting RADAR_CLOUD_MODE=true additionally forces --auth-mode=proxy and pins X-Forwarded-User / X-Forwarded-Groups so the in-cluster Radar impersonates the Cloud-authenticated user against the K8s API. Don’t set this for local installs.

Internal / development

Flag	Description
`--dev`	Serve the frontend from disk instead of the embedded bundle.
`--fake-in-cluster`	Pretend Radar is running in-cluster (useful for testing the in-cluster UX off-cluster).

Get started

Views

In-cluster capabilities

Integrations

Self-hosted setup

Cloud

Reference

General

Cluster connection

Timeline storage

Metrics & traffic

Feature toggles

Tuning for slow or large clusters

Authentication

Radar Cloud

Internal / development

​General

​Cluster connection

​Timeline storage

​Metrics & traffic

​Feature toggles

​Tuning for slow or large clusters

​Authentication

​Radar Cloud

​Internal / development

General

Cluster connection

Timeline storage

Metrics & traffic

Feature toggles

Tuning for slow or large clusters

Authentication

Radar Cloud

Internal / development