kubeadm / on-prem

Self-managed clusters are where the in-cluster model earns its keep: there is no cloud provider API for an agentless scanner to read, so tools that scan from the cloud side cannot see an on-prem cluster at all. The StackRadar scanner runs inside the cluster and needs only the Kubernetes API and outbound HTTPS.

Prerequisites

• A conformant cluster (kubeadm, Kubespray, or equivalent) on a supported Kubernetes version.
• The admin kubeconfig, or a kubeconfig with rights to create a namespace and cluster-scoped RBAC for the scanner.
• Helm 3.8+ and kubectl.
• A free StackRadar account.

1. Point kubectl at your kubeadm and self-managed clusters cluster

   bash

   # On a control-plane node:
   export KUBECONFIG=/etc/kubernetes/admin.conf
   kubectl get nodes
   
   # Or copy it to your workstation:
   scp root@<control-plane>:/etc/kubernetes/admin.conf ~/.kube/config

2. Install the scanner

   Create a cluster in the StackRadar dashboard and copy its cluster ID and cluster-scoped API key (see API keys & cluster scoping):

   bash

   export STACKRADAR_API_KEY=<your-api-key>
   export STACKRADAR_CLUSTER_ID=<your-cluster-id>

   Then install the scanner chart (Helm 3.8+ for the OCI method). The command pins the current release, 0.3.0 — published versions are immutable, so the install is reproducible.

   bash

   helm install stackradar-scanner \
       oci://ghcr.io/lockdep/charts/stackradar-scanner \
       --version 0.3.0 \
       --namespace stackradar --create-namespace \
       --set stackradar.apiKey=$STACKRADAR_API_KEY \
       --set stackradar.clusterId=$STACKRADAR_CLUSTER_ID

3. Verify

   bash

   kubectl get pods --namespace stackradar

   Once the pod is Running, the scanner sends a heartbeat and the cluster shows as connected in the dashboard. SBOMs for running workloads follow within a few minutes. If the cluster never connects, see Troubleshooting.

On-prem notes

• Egress: the scanner needs HTTPS to api.stackradar.io and to whichever registries your images come from. Behind a corporate proxy, set proxy.httpsProxy (with the scheme) and, for a TLS-intercepting proxy, mount your CA bundle with caBundle.configMapName — both are chart values.
• Private registries (Harbor, Nexus, Artifactory, a plain registry:2): the scanner reuses the imagePullSecrets on each pod. If your nodes authenticate via containerd config instead, the pods carry no Secret and the scanner needs a dockerConfigSecret of its own.
• Pod Security Admission: the chart’s defaults satisfy the restricted profile, so a namespace labelled pod-security.kubernetes.io/enforce=restricted admits the scanner without changes.
• Storage: the scanner uses an emptyDir scratch volume for image layers while generating SBOMs. No PersistentVolume is needed; the SBOMs are uploaded and the scratch space is discarded.

What happens after install

The scanner reports the cluster's workload inventory first — namespaces, workloads, containers, plus the Helm releases and GitOps applications that deliver them — so the dashboard shows every discovered workload and its scan coverage right away. Its first pass covers the whole cluster, not just new deploys: the initial sync lists every pod already running, and each container image is queued for scanning immediately. The scanner generates a CycloneDX SBOM per image and uploads it for matching against 900K+ OSV.dev advisories, then keeps coverage current as pods start, restart, or change — no scan schedules to configure. See architecture & data flow for what runs where and exactly what data leaves the cluster.