What is the recommended way to use Radar?

[UntestedEngineer]

Using the external desktop App or in cluster exposing it via a service with a Reverse Proxy (IE: Nginx/Traefik)?

[nadaverell]

Depends on your preferences.

Desktop app or CLI is great that anyone can just use with their local permissions, no setup required, literally 15 sec download and run, connect to whatever you can connect locally.

In-cluster - now that we have auth options (proxy, OIDC) - you can host in cluster and put proxy or SSO in front of it and it will use the authenticated user's RBAC defined in the cluster. This is nice to allow users to just open e.g. "radar.acme.com" or whatever, no need for refreshing credentials locally and such.

This does require a bit of setup and also doesn't cleanly do multi-cluster - each radar instance now only knows itself.
We're thinking of that but to offer a really clean UX where users can switch between clusters even though each is hosted in the cluster needs some hosted component, to manage streaming the data from each radar-in-cluster to each connected user...

[UntestedEngineer]

What method is more optimal?

[nadaverell]

Optimal in what sense? I think it's mostly a UX question.

If you prefer zero setup and/or frequently work across clusters - desktop version probably good option, with the built-in cluster switcher.

If you want to more easily share in the team, including deep-links etc - the in-cluster version gives you that once you set up auth. People don't need to reauth their cloud provider, run locally etc. just click a link and you're in the Radar UI (given SSO).

Regarding proxy vs OIDC - if you already have proxy auth, if internal tools are already behind a gateway or something - use proxy mode and radar doesn't need almost anything, proxy authenticates users and forwards X-Forwarded-User / X-Forwarded-Groups headers. Radar trusts those headers and impersonates accordingly.

If you're deploying Radar standalone and don't want to set up a separate proxy just for this - use OIDC mode. Radar then goes to the IdP and handles the redirect flow + session cookies itself.

Either way, authorization is the same: Radar impersonates the authenticated user against K8s RBAC, so permissions are managed with standard K8s tooling - no Radar-specific role system.