Documentation
Everything you need to run StackRadar: install the scanner in your Kubernetes clusters, understand exactly how SBOM generation and vulnerability matching work, manage your team, plan, and data, and fix problems when they come up.
Pick your path
- Install the scannerOne Helm command in any Kubernetes cluster. Guides for EKS, GKE, AKS, restricted networks and a dozen distributions.Start here
- Understand the resultsWhat runs in your cluster and what leaves it, how SBOMs are matched to advisories, and how the Radar Score ranks what to fix first.Start here
- Manage your accountOrganizations and roles, API keys and cluster scoping, plan history windows, and deleting your data.Start here
All pages
Getting started
Installation
- Any Kubernetes clusterWhat the StackRadar scanner needs from any conformant Kubernetes cluster — k3s, kubeadm, OpenShift, Rancher or managed cloud — plus upgrades and uninstall.
- Amazon EKSContinuous SBOM generation and vulnerability scanning on Amazon EKS: connect kubectl, install the StackRadar Helm chart, and verify the scanner reports.
- Google GKEContinuous SBOM generation and vulnerability scanning on Google GKE: connect kubectl, install the StackRadar Helm chart, and verify the scanner reports.
- Azure AKSContinuous SBOM generation and vulnerability scanning on Azure AKS: connect kubectl, install the StackRadar Helm chart, and verify the scanner reports.
- Private registries & restricted networksRun the StackRadar scanner behind private registries or restricted egress: registry credentials, chart and image mirroring, proxies, and the endpoint to allow.
Platform guides
- k3sInstall the StackRadar scanner on k3s: find the kubeconfig, install the Helm chart, and get a CycloneDX SBOM and ranked vulnerabilities for every running image.
- RKE2 / RancherInstall the StackRadar scanner on RKE2 or any Rancher-managed cluster: kubeconfig locations, the Rancher install path, CIS-hardened profiles, what to expect.
- Red Hat OpenShiftInstall the StackRadar scanner on OpenShift: log in with oc, adjust the pod security context for restricted-v2, handle the internal registry, verify it reports.
- kubeadm / on-premInstall the StackRadar scanner on a self-managed cluster built with kubeadm, Kubespray or by hand: kubeconfig, egress, private registries, and security context.
- Talos LinuxInstall the StackRadar scanner on Talos Linux: get a kubeconfig with talosctl, install the Helm chart, and get a CycloneDX SBOM and ranked findings per image.
- DigitalOcean DOKSSBOM generation and vulnerability scanning on DigitalOcean Kubernetes (DOKS): connect kubectl with doctl, install the Helm chart, and handle DOCR credentials.
- Akamai / Linode LKESBOM generation and vulnerability scanning on Akamai’s Linode Kubernetes Engine (LKE): get the kubeconfig, install the Helm chart, and verify the scanner runs.
- CivoSBOM generation and vulnerability scanning on Civo Kubernetes (k3s or Talos): save the kubeconfig with the civo CLI, install the Helm chart, verify it reports.
- Scaleway KapsuleSBOM generation and vulnerability scanning on Scaleway Kapsule: install the kubeconfig with scw, install the Helm chart, and handle Scaleway registry logins.
- kind (local evaluation)Evaluate the StackRadar scanner on a local kind cluster: create the cluster, deploy something to scan, install the chart with one Helm command, see your first findings within minutes.
How it works
- Architecture & data flowHow the StackRadar scanner works: what runs in your cluster, exactly what data leaves it, how SBOMs are matched to vulnerabilities, and where data is stored.
- Vulnerability matchingHow StackRadar matches SBOM components against 900K+ OSV.dev advisories: PURL matching, version-range evaluation from npm to Debian and RPM, and confidence.
- The Radar ScoreHow the Radar Score uses the EPSS score, the CISA KEV catalogue and CVSS to rank what to fix first — the published formula, worked examples, and the thresholds that matter.
- CycloneDX SBOM formatA real, downloadable CycloneDX 1.6 SBOM example generated from a container image, with a field-by-field walkthrough: components, PURLs, the dependency graph, and what a scanner reads.
Your account
- Organizations & membersHow StackRadar organizations work: the roles and what each allows, inviting teammates by email, accepting an invite, and removing members.
- Plans, retention & deletionWhat each StackRadar plan’s history window keeps, what happens when you downgrade or cancel, and how to delete clusters, organizations, and all stored data.
Reference
- API keys & cluster scopingHow StackRadar API keys work: one cluster-scoped key per cluster, why every scanner request requires one, and how to get and rotate keys safely.
- TroubleshootingFixes for common StackRadar scanner issues: 401/403 API errors, a cluster that never appears in the dashboard, Helm install failures, and missing SBOMs.