Radar

<a href="https://www.producthunt.com/products/radar-7?embed=true&utm_source=badge-top-post-badge&utm_medium=badge&utm_campaign=badge-radar-42edb7b0-e388-4fa8-9ba5-4876c2c0d638" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/top-post-badge.svg?post_id=1130618&theme=neutral&period=daily" alt="Radar - The missing open-source Kubernetes UI | Product Hunt" width="250" height="54" /></a>

The missing open-source Kubernetes UI. <br>Single binary. No account required. Free forever.

🌐 radarhq.io · Docs · Releases

Topology, resources, Helm, GitOps, traffic, audit, upgrade impact, and MCP context for AI agents — from your laptop or in-cluster.

<details> <summary><b>Table of contents</b></summary>

• Why Radar?
• Installation
• Usage
• Views — Topology · Resources · Image Filesystem · Timeline · Helm · Compare · TLS · GitOps · Traffic · Cost · Audit · Upgrade impact · RBAC · MCP · Auth
• Supported Resources
• Keyboard Shortcuts
• Security
• Development · Contributing

</details> <p align="center"> <img src="docs/screenshot.png" alt="Radar Screenshot" width="800"> </p>

Install and run in 30 seconds:

curl -fsSL https://get.radarhq.io | sh && kubectl radar

More installation options ↓

Why Radar?

• Zero install on your cluster — runs on your laptop, talks to the K8s API directly
• Single binary — no dependencies, no agents, no CRDs
• Fast on big clusters — tested on tens of thousands of pods, with responsive views and live updates under real cluster churn
• Private by design — your cluster data stays on your machine. No account, no agents, no cloud sync, no cluster telemetry
• Airgapped-friendly — runs as a single binary against the Kubernetes API and works in locked-down environments with outbound egress blocked
• Real-time — watches your cluster via informers, pushes updates to the browser via SSE
• Works everywhere — GKE, EKS, AKS, minikube, kind, k3s, or any conformant cluster
• AI-ready — built-in MCP server lets AI agents query your cluster through Radar
• In-cluster option — deploy with Helm for shared team access with RBAC-scoped permissions

"Have Radar deployed at work. As far as Kubernetes dashboards go, this is one of the best." — u/TheRealNetroxen

---

Installation

Quick Install:

curl -fsSL https://get.radarhq.io | sh

Homebrew:

brew install skyhook-io/tap/radar

Then run: kubectl radar. Quick install, PowerShell, Homebrew, and Scoop also set up the radar shorthand. Krew and direct downloads use kubectl radar unless you add your own radar symlink.

<details> <summary><b>More install options</b> — Desktop App (macOS/Linux/Windows), Krew, Scoop, In-Cluster Helm</summary>

CLI

Krew (kubectl plugin manager):

kubectl krew install radar

Scoop (Windows):

scoop bucket add skyhook https://github.com/skyhook-io/scoop-bucket
scoop install radar

PowerShell (Windows):

irm https://get.radarhq.io/install.ps1 | iex

Direct download — GitHub Releases for macOS, Linux, or Windows.

Desktop App

Native desktop app — no terminal needed.

Homebrew (macOS):

brew install --cask skyhook-io/tap/radar-desktop

Debian/Ubuntu — download the .deb from GitHub Releases, then:

sudo apt install ./radar-desktop_*.deb

Fedora/RHEL — download the .rpm from GitHub Releases, then:

sudo rpm -i radar-desktop_*.rpm

Scoop (Windows):

scoop bucket add skyhook https://github.com/skyhook-io/scoop-bucket
scoop install radar-desktop

Windows (direct download) — GitHub Releases.

In-Cluster Deployment

Deploy to your cluster for shared team access:

helm repo add skyhook https://skyhook-io.github.io/helm-charts
helm install radar skyhook/radar -n radar --create-namespace

See the In-Cluster Deployment Guide for ingress, authentication, and RBAC configuration.

Gateway API HTTPRoute

Chart supports optional Gateway API HTTPRoute generation. Enable httpRoute.enabled, set parentRefs, and use httpRoute.rules for multiple path prefixes, per-route timeouts, filters, or custom backends. hostnames defaults to an empty list, and apiVersion can be overridden for older Gateway API installations. The generated default route has no chart-imposed timeout, so the Gateway deployment default applies. Set httpRoute.defaultTimeout for an explicit timeout; custom rules can define their own timeouts.

ingress and httpRoute are mutually exclusive: enabling both stops the install with an error, so enable only one. When httpRoute is enabled you must set at least one parentRefs entry (the Gateway the route attaches to); otherwise the install fails instead of creating an HTTPRoute that is attached to no Gateway.

httpRoute:
  enabled: true
  parentRefs:
    - name: public-gateway
  hostnames: []
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: radar
          port: 9280

See the Helm Chart README for full configuration details and timeout examples.

</details>

---

Usage

# Opens browser automatically
kubectl radar

# Quick install, PowerShell, Homebrew, and Scoop also set up the bare command
radar

To inspect an in-cluster Radar Cloud installation without changing it:

radar cloud status
radar cloud status --context my-cluster
radar cloud status --context my-cluster --namespace radar --release radar

The command reports installation ownership, chart and image, agent readiness, and Cloud configuration without printing the connection token. Passing both --namespace and --release selects an exact installation. Live tunnel status is reported by Radar Cloud using the token in the referenced Kubernetes Secret. If the Secret or Hub is unavailable, local installation diagnostics still run. Interactive terminals use restrained status colors; set NO_COLOR (or pipe the output) for plain text. URLs, tokens, and suggested commands remain unstyled.

CLI Flags

| Flag | Default | Description | |------|---------|-------------| | --kubeconfig | ~/.kube/config | Path to kubeconfig file | | --kubeconfig-dir | | Comma-separated directories containing kubeconfig files | | --namespace | (all) | Initial namespace filter (supports multi-select in the UI; also used as RBAC fallback for namespace-scoped users) | | --namespaces | (all) | Initial namespace filters as a comma-separated list, e.g. --namespaces ns1,ns2,ns3. Use this when your identity can list resources in specific namespaces but cannot list namespaces cluster-wide. | | --namespace-scope | false | Pin namespaced informer caches to a single namespace for large clusters (scoping to multiple namespaces is not supported yet). Requires --namespace, a kubeconfig context namespace, or a saved local single-namespace pick. Local mode can rebuild the cache when switching namespaces; auth/cloud mode locks the shared cache to the startup namespace. | | --port | 9280 | Server port | | --listen-address | 127.0.0.1 | HTTP listen address. Use 127.0.0.1 or localhost for local-only access; use 0.0.0.0 explicitly for containers, VMs, WSL, or remote/shared access, together with authentication and network controls. | | --base-path | | Serve Radar under a URL prefix such as /radar. Use when an ingress forwards a subpath without stripping it — everything, including /api/health, moves under the prefix. Not supported with --cloud-url. | | --no-browser | false | Don't auto-open browser | | --browser | | Browser to use when opening the UI, e.g. firefox, google-chrome, or Google Chrome on macOS | | --timeline-storage | memory | Timeline storage backend: memory or sqlite | | --timeline-db | ~/.radar/timeline.db | Path to SQLite database (when using sqlite storage) | | --timeline-max-size | 1Gi | Maximum SQLite DB + WAL size before pruning oldest events (e.g. 800Mi, 8Gi; 0 disables) | | --history-limit | 10000 | Maximum events to retain in timeline | | --disable-exec | false | Disable terminal and debug shell | | --disable-helm-write | false | Disable Helm write operations | | --disable-local-terminal | false | Disable local terminal feature | | --debug-image | busybox:latest | Image for ephemeral debug containers and node debug pods. If built-in restricted PodSecurity rejects the default pod debug container, Radar retries with a restricted-compatible Linux security context using the target/pod non-root UID, or UID 65532 by default; point at a compatible mirror for air-gapped / private-registry clusters. | | --list-page-size | 0 (off) | Paginate the initial LIST of high-cardinality kinds (Pods, ReplicaSets) at this size. Helps very large clusters that fail to sync; only used when WatchList streaming is unavailable. Try 2000. | | --context-switch-timeout | 30s | Maximum time a kubeconfig context switch may take. Widen on high-latency control planes — see Tuning for slow clusters. Env: RADAR_CONTEXT_SWITCH_TIMEOUT. | | --first-paint-backstop | 5m | Hard upper bound on the initial critical-cache sync wait before Radar falls through to a partial-data render. Env: RADAR_FIRST_PAINT_BACKSTOP. | | --namespace-list-timeout | 5s | Timeout for the cluster-wide namespace LIST used to decide if the user is RBAC-namespace-restricted. A timeout on a slow control plane is misreported in the UI as "Limited list — RBAC". Env: RADAR_NAMESPACE_LIST_TIMEOUT. | | --max-scope-candidates | 20 | Cap on the namespace-fallback probe fanout (used by accounts that can list namespaces cluster-wide but not list a specific kind cluster-wide). Raise above 20 for clusters with more than 20 namespaces. Env: RADAR_MAX_SCOPE_CANDIDATES. | | --prometheus-url | (auto-discover) | Manual Prometheus/VictoriaMetrics URL (skips auto-discovery) | | --prometheus-header | | HTTP header sent with every Prometheus request, format Key=Value (repeatable). Required for auth-protected backends. | | --prometheus-header-from-env | | HTTP header sent with every Prometheus request, sourced from an environment variable, format Key=ENV_VAR (repeatable). | | `--aut