Quick start

Want to see the dashboard before installing anything? Open the live demo — read-only, no account needed.

Prerequisites

• A Kubernetes cluster and a kubectl context with permission to create a namespace and install workloads.
• Helm 3.8 or newer (3.8+ is required for the OCI install method).
• A free StackRadar account — no credit card required.
• Outbound HTTPS (port 443) from the cluster to api.stackradar.io — the single StackRadar endpoint, used for SBOM uploads and heartbeats. (The scanner also talks to the in-cluster Kubernetes API and pulls images directly from their registries, over your own network.)

1. Get your credentials

   Sign in to the dashboard and create a cluster. A cluster-scoped API key is generated for it on the spot and shown once — copy it together with the cluster ID before closing the dialog. Each cluster gets its own key — see API keys & cluster scoping for why.

   bash

   export STACKRADAR_API_KEY=<your-api-key>
   export STACKRADAR_CLUSTER_ID=<your-cluster-id>

2. Install the scanner

   The scanner is a single Helm chart, published as an OCI package. The command below pins the current release, 0.3.0 — published versions are immutable, so the install is reproducible. Other versions are on the releases page.

   bash

   helm install stackradar-scanner \
       oci://ghcr.io/lockdep/charts/stackradar-scanner \
       --version 0.3.0 \
       --namespace stackradar --create-namespace \
       --set stackradar.apiKey=$STACKRADAR_API_KEY \
       --set stackradar.clusterId=$STACKRADAR_CLUSTER_ID

   The scanner source is published — you can read every line of what runs in your cluster on GitHub and inspect the chart on Artifact Hub.

3. Verify it's running

   Check that the scanner pod is up:

   bash

   kubectl get pods --namespace stackradar

   Once the pod is running the scanner sends its first heartbeat and the cluster shows as connected in the dashboard. It then reports the cluster's workload inventory — every namespace, workload, and container it can see, plus the Helm releases and GitOps applications that deliver them — so the dashboard immediately shows what was discovered and tracks scan coverage as SBOMs land. The first pass covers the whole cluster, not just new deploys: the scanner's initial sync sees every pod already running and queues each container image for scanning immediately, generating and uploading a CycloneDX SBOM per image. After that, coverage follows pod churn — new and restarted pods are scanned as they appear. Expect your first findings within minutes. The cluster page lists its containers grouped by namespace; the sidebar's Containers page lists every running container across all your clusters in one table, worst first, filterable by cluster and namespace.

Other setups

• Installing on a managed platform? See the guides for EKS, GKE, or AKS — or the general guide for any Kubernetes cluster, which also covers configuration, upgrades, and uninstalling.
• Cluster can't reach the public internet? See private registry & restricted-network installs.
• Something not working? See Troubleshooting.