DigitalOcean DOKS

DOKS is a managed, conformant cluster with public egress by default, so the scanner installs with no networking changes. The one thing to know is how DigitalOcean Container Registry (DOCR) credentials reach pods, because the scanner pulls images itself.

Prerequisites

• A DOKS cluster and doctl authenticated (doctl auth init).
• Helm 3.8+ and kubectl.
• A free StackRadar account.

1. Point kubectl at your DigitalOcean Kubernetes (DOKS) cluster

   bash

   doctl kubernetes cluster kubeconfig save <cluster-name>
   kubectl get nodes

2. Install the scanner

   Create a cluster in the StackRadar dashboard and copy its cluster ID and cluster-scoped API key (see API keys & cluster scoping):

   bash

   export STACKRADAR_API_KEY=<your-api-key>
   export STACKRADAR_CLUSTER_ID=<your-cluster-id>

   Then install the scanner chart (Helm 3.8+ for the OCI method). The command pins the current release, 0.3.0 — published versions are immutable, so the install is reproducible.

   bash

   helm install stackradar-scanner \
       oci://ghcr.io/lockdep/charts/stackradar-scanner \
       --version 0.3.0 \
       --namespace stackradar --create-namespace \
       --set stackradar.apiKey=$STACKRADAR_API_KEY \
       --set stackradar.clusterId=$STACKRADAR_CLUSTER_ID

3. Verify

   bash

   kubectl get pods --namespace stackradar

   Once the pod is Running, the scanner sends a heartbeat and the cluster shows as connected in the dashboard. SBOMs for running workloads follow within a few minutes. If the cluster never connects, see Troubleshooting.

DigitalOcean notes

• DOCR integration: when you link a registry to a DOKS cluster in the control panel, DigitalOcean creates a registry-<name> pull Secret in the default namespace and adds it to that namespace’s default ServiceAccount. Pods in other namespaces reference it explicitly or through their own ServiceAccount. The scanner reuses imagePullSecrets listed on the pod; for images pulled via a ServiceAccount-attached Secret, give the scanner a dockerConfigSecret with a DOCR read token.
• Node pools: DOKS recycles nodes on upgrades and autoscaling. Pods move, image digests do not, so the scanner’s inventory follows the workloads and no rescan happens for an unchanged image.
• Egress: DOKS nodes have public IPs; no NAT or proxy configuration is needed to reach api.stackradar.io.

What happens after install

The scanner reports the cluster's workload inventory first — namespaces, workloads, containers, plus the Helm releases and GitOps applications that deliver them — so the dashboard shows every discovered workload and its scan coverage right away. Its first pass covers the whole cluster, not just new deploys: the initial sync lists every pod already running, and each container image is queued for scanning immediately. The scanner generates a CycloneDX SBOM per image and uploads it for matching against 900K+ OSV.dev advisories, then keeps coverage current as pods start, restart, or change — no scan schedules to configure. See architecture & data flow for what runs where and exactly what data leaves the cluster.