Scaleway Kapsule

Kapsule is a managed, conformant cluster in the EU, which pairs naturally with StackRadar’s EU-only data residency: SBOMs generated in a Paris or Amsterdam cluster are stored in the EU end to end. The scanner installs with the standard chart.

Prerequisites

• A Kapsule cluster and the scw CLI configured with a project.
• Helm 3.8+ and kubectl.
• A free StackRadar account.

1. Point kubectl at your Scaleway Kapsule cluster

   bash

   scw k8s kubeconfig install <cluster-id>
   kubectl get nodes

2. Install the scanner

   Create a cluster in the StackRadar dashboard and copy its cluster ID and cluster-scoped API key (see API keys & cluster scoping):

   bash

   export STACKRADAR_API_KEY=<your-api-key>
   export STACKRADAR_CLUSTER_ID=<your-cluster-id>

   Then install the scanner chart (Helm 3.8+ for the OCI method). The command pins the current release, 0.3.0 — published versions are immutable, so the install is reproducible.

   bash

   helm install stackradar-scanner \
       oci://ghcr.io/lockdep/charts/stackradar-scanner \
       --version 0.3.0 \
       --namespace stackradar --create-namespace \
       --set stackradar.apiKey=$STACKRADAR_API_KEY \
       --set stackradar.clusterId=$STACKRADAR_CLUSTER_ID

3. Verify

   bash

   kubectl get pods --namespace stackradar

   Once the pod is Running, the scanner sends a heartbeat and the cluster shows as connected in the dashboard. SBOMs for running workloads follow within a few minutes. If the cluster never connects, see Troubleshooting.

Scaleway notes

• Scaleway Container Registry: pods authenticate with a Secret created from a Scaleway secret key (username nologin). The scanner reuses that imagePullSecret when the pod references it; otherwise give it a dockerConfigSecret with the same credentials.
• Kosmos (multi-cloud) clusters: external nodes still run the scanner; it schedules like any other Deployment.

What happens after install

The scanner reports the cluster's workload inventory first — namespaces, workloads, containers, plus the Helm releases and GitOps applications that deliver them — so the dashboard shows every discovered workload and its scan coverage right away. Its first pass covers the whole cluster, not just new deploys: the initial sync lists every pod already running, and each container image is queued for scanning immediately. The scanner generates a CycloneDX SBOM per image and uploads it for matching against 900K+ OSV.dev advisories, then keeps coverage current as pods start, restart, or change — no scan schedules to configure. See architecture & data flow for what runs where and exactly what data leaves the cluster.