Radar
The missing open-source Kubernetes UI. Single binary. No account required. Free forever.
🌐 radarhq.io · Docs · Releases
Topology, resources, Helm, GitOps, traffic, audit, and MCP context for AI agents — from your laptop or in-cluster.
- Why Radar?
- Installation
- Usage
- Views — Topology · Resources · Image Filesystem · Timeline · Helm · Compare · TLS · GitOps · Traffic · Cost · Audit · RBAC · MCP · Auth
- Supported Resources
- Keyboard Shortcuts
- Security
- Development · Contributing
Install and run in 30 seconds:
curl -fsSL https://get.radarhq.io | sh && kubectl radar
Why Radar?
- Zero install on your cluster — runs on your laptop, talks to the K8s API directly
- Single binary — no dependencies, no agents, no CRDs
- Fast on big clusters — tested on tens of thousands of pods, with responsive views and live updates under real cluster churn
- Private by design — your cluster data stays on your machine. No account, no agents, no cloud sync, no cluster telemetry
- Airgapped-friendly — runs as a single binary against the Kubernetes API and works in locked-down environments with outbound egress blocked
- Real-time — watches your cluster via informers, pushes updates to the browser via SSE
- Works everywhere — GKE, EKS, AKS, minikube, kind, k3s, or any conformant cluster
- AI-ready — built-in MCP server lets AI agents query your cluster through Radar
- In-cluster option — deploy with Helm for shared team access with RBAC-scoped permissions
"Have Radar deployed at work. As far as Kubernetes dashboards go, this is one of the best." — u/TheRealNetroxen
Installation
Quick Install:
curl -fsSL https://get.radarhq.io | sh
Homebrew:
brew install skyhook-io/tap/radar
Then run: kubectl radar. Quick install, PowerShell, Homebrew, and Scoop also set up the radar shorthand. Krew and direct downloads use kubectl radar unless you add your own radar symlink.
CLI
Krew (kubectl plugin manager):
kubectl krew install radar
Scoop (Windows):
scoop bucket add skyhook https://github.com/skyhook-io/scoop-bucket
scoop install radar
PowerShell (Windows):
irm https://get.radarhq.io/install.ps1 | iex
Direct download — GitHub Releases for macOS, Linux, or Windows.
Desktop App
Native desktop app — no terminal needed.
Homebrew (macOS):
brew install --cask skyhook-io/tap/radar-desktop
Debian/Ubuntu — download the .deb from GitHub Releases, then:
sudo apt install ./radar-desktop_*.deb
Fedora/RHEL — download the .rpm from GitHub Releases, then:
sudo rpm -i radar-desktop_*.rpm
Scoop (Windows):
scoop bucket add skyhook https://github.com/skyhook-io/scoop-bucket
scoop install radar-desktop
Windows (direct download) — GitHub Releases.
In-Cluster Deployment
Deploy to your cluster for shared team access:
helm repo add skyhook https://skyhook-io.github.io/helm-charts
helm install radar skyhook/radar -n radar --create-namespace
See the In-Cluster Deployment Guide for ingress, authentication, and RBAC configuration.
Usage
# Opens browser automatically
kubectl radar
# Quick install, PowerShell, Homebrew, and Scoop also set up the bare command
radar
To inspect an in-cluster Radar Cloud installation without changing it:
radar cloud status
radar cloud status --context my-cluster
radar cloud status --context my-cluster --namespace radar --release radar
The command reports installation ownership, chart and image, agent readiness,
and Cloud configuration without printing the connection token. Passing both
--namespace and --release selects an exact installation. Live tunnel status
is reported by Radar Cloud using the token in the referenced Kubernetes Secret.
If the Secret or Hub is unavailable, local installation diagnostics still run.
Interactive terminals use restrained status colors; set NO_COLOR (or pipe the
output) for plain text. URLs, tokens, and suggested commands remain unstyled.
CLI Flags
| Flag | Default | Description |
|---|---|---|
--kubeconfig |
~/.kube/config |
Path to kubeconfig file |
--kubeconfig-dir |
Comma-separated directories containing kubeconfig files | |
--namespace |
(all) | Initial namespace filter (supports multi-select in the UI; also used as RBAC fallback for namespace-scoped users) |
--namespaces |
(all) | Initial namespace filters as a comma-separated list, e.g. --namespaces ns1,ns2,ns3. Use this when your identity can list resources in specific namespaces but cannot list namespaces cluster-wide. |
--namespace-scope |
false |
Pin namespaced informer caches to a single namespace for large clusters (scoping to multiple namespaces is not supported yet). Requires --namespace, a kubeconfig context namespace, or a saved local single-namespace pick. Local mode can rebuild the cache when switching namespaces; auth/cloud mode locks the shared cache to the startup namespace. |
--port |
9280 |
Server port |
--listen-address |
127.0.0.1 |
HTTP listen address. Use 127.0.0.1 or localhost for local-only access; use 0.0.0.0 explicitly for containers, VMs, WSL, or remote/shared access, together with authentication and network controls. |
--no-browser |
false |
Don't auto-open browser |
--browser |
Browser to use when opening the UI, e.g. firefox, google-chrome, or Google Chrome on macOS |
|
--timeline-storage |
memory |
Timeline storage backend: memory or sqlite |
--timeline-db |
~/.radar/timeline.db |
Path to SQLite database (when using sqlite storage) |
--timeline-max-size |
1Gi |
Maximum SQLite DB + WAL size before pruning oldest events (e.g. 800Mi, 8Gi; 0 disables) |
--history-limit |
10000 |
Maximum events to retain in timeline |
--disable-exec |
false |
Disable terminal and debug shell |
--disable-helm-write |
false |
Disable Helm write operations |
--disable-local-terminal |
false |
Disable local terminal feature |
--debug-image |
busybox:latest |
Image for ephemeral debug containers and node debug pods. If built-in restricted PodSecurity rejects the default pod debug container, Radar retries with a restricted-compatible Linux security context using the target/pod non-root UID, or UID 65532 by default; point at a compatible mirror for air-gapped / private-registry clusters. |
--list-page-size |
0 (off) |
Paginate the initial LIST of high-cardinality kinds (Pods, ReplicaSets) at this size. Helps very large clusters that fail to sync; only used when WatchList streaming is unavailable. Try 2000. |
--context-switch-timeout |
30s |
Maximum time a kubeconfig context switch may take. Widen on high-latency control planes — see Tuning for slow clusters. Env: RADAR_CONTEXT_SWITCH_TIMEOUT. |
--first-paint-backstop |
5m |
Hard upper bound on the initial critical-cache sync wait before Radar falls through to a partial-data render. Env: RADAR_FIRST_PAINT_BACKSTOP. |
--namespace-list-timeout |
5s |
Timeout for the cluster-wide namespace LIST used to decide if the user is RBAC-namespace-restricted. A timeout on a slow control plane is misreported in the UI as "Limited list — RBAC". Env: RADAR_NAMESPACE_LIST_TIMEOUT. |
--max-scope-candidates |
20 |
Cap on the namespace-fallback probe fanout (used by accounts that can list namespaces cluster-wide but not list a specific kind cluster-wide). Raise above 20 for clusters with more than 20 namespaces. Env: RADAR_MAX_SCOPE_CANDIDATES. |
--prometheus-url |
(auto-discover) | Manual Prometheus/VictoriaMetrics URL (skips auto-discovery) |
--prometheus-header |
HTTP header sent with every Prometheus request, format Key=Value (repeatable). Required for auth-protected backends. |
|
| `--promet |