> ## Documentation Index > Fetch the complete documentation index at: https://radarhq.io/docs/llms.txt > Use this file to discover all available pages before exploring further. # CLI flags > Every flag accepted by the radar / kubectl-radar binary, including auth, MCP, timeline storage, and Radar Cloud integration flags. `radar` (or `kubectl radar` when installed via Krew) accepts the flags below. Defaults come from `~/.radar/config.json` if present - see [Configuration files](/docs/configuration/files). ## General | Flag | Default | Description | | ---------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--port` | `9280` | HTTP port the UI / API serve on. | | `--no-browser` | `false` | Don't auto-open the browser. | | `--browser` | `""` | Browser to open the UI in, overriding the OS default launcher. Local runs only (in-cluster and Cloud can't open a user browser). On macOS, app names and `.app` bundles work, e.g. `--browser Safari` or `--browser "Google Chrome"`. Empty uses the OS default. | | `--namespace` | `""` | Initial namespace filter (empty = all namespaces). | | `--version` | - | Print version and exit. | | `--debug-events` | `false` | Verbose event-drop logging. | ## Cluster connection | Flag | Description | | ------------------ | ------------------------------------------------------------------------------------------------- | | `--kubeconfig` | Path to a kubeconfig file. Falls back to `KUBECONFIG` env or `~/.kube/config`. | | `--kubeconfig-dir` | Comma-separated directories whose kubeconfigs are merged. Mutually exclusive with `--kubeconfig`. | ## Timeline storage | Flag | Default | Description | | --------------------- | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------ | | `--timeline-storage` | `memory` | `memory` or `sqlite`. SQLite persists across restarts. | | `--timeline-db` | `~/.radar/timeline.db` | Path to the SQLite database when `--timeline-storage=sqlite`. | | `--history-limit` | `10000` | Max events retained in the timeline (memory mode). | | `--timeline-max-size` | `1Gi` | Max SQLite timeline size (DB + WAL) before the oldest events are pruned, e.g. `800Mi`, `8Gi`. `0` disables size-based pruning. | ## Metrics & traffic | Flag | Description | | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | `--prometheus-url` | Manual Prometheus / VictoriaMetrics URL. Skips auto-discovery (handy for out-of-cluster Prometheus). | | `--prometheus-header` | HTTP header to send with Prometheus requests, e.g. `'Authorization=Bearer '` (repeatable). Required for auth-protected backends. | | `--prometheus-header-from-env` | Like `--prometheus-header`, but the value is read from an env var, e.g. `'Authorization=PROMETHEUS_TOKEN'` (repeatable) - keeps secrets out of `ps`. | ## Feature toggles | Flag | Effect | | -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--no-mcp` | Disable the MCP server (AI tools won't be able to connect). | | `--mcp-catalog-only` | Start only the MCP endpoint for registry / inspector catalog introspection (e.g. Glama); skips Kubernetes initialization. | | `--mcp-catalog-stdio` | Start only the MCP catalog over stdio for registry / inspector introspection; skips Kubernetes initialization. | | `--disable-helm-write` | Read-only Helm: hide install / upgrade / rollback / uninstall buttons. | | `--disable-exec` | No pod terminal / debug shell. | | `--disable-local-terminal` | Disable the local-machine terminal pane. | | `--pod-shell-default` | Override the default pod exec shell (runs as `sh -c `; empty falls back to `bash -il → ash → sh`). | | `--debug-image` | Image for ephemeral debug containers and node debug pods. Defaults to `busybox:latest`; point at a mirror for air-gapped / private-registry clusters. | | `--list-page-size` | Paginate the initial LIST of high-cardinality kinds (Pods, ReplicaSets) at this size. Defaults to `0` (single LIST). Helps very large clusters whose initial sync fails; only used when WatchList streaming is unavailable on the apiserver. Try `2000`. | | `--namespace-scope` | Pin namespaced informer caches to a **single** namespace instead of watching the whole cluster - for very large clusters where cluster-wide caches are too heavy. Cluster-scoped resources (Nodes, Namespaces, PVs, and cluster-scoped CRDs) still load cluster-wide. Requires `--namespace`, a namespace on the kubeconfig context, or a saved local pick. Scoping to multiple namespaces is not supported yet. Local sessions can switch the scoped namespace from the picker (rebuilds the cache in place); auth / shared deployments lock it to the startup namespace so one user can't reshape the shared cache for everyone. | ## Tuning for slow or large clusters Clusters reached over high-latency tunnels, or with thousands of namespaces, can trip Radar's default deadlines. Each flag also reads from the matching `RADAR_*` env var. | Flag | Default | Env | Description | | -------------------------- | ------- | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--context-switch-timeout` | `30s` | `RADAR_CONTEXT_SWITCH_TIMEOUT` | Max time a kubeconfig context switch may take. Widen to `120s`+ for clusters over high-latency tunnels. | | `--first-paint-backstop` | `5m` | `RADAR_FIRST_PAINT_BACKSTOP` | Hard upper bound on the initial critical-cache sync wait before Radar falls through to a partial-data render. | | `--namespace-list-timeout` | `5s` | `RADAR_NAMESPACE_LIST_TIMEOUT` | Timeout for the cluster-wide namespace LIST that decides if you're RBAC-namespace-restricted. Widen to `30s`+ on slow control planes - a timeout here is otherwise misreported as "Limited list - RBAC". | | `--max-scope-candidates` | `20` | `RADAR_MAX_SCOPE_CANDIDATES` | Cap on the namespace-fallback probe fanout for users who can list namespaces cluster-wide but not a specific kind. Raise above 20 for clusters with more namespaces to avoid silently marking kinds denied. | ## Authentication See [Authentication](/docs/configuration/authentication) for the full setup. Common flags: | Flag | Description | | ------------------- | ---------------------------------------------------------------------------------------------------- | | `--auth-mode` | `none` (default), `proxy`, or `oidc`. | | `--auth-secret` | HMAC secret for session cookies. Auto-generated when empty - set this for multi-replica deployments. | | `--auth-cookie-ttl` | Sliding session TTL. Default `4h`. | **Proxy mode (oauth2-proxy / Pomerium / etc.):** | Flag | Default | Description | | ---------------------- | -------------------- | ------------------------------------------- | | `--auth-user-header` | `X-Forwarded-User` | Header carrying the username. | | `--auth-groups-header` | `X-Forwarded-Groups` | Header carrying the comma-separated groups. | **OIDC mode (Google / Okta / Keycloak / etc.):** | Flag | Description | | -------------------------------------- | --------------------------------------------------------------------------------------------- | | `--auth-oidc-issuer` | OIDC issuer URL. | | `--auth-oidc-client-id` | Client ID from your IdP. | | `--auth-oidc-client-secret` | Client secret. | | `--auth-oidc-redirect-url` | The `/auth/callback` URL registered with the IdP. | | `--auth-oidc-groups-claim` | JWT claim that carries groups. Default `groups`. | | `--auth-oidc-post-logout-redirect-url` | URL to redirect to after IdP logout (must be registered with the IdP). | | `--auth-oidc-username-prefix` | Username prefix for K8s impersonation - must match kube-apiserver's `--oidc-username-prefix`. | | `--auth-oidc-groups-prefix` | Groups prefix for K8s impersonation - must match kube-apiserver's `--oidc-groups-prefix`. | | `--auth-oidc-insecure-skip-verify` | Skip TLS verification on the IdP (dev / test only). | | `--auth-oidc-ca-cert` | Path to a custom CA bundle for the IdP. | | `--auth-oidc-backchannel-logout` | Enable the back-channel logout endpoint. Single-replica only. | ## Radar Cloud These flags wire an in-cluster Radar to a hosted Radar Cloud. Each is also readable from the matching `RADAR_CLOUD_*` env var (so secrets stay out of `ps`). | Flag | Env | Description | | ---------------- | -------------------------- | -------------------------------------------------------------------------- | | `--cloud-url` | `RADAR_CLOUD_URL` | Cloud WS endpoint (e.g. `wss://api.radarhq.io/agent`). Empty = local-only. | | `--cloud-token` | `RADAR_CLOUD_TOKEN` | Cluster token from the Cloud install wizard (`rhc_`). | | `--cluster-name` | `RADAR_CLOUD_CLUSTER_NAME` | Human-readable name (required with `--cloud-url`). | Setting `RADAR_CLOUD_MODE=true` additionally forces `--auth-mode=proxy` and pins `X-Forwarded-User` / `X-Forwarded-Groups` so the in-cluster Radar impersonates the Cloud-authenticated user against the K8s API. Don't set this for local installs. ## Internal / development | Flag | Description | | ------------------- | --------------------------------------------------------------------------------------- | | `--dev` | Serve the frontend from disk instead of the embedded bundle. | | `--fake-in-cluster` | Pretend Radar is running in-cluster (useful for testing the in-cluster UX off-cluster). |