31 best-practice checks. Zero install on your cluster.
Security, reliability, and efficiency checks - inspired by Polaris, Kubescape, Trivy, and the NSA/CISA hardening guide. Runs against Radar's cached cluster state, finishes in under a second.
Illustrative layout · real checks listed below
Three tools, one ops fight, and a cluster you still can't sign off on.
You want the CIS hardening advice. You install Kubescape. You want the efficiency best-practices. You install Polaris. You want container CVEs. You install Trivy. Three operators, three CRD sets, three maintenance surfaces.
And your first output is a YAML report you have to diff against last week's to know if anything got worse.
Radar's audit runs 31 checks spanning all three concerns - security, reliability, efficiency - grouped into one view, with per-check remediation, labeled by which framework originated it (NSA/CISA, CIS, Polaris). No operator to deploy. No CRDs installed. No scan schedule to maintain. The audit runs against Radar's already-cached cluster state, so it finishes in milliseconds.
Three categories. 31 checks. Zero config.
Inspired by Polaris, Kubescape, Trivy, and the NSA/CISA Kubernetes hardening guide. Categories from the Radar README; example checks below are representative.
Security
- Privileged containers
- Privilege escalation allowed
- Host namespaces shared (hostPID, hostIPC, hostNetwork)
- Container runtime sockets mounted
- Service account tokens auto-mounted
Reliability
- Liveness / readiness probes missing
- Image tagged `:latest`
- Single-replica Deployments (no HA)
- HA risk (all replicas on one node)
- Deprecated APIs still in use
Efficiency
- Resource requests missing
- Resource limits missing
- Orphan ConfigMaps / Secrets
- Overprovisioned limits
Examples above are from the Radar README. The running audit enumerates all 31 with per-finding remediation guidance.
Why the audit is instant.
Runs on cached state
Radar's informer cache already powers the topology and resource views. The audit re-uses it. No extra API calls, no cluster-side scan scheduler.
Framework-labeled findings
Each finding carries labels for the framework it came from - NSA/CISA, CIS, Polaris - so you can filter to the one your auditor cares about or the set your compliance program requires.
Ignore lists
Configurable per-namespace ignore rules for the controllers you already know break the checks on purpose (kube-system, GPU operators, etc.) - so real findings aren't buried by noise.
One install instead of three operators.
| What you want | Typical tool | Radar audit |
|---|---|---|
| Security best-practices (NSA/CISA, CIS) | Kubescape operator + Kyverno | Built-in, labeled |
| Reliability hygiene (probes, replicas, :latest) | Polaris operator | Built-in |
| Efficiency checks (requests/limits, orphans) | Polaris operator or custom kubectl scripts | Built-in |
| Per-check remediation guidance | Tool-dependent | In every finding |
| Install cost | 3 operators + 3 CRD sets | brew install |
| Scan latency | Scheduled CronJob, minutes | Sub-second, on demand |
Apache 2.0. Yours to inspect, fork, or self-host.
Radar's source is on GitHub. Every feature on this page is in the binary you install with brew install. No telemetry, no mandatory login, no phone-home. If we ever change that, you'll see it in a diff first.
Radar Cloud runs the audit across your whole fleet.
Same 31 checks. Same framework labels. Fleet-wide rollup across connected clusters, so you can see which checks are failing where without opening each cluster separately.
See the OSS vs Cloud comparisonFour more things Radar does in the same binary.
Live topology graph
Every resource and connection, laid out by ELK.js, updated via SSE.
Event timeline
Every K8s event and resource change, retained past the 1-hour TTL.
Image filesystem viewer
Browse any container image tree without kubectl exec or docker pull.
AI via MCP
Give Claude, Cursor, or Copilot a safe, token-optimized view of your cluster.
Stop juggling three operators to learn what's wrong.
Radar runs the checks the moment it connects. brew install, open the Audit tab, read the list.
Apache 2.0 OSS · Unlimited clusters self-hosted · Hosted free tier for up to 3 clusters