Google GKE

Set up continuous SBOM generation and vulnerability scanning on Google Kubernetes Engine: connect kubectl, install the StackRadar Helm chart, and verify the scanner is reporting.

Google Kubernetes Engine clusters work with StackRadar out of the box: the scanner installs with Helm like any other workload and needs no GCP service accounts, Workload Identity bindings, or node pool changes. The only external dependency is outbound HTTPS to api.stackradar.io.

Prerequisites

A GKE cluster and the gcloud CLI with the gke-gcloud-auth-plugin installed.
Helm 3.8+ and kubectl.
A free StackRadar account.

1. Point kubectl at your GKE cluster

bash

gcloud container clusters get-credentials <cluster-name> \
    --region <region> --project <project-id>
kubectl get nodes

2. Install the scanner

Create a cluster in the StackRadar dashboard and copy its cluster ID and cluster-scoped API key (see API keys & cluster scoping):

bash

export STACKRADAR_API_KEY=<your-api-key>
export STACKRADAR_CLUSTER_ID=<your-cluster-id>

Then install the scanner chart (Helm 3.8+ for the OCI method):

bash

helm install stackradar-scanner \
    oci://ghcr.io/lockdep/charts/stackradar-scanner \
    --namespace stackradar --create-namespace \
    --set stackradar.apiKey=$STACKRADAR_API_KEY \
    --set stackradar.clusterId=$STACKRADAR_CLUSTER_ID

3. Verify

bash

kubectl get pods --namespace stackradar

Once the pod is Running, the scanner sends a heartbeat and the cluster shows as connected in the dashboard. SBOMs for running workloads follow within a few minutes. If the cluster never connects, see Troubleshooting.

GKE networking notes

Public clusters — no extra configuration needed.
Private clusters — nodes have no public IPs, so outbound traffic to api.stackradar.io must go through Cloud NAT or an egress proxy. If your workloads can pull images from public registries, the scanner can reach the API too.
Egress filtering — with VPC firewall rules, VPC Service Controls, or an egress proxy in place, allow HTTPS (port 443) to api.stackradar.io. That is the single endpoint used for SBOM uploads and heartbeats.

Pulling images only from a private Artifact Registry, or running without public egress? See private registry & restricted-network installs.

What happens after install

The scanner watches pods starting across all namespaces, generates a CycloneDX SBOM per container image, and uploads it to StackRadar for matching against 300K+ OSV.dev advisories. New GKE node pools, spot/preemptible node churn, and autoscaling events need no reconfiguration — scanning follows pod starts, not infrastructure. See architecture & data flow for exactly what data leaves the cluster.