Skip to content

KubeBuddy CLI + Radar Integration (Pro)

Use this guide to upload KubeBuddy JSON scan results into KubeBuddy Radar and to pull saved Radar cluster configs into KubeBuddy for:

  • run history
  • score trends
  • run-to-run compare
  • saved cluster configs
  • generated commands and YAML config files

For the Radar web experience itself, see Radar Overview, Cluster Reports, Cluster Configs, and API Reference.

What Gets Uploaded

Only the JSON report payload is uploaded.

  • kubebuddy run --json-report --radar-upload ...
  • Invoke-KubeBuddy -jsonReport -RadarUpload ...
  • HTML and TXT outputs are local artifacts only
  • Radar derives report and compare data from the uploaded JSON report

Authentication

Radar uses HTTP Basic auth with WordPress Application Passwords:

  • username: your WordPress username
  • password: your WordPress Application Password (from Account page)

Set credentials as env vars for KubeBuddy:

$env:KUBEBUDDY_RADAR_API_USER = "<wordpress-username>"
$env:KUBEBUDDY_RADAR_API_PASSWORD = "<wordpress-app-password>"

Native CLI Usage

Upload JSON run:

kubebuddy run \
  --json-report \
  --radar-upload \
  --radar-environment prod \
  --yes \
  --output-path ./reports

Upload + compare:

kubebuddy run \
  --json-report \
  --radar-upload \
  --radar-compare \
  --radar-environment prod \
  --yes \
  --output-path ./reports

Fetch a saved Radar cluster config:

kubebuddy run \
  --radar-fetch-config \
  --radar-config-id "ccfg_12345678-1234-1234-1234-123456789abc" \
  --html-report \
  --yes \
  --output-path ./reports

Exclude checks for this run while still using the fetched profile:

kubebuddy run \
  --radar-fetch-config \
  --radar-config-id "ccfg_12345678-1234-1234-1234-123456789abc" \
  --excluded-checks SEC014,WRK011 \
  --html-report \
  --yes

PowerShell CLI Usage

Upload JSON run:

Invoke-KubeBuddy `
  -jsonReport `
  -RadarUpload `
  -RadarEnvironment "prod"

Upload + compare:

Invoke-KubeBuddy `
  -jsonReport `
  -RadarUpload `
  -RadarCompare `
  -RadarEnvironment "prod"

Optional overrides:

  • -RadarApiBaseUrl (default https://radar.kubebuddy.io/api/kb-radar/v1)
  • -RadarApiUserEnv (default KUBEBUDDY_RADAR_API_USER)
  • -RadarApiSecretEnv (default KUBEBUDDY_RADAR_API_PASSWORD)

Fetch a saved Radar cluster config:

Invoke-KubeBuddy `
  -RadarFetchConfig `
  -RadarConfigId "ccfg_12345678-1234-1234-1234-123456789abc"

Exclude checks for this run while still using the fetched profile:

Invoke-KubeBuddy `
  -RadarFetchConfig `
  -RadarConfigId "ccfg_12345678-1234-1234-1234-123456789abc" `
  -ExcludedChecks "SEC014","WRK011"

Docker Entrypoint Usage (kubebuddy run-env)

Use these env vars:

-e JSON_REPORT="true" \
-e RADAR_UPLOAD="true" \
-e RADAR_COMPARE="true" \
-e RADAR_FETCH_CONFIG="true" \
-e RADAR_CONFIG_ID="ccfg_12345678-1234-1234-1234-123456789abc" \
-e EXCLUDED_CHECKS="SEC014,WRK011" \
-e RADAR_ENVIRONMENT="prod" \
-e KUBEBUDDY_RADAR_API_USER="<wordpress-username>" \
-e KUBEBUDDY_RADAR_API_PASSWORD="<wordpress-app-password>"

Validation rules:

  • RADAR_UPLOAD/RADAR_COMPARE requires JSON_REPORT=true
  • RADAR_FETCH_CONFIG=true fetches the saved Radar cluster profile and applies it to the native run before checks start
  • EXCLUDED_CHECKS merges comma-separated runtime check exclusions with any fetched profile exclusions

Direct API Example (for debugging)

$pair = "$($env:KUBEBUDDY_RADAR_API_USER):$($env:KUBEBUDDY_RADAR_API_PASSWORD)"
$token = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($pair))

Invoke-RestMethod `
  -Method Get `
  -Uri "https://radar.kubebuddy.io/api/kb-radar/v1/cluster-reports?page=1&per_page=5" `
  -Headers @{ Authorization = "Basic $token" }

See Cluster Reports (Pro), Cluster Configs (Pro), and API Reference for full endpoint details.