# Radar

> Documentation for Radar - the open-source Kubernetes visibility tool, and Radar Cloud, the hosted multi-cluster control plane. By Skyhook.

- [Radar documentation](https://radarhq.io/docs/index.md): Install and operate Radar - the open-source Kubernetes visibility tool, and Radar Cloud, the hosted multi-cluster control plane.
- [OSS vs Cloud](https://radarhq.io/docs/oss-vs-cloud.md): How Radar OSS and Radar Cloud differ - features, deployment model, and when to pick which.
- [Install Radar (local)](https://radarhq.io/docs/install.md): Install the Radar CLI or desktop app to run Radar against any cluster reachable from your kubeconfig. No account, no in-cluster install, no cloud.
- [Quickstart with Radar Cloud](https://radarhq.io/docs/quickstart-cloud.md): Sign up, create an organization, install Radar in your cluster with one Helm command, and start using fleet views.
- [Navigation & search](https://radarhq.io/docs/features/navigation.md): The left nav rail and the omnibar - how you move between views and find any resource across the cluster. Identical between OSS and Cloud.
- [Topology view](https://radarhq.io/docs/features/topology.md): Interactive graph of every resource in your cluster and how they're connected - workloads, services, ingresses, traffic flows, and integration-aware edges from Argo, Flux, Karpenter, and more.
- [Resource browser](https://radarhq.io/docs/features/resources.md): Table view of every Kubernetes resource - smart columns per kind, search, filter, drill-down, and direct YAML edit.
- [Applications view - browse a cluster by app](https://radarhq.io/docs/features/applications.md): Group a cluster's workloads into the application they belong to - resolved from ownership, GitOps, Helm, and labels - with a workload rail, topology, and search. Open source and Cloud.
- [Workload metrics](https://radarhq.io/docs/features/workload-metrics.md): Understand workload request rate, HTTP errors, latency, CPU, memory and throttling from an existing Prometheus-compatible backend, with automatic discovery and explicit data coverage.
- [Jobs and workflows](https://radarhq.io/docs/features/jobs-and-workflows.md): Inspect Kubernetes Jobs, CronJobs, Argo Workflows, and scheduled runs as executions with retained history, configuration, steps, activity, and logs.
- [Compare resources](https://radarhq.io/docs/features/compare.md): Diff two Kubernetes resources of the same kind side-by-side - YAML diff with field-level highlighting, swap, spec-only, hide-unchanged.
- [Issues](https://radarhq.io/docs/features/issues.md): One ranked stream of what's broken right now - failing workloads, dangling references, pods that can't start, and False conditions on Argo / Flux / Knative / Crossplane / cert-manager / KEDA resources. Live operational state, not config posture.
- [GitOps workspace](https://radarhq.io/docs/features/gitops.md): Operate Argo CD Applications and Flux Kustomizations and HelmReleases from one fleet view, with topology, diagnosis, activity, and reconciliation controls.
- [Event timeline](https://radarhq.io/docs/features/timeline.md): Unified, queryable timeline of cluster events and resource changes. Memory or SQLite storage locally, retained centrally in Radar Cloud.
- [Helm management](https://radarhq.io/docs/features/helm.md): View installed Helm releases, inspect values and rendered manifests, track available upgrades, choose a version, rollback, and uninstall - all without leaving Radar.
- [Traffic visualization](https://radarhq.io/docs/features/traffic.md): See which workloads talk to each other, live, from Hubble (Cilium), Istio, Caretta, or Beyla - auto-detected, no extra config.
- [Capacity](https://radarhq.io/docs/features/capacity.md): Read-only capacity diagnosis for any cluster: node groups across every manager, the cluster scheduling ledger, and deep Karpenter answers - why a pod is pending, which NodePool could take it, why nodes are not joining.
- [CloudNativePG](https://radarhq.io/docs/features/cloudnative-pg.md): PostgreSQL clusters run by CloudNativePG: which cluster needs attention and why, what each instance is doing, whether you could actually restore, and day-2 operations that are reviewed before they run and followed until the outcome is observed.
- [Cost insights](https://radarhq.io/docs/features/cost.md): Kubernetes cost visibility from OpenCost-compatible Prometheus metrics or Kubecost 3.
- [Rightsizing](https://radarhq.io/docs/features/rightsizing.md): CPU and memory request guidance for visible workloads, based on recent Prometheus evidence.
- [Cluster audit](https://radarhq.io/docs/features/cluster-audit.md): Built-in best-practices scan covering security, reliability, and efficiency. Inspired by Polaris and the NSA / CISA Kubernetes hardening guide. Configurable policy. No extra installs.
- [Kubernetes upgrade impact](https://radarhq.io/docs/features/upgrade-impact.md): Find version skew, removed APIs, drain blockers, webhook failures, deprecated configuration, and incomplete evidence before upgrading a Kubernetes cluster.
- [Access control (RBAC visibility)](https://radarhq.io/docs/features/access-control.md): Inspect what any ServiceAccount, User, or Group can actually do - without three kubectl describe calls. Pod and Workload detail pages surface blast radius so you can answer 'what happens if this is compromised?' in one click.
- [Image filesystem](https://radarhq.io/docs/features/image-filesystem.md): Inspect a container image's filesystem directly from its registry. Browse layers, search, and download files, with Pod-bound authorization in shared deployments.
- [Exec & port-forward](https://radarhq.io/docs/features/exec-and-portforward.md): Pod terminal, debug containers, port forwarding, and a local terminal pane - all gated by RBAC and disable-able per install.
- [Kubernetes MCP server](https://radarhq.io/docs/features/mcp.md): Radar's built-in MCP server: token-optimized Kubernetes context for Claude Code, Codex, Cursor, GitHub Copilot, OpenCode, Google Antigravity, and any other MCP client, with RBAC-enforced tools to inspect, diagnose, and operate your cluster.
- [Reachability](https://radarhq.io/docs/features/reachability.md): Did traffic actually get through? Trace the declared network path, test it live from multiple vantages, and see exactly which hop breaks - without ever claiming more than was verified.
- [AI investigations](https://radarhq.io/docs/features/diagnose.md): AI investigations for failing resources. Locally with your own agent CLI - Claude Code, Codex, Cursor, or OpenCode - or hosted in Radar Cloud with no CLI at all. Read-only until you approve a fix.
- [Integrations](https://radarhq.io/docs/features/integrations.md): Argo, Flux, Cilium, Istio, Karpenter, KEDA, Crossplane, cert-manager, OpenCost, Kubecost, Prometheus, Trivy, Velero, Knative, and more - all detected at runtime, zero plugins required.
- [FluxCD UI and Kubernetes integration](https://radarhq.io/docs/features/integrations/flux.md): Use Radar as an open-source Flux UI for Kustomizations, HelmReleases, sources, dependency topology, failure diagnosis, and reconciliation controls.
- [GitOps integration coverage](https://radarhq.io/docs/features/integrations/gitops-flux-argo.md): Exact CRD, API version, fleet, topology, detail, and structured AI coverage for Radar's Argo CD and Flux integrations.
- [Argo Rollouts progressive delivery visibility](https://radarhq.io/docs/features/integrations/argo-rollouts.md): Visualize Argo Rollouts in Radar: live Rollout status in topology, typed detail views, and AI summaries for canary and blue-green progressive delivery.
- [Argo Workflows visibility in Kubernetes](https://radarhq.io/docs/features/integrations/argo-workflows.md): Inspect Argo Workflow runs, templates, CronWorkflows, DAG tasks, steps, retries, inputs, failures, and retained history in Radar.
- [Gateway API routing visibility in Kubernetes](https://radarhq.io/docs/features/integrations/gateway-api.md): Visualize Gateway API in Radar: the full network path from GatewayClass through Gateway and HTTPRoute to Service and Pod, with typed route detail views.
- [Istio service mesh visibility in Kubernetes](https://radarhq.io/docs/features/integrations/istio.md): See Istio in Radar: gateway-to-service traffic topology, VirtualService routing rules with weight bars, DestinationRule config edges, and fault-injection warnings.
- [Traefik ingress routing visibility](https://radarhq.io/docs/features/integrations/traefik.md): Trace Traefik in Radar: IngressRoute to Middleware to Service routing paths in topology, plus IngressRoute and Middleware detail views with secrets redacted.
- [Contour ingress routing visibility](https://radarhq.io/docs/features/integrations/contour.md): See Contour routing in Radar: HTTPProxy delegation chains, TLS configuration edges, and the full path from root proxy to Service in the topology view.
- [Kubernetes, Cilium & Calico network policy visibility](https://radarhq.io/docs/features/integrations/network-policies.md): See Kubernetes, Cilium, and Calico policies in topology, inspect enforced and staged rules, find out why Hubble dropped a flow and which policies apply, and compare workload coverage with Calico's staged-policy projection.
- [Karpenter node autoscaling visibility](https://radarhq.io/docs/features/integrations/karpenter.md): Watch Karpenter in Radar: the NodePool to NodeClaim to Node to Pod provisioning chain in topology, with NodePool status and NodeClass configuration views.
- [Cluster API (CAPI) cluster lifecycle visibility](https://radarhq.io/docs/features/integrations/cluster-api.md): Visualize Cluster API in Radar: the full CAPI ownership chain from ClusterClass through Cluster and Machine to Node, with MachineHealthChecks and lifecycle status.
- [KEDA event-driven autoscaling visibility](https://radarhq.io/docs/features/integrations/keda.md): See KEDA in Radar: ScaledObject-to-workload topology edges showing which Deployments, StatefulSets, and Rollouts KEDA scales, with live status.
- [Vertical Pod Autoscaler (VPA) visibility](https://radarhq.io/docs/features/integrations/vpa.md): See VPA in Radar: Vertical Pod Autoscaler nodes with edges to their target workloads, grouped alongside HPA and KEDA in the Scalers section.
- [Dynamic Resource Allocation (DRA) GPU visibility](https://radarhq.io/docs/features/integrations/dra.md): Inspect Kubernetes DRA in Radar: ResourceClaim allocation lifecycle, DeviceClasses, ResourceSlices, and which Pods hold each device reservation.
- [NVIDIA GPU Operator stack visibility](https://radarhq.io/docs/features/integrations/nvidia-gpu-operator.md): Monitor the NVIDIA GPU Operator in Radar: ClusterPolicy state, per-component rollout badges, driver lifecycle, and MIG strategy - with alerts when rollouts stall.
- [GPU & AI/ML resource visibility - Kueue, KubeRay, KServe & more](https://radarhq.io/docs/features/integrations/gpu-ml-ecosystem.md): Investigate Kueue admission and queue quotas, inspect JobSet member Jobs and Pods, and browse GPU, batch and inference resources with status badges and smart columns.
- [OpenCost and Kubecost Kubernetes cost visibility](https://radarhq.io/docs/features/integrations/opencost.md): Radar reads OpenCost-compatible Prometheus metrics or Kubecost 3 Aggregator APIs for cluster, namespace, application, workload, and node cost visibility.
- [Prometheus Operator monitoring visibility](https://radarhq.io/docs/features/integrations/prometheus.md): Inspect Prometheus Operator resources in Radar: ServiceMonitor scrape configs, PrometheusRule groups with alert and recording rule counts, and PodMonitor detail views.
- [Trivy Operator vulnerability scan visibility](https://radarhq.io/docs/features/integrations/trivy.md): Review Trivy Operator scans in Radar: VulnerabilityReports with severity breakdowns, config audit pass/fail checks, and CVE counts as smart table columns.
- [Kyverno policy visibility in Kubernetes](https://radarhq.io/docs/features/integrations/kyverno.md): Audit Kyverno in Radar: Policy detail views with Enforce/Audit badges and rule breakdowns, plus PolicyReport charts of pass/fail results across the cluster.
- [cert-manager TLS certificate visibility](https://radarhq.io/docs/features/integrations/cert-manager.md): Trace cert-manager in Radar: Certificate-to-Issuer topology and the full provisioning chain - CertificateRequest, Order, Challenge - with renewal status at a glance.
- [Bitnami Sealed Secrets visibility](https://radarhq.io/docs/features/integrations/sealed-secrets.md): See Bitnami Sealed Secrets in Radar: SealedSecret detail views with encrypted data keys, template metadata, and the target Secret's scope and namespace.
- [External Secrets Operator sync visibility](https://radarhq.io/docs/features/integrations/external-secrets.md): Watch External Secrets Operator in Radar: sync status, store references, secret mappings, and failure alerts for ExternalSecrets and ClusterExternalSecrets.
- [Reflector ConfigMap and Secret mirroring visibility](https://radarhq.io/docs/features/integrations/reflector.md): See EmberStack Reflector in Radar: which Secrets and ConfigMaps are sources or mirrors, where each mirror came from, how current its copy is, and configuration mistakes the controller would silently ignore.
- [Crossplane managed resource visibility](https://radarhq.io/docs/features/integrations/crossplane.md): Debug Crossplane in Radar: managed resource status for every provider, Composite and Claim views with per-resource live badges, and upstream cloud errors surfaced verbatim.
- [Velero backup & restore visibility](https://radarhq.io/docs/features/integrations/velero.md): Track Velero in Radar: Backup and Restore phases with live progress bars, scope filters, storage locations, and alerts for failed or partial backups.
- [CloudNativePG PostgreSQL cluster visibility](https://radarhq.io/docs/features/integrations/cloudnative-pg.md): Monitor CloudNativePG in Radar: PostgreSQL cluster phase, primary and replica node distribution, backup status, storage config, and failover health in one detail view.
- [Strimzi Kafka connector failure evidence](https://radarhq.io/docs/features/integrations/strimzi.md): Connector and task failures from Strimzi KafkaConnector status in Radar Issues, API and MCP, with explicit operator-snapshot limitations.
- [Knative serving & eventing visibility](https://radarhq.io/docs/features/integrations/knative.md): Trace Knative in Radar: the full Serving chain from Route through Revision to Pod, plus Eventing flows from sources through Brokers and Triggers.
- [CLI reference](https://radarhq.io/docs/configuration/cli.md): Commands and flags for running Radar, starting AI investigations, connecting a cluster to Radar Cloud, and tuning cluster access.
- [Configuration files](https://radarhq.io/docs/configuration/files.md): Where Radar stores defaults and preferences, kubeconfig precedence, and how to switch between clusters and contexts.
- [In-cluster deployment](https://radarhq.io/docs/configuration/in-cluster.md): Run Radar as a pod in your cluster for shared team access. Helm chart, ingress, RBAC opt-ins, and graceful permission degradation.
- [Authentication](https://radarhq.io/docs/configuration/authentication.md): Radar's two auth modes - proxy headers and OIDC. Writes run as the user via Kubernetes impersonation; reads are authorized by your namespace access.
- [Usage stats](https://radarhq.io/docs/configuration/usage-stats.md): Radar's opt-in, anonymous usage stats: what's sent, what never is, where it goes, and how to turn it off.
- [Radar Cloud overview](https://radarhq.io/docs/cloud/overview.md): How Radar Cloud is built - the hosted control plane, the in-cluster Radar pod, the tunnel, and what stays in your cluster vs. what goes to the cloud.
- [Connecting a cluster](https://radarhq.io/docs/cloud/connect-cluster.md): Install Radar in your Kubernetes cluster, what each Helm value does, RBAC scope, and how to verify the connection.
- [Sign-in and access: which path applies](https://radarhq.io/docs/cloud/access-overview.md): Before the SSO, members, domains and IdP-groups pages: which of them applies to your situation, and how the pieces combine.
- [Organizations & roles](https://radarhq.io/docs/cloud/organizations.md): Organizations are the tenant boundary in Cloud - they own clusters, members, billing, and audit. Three roles: owner, member, viewer.
- [Members & invitations](https://radarhq.io/docs/cloud/members.md): Invite members by email, set their role, and use domain auto-join so the right people land in your org without explicit invites.
- [SSO (SAML / OIDC)](https://radarhq.io/docs/cloud/sso.md): Self-serve SAML and OIDC setup via the WorkOS Admin Portal. Owner-only. Once configured, users in your IdP authenticate without going through email magic-link.
- [Personal access tokens](https://radarhq.io/docs/cloud/personal-access-tokens.md): Mint per-user PATs for MCP clients (Claude Code, Codex, Cursor, and others) and CI scripts. Org-pinned at mint time, SHA-256 hashed at rest, revocable any time.
- [Connected apps & MCP access](https://radarhq.io/docs/cloud/connected-apps.md): Connect external AI agents to your org over OAuth, manage their grants, and clamp the whole MCP surface to read-only with an org-wide access mode.
- [Integrations: cloud accounts as agent tools](https://radarhq.io/docs/cloud/integrations.md): Connect an AWS or Google Cloud account from Settings and the account's APIs become tools on the MCP endpoint your agents already use. Preview.
- [RBAC under Cloud mode](https://radarhq.io/docs/cloud/rbac.md): How a Cloud user's role becomes a Kubernetes identity. The radar:owner / radar:member / radar:viewer groups, the X-Forwarded-* headers, and how to override the default ClusterRoleBindings.
- [IdP group-based access](https://radarhq.io/docs/cloud/idp-groups.md): Reuse the groups you already manage in your identity provider to grant Kubernetes access through Radar. Your IdP group memberships arrive as radar:idp:<group-id> subjects you bind in your own RBAC.
- [SSO for external users](https://radarhq.io/docs/cloud/sso-external-users.md): Onboard contractors, partners, and guest users through SSO - guests who keep their own employer email sign in through your identity provider with their real address, using a per-organization sign-in link.
- [Billing & plans](https://radarhq.io/docs/cloud/billing.md): Manage your subscription, payment method and invoices.
- [Audit log](https://radarhq.io/docs/cloud/audit-log.md): Organization activity, sign-ins, credential changes, pod-terminal sessions, and MCP tool outcomes. JSON or CSV export.
- [Notifications](https://radarhq.io/docs/cloud/notifications.md): Personal email preferences, the in-app inbox, and org-level Slack / generic webhook destinations for cluster, member, and billing events.
- [Alerts](https://radarhq.io/docs/cloud/alerts.md): Rule-driven, durable alerting on top of the live Issues stream - get notified when something breaks, and keep a history of what fired after it clears.
- [Fleet views](https://radarhq.io/docs/cloud/fleet-views.md): Cross-cluster aggregates - issues, applications, search, audit checks, and package drift across every cluster connected to your org.
- [Applications across clusters (fleet view)](https://radarhq.io/docs/cloud/applications.md): Fleet Applications groups workloads by the app they belong to and folds each app across the environments and clusters it runs in - one row per app, with version skew and promotion lag at a glance.
- [Cluster token rotation](https://radarhq.io/docs/cloud/cluster-token.md): Rotate a cluster's credential without taking it offline, revoke a leaked token immediately, and recover an installation that can no longer connect.
- [Radar Cloud Self-Managed](https://radarhq.io/docs/cloud/self-hosted/index.md): Run the Radar Cloud control plane inside your own VPC. The same Go API + web app we operate at app.radarhq.io, deployed via Helm in a customer-controlled cluster.
- [Requirements](https://radarhq.io/docs/cloud/self-hosted/requirements.md): What you need before installing Radar Cloud Self-Managed.
- [Install](https://radarhq.io/docs/cloud/self-hosted/install.md): Install the self-managed control plane with Helm, then enroll your first cluster with the Radar CLI.
- [Configuration reference](https://radarhq.io/docs/cloud/self-hosted/configuration.md): Every value the chart exposes and the env var it maps to in the running control plane.
- [AI investigations](https://radarhq.io/docs/cloud/self-hosted/ai-agent.md): Run hosted AI investigations on a self-managed control plane with your own Anthropic, Amazon Bedrock, or Google Vertex AI account.
- [Authentication](https://radarhq.io/docs/cloud/self-hosted/auth.md): OIDC + the always-available break-glass admin. WorkOS is not used in Self-Managed - your IdP is the source of truth.
- [User tokens](https://radarhq.io/docs/cloud/self-hosted/user-tokens.md): Clusters call the Kubernetes API with each person's own SSO token, so the RBAC you already have decides what they can do.
- [Licensing](https://radarhq.io/docs/cloud/self-hosted/licensing.md): Install, replace and recover a self-managed license.
- [Upgrade](https://radarhq.io/docs/cloud/self-hosted/upgrade.md): Helm upgrade flow, migration safety, version-skew policy.
- [Backups](https://radarhq.io/docs/cloud/self-hosted/backups.md): What's recoverable from K8s state alone, and what needs Postgres backups.
- [Troubleshooting](https://radarhq.io/docs/cloud/self-hosted/troubleshooting.md): What to check when things go wrong. Failure modes from real installs, with the fix at the top.
- [Architecture](https://radarhq.io/docs/cloud/self-hosted/architecture.md): What runs, what connects to what, and what leaves your network.
- [Keyboard shortcuts](https://radarhq.io/docs/reference/keyboard-shortcuts.md): Every keybinding in the Radar UI - view switching, navigation, search, topology, and more. Identical between OSS and Cloud.
- [HTTP API](https://radarhq.io/docs/reference/api.md): Radar's HTTP API - the same surface the UI uses. Listed by area, with notes on Cloud-tunnel access.

## Optional

- [radarhq.io](https://radarhq.io)
- [GitHub](https://github.com/skyhook-io/radar)
- [Open app](https://app.radarhq.io)
- [Discord](https://radarhq.io/community/chat)
- [Community](https://radarhq.io/community)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.