Amazon EKS

Set up continuous SBOM generation and vulnerability scanning on Amazon EKS: connect kubectl, install the StackRadar Helm chart, and verify the scanner is reporting.

Amazon EKS clusters work with StackRadar out of the box: the scanner is a normal Kubernetes workload installed with Helm, needs no AWS IAM roles, no IRSA setup, and no changes to your node groups. The only external dependency is outbound HTTPS to api.stackradar.io.

Prerequisites

An EKS cluster and the AWS CLI configured with access to it.
Helm 3.8+ and kubectl.
A free StackRadar account.

1. Point kubectl at your EKS cluster

bash

aws eks update-kubeconfig --region <region> --name <cluster-name>
kubectl get nodes

2. Install the scanner

Create a cluster in the StackRadar dashboard and copy its cluster ID and cluster-scoped API key (see API keys & cluster scoping):

bash

export STACKRADAR_API_KEY=<your-api-key>
export STACKRADAR_CLUSTER_ID=<your-cluster-id>

Then install the scanner chart (Helm 3.8+ for the OCI method):

bash

helm install stackradar-scanner \
    oci://ghcr.io/lockdep/charts/stackradar-scanner \
    --namespace stackradar --create-namespace \
    --set stackradar.apiKey=$STACKRADAR_API_KEY \
    --set stackradar.clusterId=$STACKRADAR_CLUSTER_ID

3. Verify

bash

kubectl get pods --namespace stackradar

Once the pod is Running, the scanner sends a heartbeat and the cluster shows as connected in the dashboard. SBOMs for running workloads follow within a few minutes. If the cluster never connects, see Troubleshooting.

EKS networking notes

The scanner needs to reach api.stackradar.io on port 443. What that means depends on how your VPC is set up:

Nodes in public subnets — no extra configuration needed.
Nodes in private subnets — egress must go through a NAT gateway or an egress proxy. This is the standard EKS private-subnet pattern; if your workloads can pull public container images, the scanner can reach the API too.
Egress filtering — if you restrict outbound traffic with security groups, a firewall, or an egress proxy, allow HTTPS to api.stackradar.io. It's the single endpoint used for SBOM uploads and heartbeats.

Pulling images from a private ECR registry, or running a cluster without any public egress? See private registry & restricted-network installs.

What happens after install

The scanner watches for pods starting anywhere in the cluster, generates a CycloneDX SBOM for each container image, and uploads it to StackRadar, where it's matched against 300K+ advisories from OSV.dev. There are no scheduled scan jobs to configure — coverage follows your deploys. See architecture & data flow for the details, including exactly what data leaves the cluster.