Azure AKS

Set up continuous SBOM generation and vulnerability scanning on Azure Kubernetes Service: connect kubectl, install the StackRadar Helm chart, and verify the scanner is reporting.

Azure Kubernetes Service clusters work with StackRadar out of the box: the scanner installs with Helm like any other workload and needs no Azure managed identities, RBAC role assignments, or node pool changes. The only external dependency is outbound HTTPS to api.stackradar.io.

Prerequisites

An AKS cluster and the Azure CLI signed in with access to it.
Helm 3.8+ and kubectl.
A free StackRadar account.

1. Point kubectl at your AKS cluster

bash

az aks get-credentials --resource-group <resource-group> --name <cluster-name>
kubectl get nodes

2. Install the scanner

Create a cluster in the StackRadar dashboard and copy its cluster ID and cluster-scoped API key (see API keys & cluster scoping):

bash

export STACKRADAR_API_KEY=<your-api-key>
export STACKRADAR_CLUSTER_ID=<your-cluster-id>

Then install the scanner chart (Helm 3.8+ for the OCI method):

bash

helm install stackradar-scanner \
    oci://ghcr.io/lockdep/charts/stackradar-scanner \
    --namespace stackradar --create-namespace \
    --set stackradar.apiKey=$STACKRADAR_API_KEY \
    --set stackradar.clusterId=$STACKRADAR_CLUSTER_ID

3. Verify

bash

kubectl get pods --namespace stackradar

Once the pod is Running, the scanner sends a heartbeat and the cluster shows as connected in the dashboard. SBOMs for running workloads follow within a few minutes. If the cluster never connects, see Troubleshooting.

AKS networking notes

Default outbound (load balancer or NAT gateway) — no extra configuration needed.
User-defined routing through Azure Firewall — clusters using outboundType: userDefinedRouting filter egress. Add an application rule allowing HTTPS to api.stackradar.io; it's the single endpoint used for SBOM uploads and heartbeats.
Private clusters — a private API server endpoint doesn't affect the scanner (it talks to the in-cluster API service), but node egress still needs a path to api.stackradar.io.

Pulling images only from a private Azure Container Registry, or running without public egress? See private registry & restricted-network installs.

What happens after install

The scanner watches pods starting across all namespaces, generates a CycloneDX SBOM per container image, and uploads it to StackRadar for matching against 300K+ OSV.dev advisories. Node image upgrades, cluster autoscaler churn, and new node pools need no reconfiguration — scanning follows pod starts, not infrastructure. See architecture & data flow for exactly what data leaves the cluster.