Radar

<a href="https://www.producthunt.com/products/radar-7?embed=true&utm_source=badge-top-post-badge&utm_medium=badge&utm_campaign=badge-radar-42edb7b0-e388-4fa8-9ba5-4876c2c0d638" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/top-post-badge.svg?post_id=1130618&theme=neutral&period=daily" alt="Radar - The missing open-source Kubernetes UI | Product Hunt" width="250" height="54" /></a>

The missing open-source Kubernetes UI. <br>Single binary. No account required. Free forever.

🌐 radarhq.io · Docs · Releases

Topology, resources, Helm, GitOps, traffic, audit, upgrade impact, and MCP context for AI agents — from your laptop or in-cluster.

<details> <summary><b>Table of contents</b></summary>

• Why Radar?
• Installation
• Usage
• Views — Topology · Resources · Image Filesystem · Timeline · Helm · Compare · TLS · GitOps · Traffic · Cost · Audit · Upgrade impact · RBAC · MCP · Auth
• Supported Resources
• Keyboard Shortcuts
• Security
• Development · Contributing

</details> <p align="center"> <img src="docs/screenshot.png" alt="Radar Screenshot" width="800"> </p>

Install and run in 30 seconds:

curl -fsSL https://get.radarhq.io | sh && kubectl radar

More installation options ↓

Why Radar?

• Zero install on your cluster — runs on your laptop, talks to the K8s API directly
• Single binary — no dependencies, no agents, no CRDs
• Fast on big clusters — tested on tens of thousands of pods, with responsive views and live updates under real cluster churn
• Private by design — your cluster data stays on your machine. No account, no agents, no cloud sync, no cluster telemetry
• Airgapped-friendly — runs as a single binary against the Kubernetes API and works in locked-down environments with outbound egress blocked
• Real-time — watches your cluster via informers, pushes updates to the browser via SSE
• Works everywhere — GKE, EKS, AKS, minikube, kind, k3s, or any conformant cluster
• AI-ready — built-in MCP server lets AI agents inspect, investigate, and operate your cluster through Radar
• In-cluster option — deploy with Helm for shared team access with RBAC-scoped permissions

"Have Radar deployed at work. As far as Kubernetes dashboards go, this is one of the best." — u/TheRealNetroxen

---

Installation

Quick Install:

curl -fsSL https://get.radarhq.io | sh

Homebrew:

brew install skyhook-io/tap/radar

Then run: kubectl radar. Quick install, PowerShell, Homebrew, and Scoop also set up the radar shorthand. Krew and direct downloads use kubectl radar unless you add your own radar symlink.

<details> <summary><b>More install options</b> — Desktop App (macOS/Linux/Windows), Krew, Scoop, In-Cluster Helm</summary>

CLI

Krew (kubectl plugin manager):

kubectl krew install radar

Scoop (Windows):

scoop bucket add skyhook https://github.com/skyhook-io/scoop-bucket
scoop install radar

PowerShell (Windows):

irm https://get.radarhq.io/install.ps1 | iex

Custom install location (macOS/Linux):

curl -fsSL https://get.radarhq.io | INSTALL_DIR="$HOME/.local/bin" sh

Quick install writes to /usr/local/bin unless INSTALL_DIR says otherwise. The directory is created if missing, and needs to be on your PATH for radar and kubectl radar to resolve.

Direct download — GitHub Releases for macOS, Linux, or Windows.

Desktop App

Native desktop app — no terminal needed.

Homebrew (macOS):

brew install --cask skyhook-io/tap/radar-desktop

Debian/Ubuntu — download the .deb from GitHub Releases, then:

sudo apt install ./radar-desktop_*.deb

Fedora/RHEL — download the .rpm from GitHub Releases, then:

sudo rpm -i radar-desktop_*.rpm

Scoop (Windows):

scoop bucket add skyhook https://github.com/skyhook-io/scoop-bucket
scoop install radar-desktop

Windows (direct download) — GitHub Releases.

In-Cluster Deployment

Deploy to your cluster for shared team access:

helm repo add skyhook https://skyhook-io.github.io/helm-charts
helm install radar skyhook/radar -n radar --create-namespace

See the In-Cluster Deployment Guide for Gateway API and ingress exposure, authentication, and RBAC configuration.

</details>

---

Usage

# Opens browser automatically
kubectl radar

# Quick install, PowerShell, Homebrew, and Scoop also set up the bare command
radar

To inspect an in-cluster Radar Cloud installation without changing it:

radar cloud status
radar cloud status --context my-cluster
radar cloud status --context my-cluster --namespace radar --release radar

The command reports installation ownership, chart and image, agent readiness, and Cloud configuration without printing the connection token. Passing both --namespace and --release selects an exact installation. Live tunnel status is reported by Radar Cloud using the token in the referenced Kubernetes Secret. If the Secret or Hub is unavailable, local installation diagnostics still run. Interactive terminals use restrained status colors; set NO_COLOR (or pipe the output) for plain text. URLs, tokens, and suggested commands remain unstyled.

CLI Flags

The table below covers common startup flags. See the full CLI reference; radar --help is authoritative for the installed version.

| Flag | Default | Description | |------|---------|-------------| | --kubeconfig | ~/.kube/config | Path to primary kubeconfig file | | --kubeconfig-dir | | Comma-separated directories containing additional kubeconfig files | | --namespace | (all) | Initial namespace filter (supports multi-select in the UI; also used as RBAC fallback for namespace-scoped users) | | --namespaces | (all) | Initial namespace filters as a comma-separated list, e.g. --namespaces ns1,ns2,ns3. Use this when your identity can list resources in specific namespaces but cannot list namespaces cluster-wide. | | --namespace-scope | false | Pin namespaced informer caches to a single namespace for large clusters (scoping to multiple namespaces is not supported yet). Requires --namespace, a kubeconfig context namespace, or a saved local single-namespace pick. Local mode can rebuild the cache when switching namespaces; auth/cloud mode locks the shared cache to the startup namespace. | | --port | 9280 | Server port | | --listen-address | 127.0.0.1 | HTTP listen IP address (IPv4 or IPv6), or localhost. Bind a specific local IP or use 0.0.0.0 for all interfaces. Non-loopback access needs authentication and network controls. | | --base-path | | Serve Radar under a URL prefix such as /radar. Use when an ingress forwards a subpath without stripping it — everything, including /api/health, moves under the prefix. Not supported with --cloud-url. | | --no-browser | false | Don't auto-open browser | | --browser | | Browser to use when opening the UI, e.g. firefox, google-chrome, or Google Chrome on macOS | | --timeline-storage | memory | Timeline storage backend: memory, sqlite, or postgres | | --timeline-db | ~/.radar/timeline.db | Path to SQLite database (when using sqlite storage) | | --timeline-max-size | 1Gi | Maximum SQLite DB + WAL size before pruning oldest events (e.g. 800Mi, 8Gi; 0 disables) | | --history-limit | 10000 | Maximum events to retain in timeline (memory only) | | --disable-exec | false | Disable terminal and debug shell | | --disable-helm-write | false | Disable Helm write operations | | --disable-local-terminal | false | Disable the host local terminal | | --debug-image | busybox:latest | Image for ephemeral debug containers and node debug pods. If built-in restricted PodSecurity rejects the default pod debug container, Radar retries with a restricted-compatible Linux security context using the target/pod non-root UID, or UID 65532 by default; point at a compatible mirror for air-gapped / private-registry clusters. | | --list-page-size | 0 (off) | Paginate the initial LIST of high-cardinality kinds (Pods, ReplicaSets) at this size. Helps very large clusters that fail to sync; only used when WatchList streaming is unavailable. Try 2000. | | --context-switch-timeout | 30s | Maximum time a kubeconfig context switch may take. Widen on high-latency control planes — see Tuning for slow clusters. Env: RADAR_CONTEXT_SWITCH_TIMEOUT. | | --first-paint-backstop | 5m | Hard upper bound on the initial critical-cache sync wait before Radar falls through to a partial-data render. Env: RADAR_FIRST_PAINT_BACKSTOP. | | --namespace-list-timeout | 5s | Timeout for the cluster-wide namespace LIST used to decide if the user is RBAC-namespace-restricted. A timeout on a slow control plane is misreported in the UI as "Limited list — RBAC". Env: RADAR_NAMESPACE_LIST_TIMEOUT. | | --max-scope-candidates | 20 | Cap on the namespace-fallback probe fanout (used by accounts that can list namespaces cluster-wide but not list a specific kind cluster-wide). Raise above 20 for clusters with more than 20 namespaces. Env: RADAR_MAX_SCOPE_CANDIDATES. | | --prometheus-url | (auto-discover) | Manual PromQL-compatible query URL, including Prometheus, VictoriaMetrics, Thanos, or Mimir (skips auto-discovery) | | --prometheus-single-cluster | false | Optional workload-metrics scope override: assert that the backend contains only this cluster. Replaces automatic identity matching; does not scope rightsizing or other metrics features. Scope and lifetime. | | --prometheus-cluster-label | (automatic matching) | Optional workload-metrics override for a shared backend, e.g. cluster=production (repeatable, ANDed). Alternative to --prometheus-single-cluster; leave both unset for automatic matching. Not persisted. | | --prometheus-header | | HTTP header sent with every Prometheus request, format Key=Value (repeatable). Required for auth-protected backends. | | --prometheus-header-from-env | | HTTP header sent with every Prometheus request, sourced from an environment variable, format Key=ENV_VAR (repeatable). | | --beyla-job-selector | (empty) | Beyla Live Traffic matcher fragme