The EU Cyber Resilience Act’s 24-hour reporting duty starts 11 September 2026. What it actually requires
Documentation menu

Akamai / Linode LKE

SBOM generation and vulnerability scanning on Akamai’s Linode Kubernetes Engine (LKE): get the kubeconfig, install the Helm chart, and verify the scanner runs.

LKE is a managed, conformant cluster with public egress. The scanner installs with the standard chart and no platform-specific configuration.

Prerequisites

  • An LKE cluster and either the Cloud Manager or linode-cli with access to it.
  • Helm 3.8+ and kubectl.
  • A free StackRadar account.

  1. Point kubectl at your Linode Kubernetes Engine (LKE) cluster

    bash
    # With linode-cli:
linode-cli lke kubeconfig-view <cluster-id> --text --no-headers | base64 -d > ~/.kube/lke.yaml
export KUBECONFIG=~/.kube/lke.yaml
kubectl get nodes

# Or download the kubeconfig from Cloud Manager → Kubernetes → your cluster.

  2. Install the scanner

    Create a cluster in the StackRadar dashboard and copy its cluster ID and cluster-scoped API key (see API keys & cluster scoping):

    bash
    export STACKRADAR_API_KEY=<your-api-key>
export STACKRADAR_CLUSTER_ID=<your-cluster-id>

    Then install the scanner chart (Helm 3.8+ for the OCI method). The command pins the current release, 0.3.0 — published versions are immutable, so the install is reproducible.

    bash
    helm install stackradar-scanner \
    oci://ghcr.io/lockdep/charts/stackradar-scanner \
    --version 0.3.0 \
    --namespace stackradar --create-namespace \
    --set stackradar.apiKey=$STACKRADAR_API_KEY \
    --set stackradar.clusterId=$STACKRADAR_CLUSTER_ID

  3. Verify

    bash
    kubectl get pods --namespace stackradar

    Once the pod is Running, the scanner sends a heartbeat and the cluster shows as connected in the dashboard. SBOMs for running workloads follow within a few minutes. If the cluster never connects, see Troubleshooting.

LKE notes

  • LKE has no integrated private registry; images usually come from Docker Hub, GHCR or a registry you run. The scanner reuses each pod’s imagePullSecrets, so a private registry that works for your pods works for the scanner.
  • Docker Hub rate limits apply to the scanner’s pulls as they do to the kubelet’s. Anonymous pulls from a busy cluster can hit the limit; a pull Secret with a Docker Hub account lifts it for both.

Images from a private registry? The scanner pulls each image itself and reuses the imagePullSecrets your pods declare. If your nodes authenticate some other way, give the scanner a credential via dockerConfigSecret — see authenticating to a private registry. No public egress at all? Same page: restricted-network installs.

What happens after install

The scanner reports the cluster's workload inventory first — namespaces, workloads, containers, plus the Helm releases and GitOps applications that deliver them — so the dashboard shows every discovered workload and its scan coverage right away. Its first pass covers the whole cluster, not just new deploys: the initial sync lists every pod already running, and each container image is queued for scanning immediately. The scanner generates a CycloneDX SBOM per image and uploads it for matching against 900K+ OSV.dev advisories, then keeps coverage current as pods start, restart, or change — no scan schedules to configure. See architecture & data flow for what runs where and exactly what data leaves the cluster.

Next steps