Skip to main content

​
One-Line Install

curl -sL https://install.changeguard.ai | bash -s -- \
  --api-key YOUR_API_KEY \
  --cluster my-cluster

​
What the installer creates

The install script applies a single kubectl manifest that creates:
  1. Namespace — changeguard-agent (isolated from your workloads)
  2. Secret — stores your API key and configuration
  3. ServiceAccount + RBAC — read-only cluster access
  4. Deployment — single replica, the agent pod

​
RBAC Permissions

The agent requests the minimum permissions needed:
ResourceVerbsPurpose
Pods, Nodes, Namespaces, Events, Servicesget, list, watchCluster snapshot
Pods/logget, listLog collection
Deployments, StatefulSets, DaemonSets, ReplicaSetsget, list, watchWorkload status
Jobs, CronJobsget, list, watchBatch workload status
SecretsgetArgoCD token discovery only
Ingresses, NetworkPolicies, ConfigMaps, PVCs, HPAs, ServiceAccountsget, list, watchFull cluster visibility
Metrics (metrics.k8s.io)get, listCPU/memory utilization
The agent never writes to your cluster. It is strictly read-only.

​
Security

  • Runs as non-root user (UID 1000)
  • Read-only root filesystem
  • All capabilities dropped
  • No privilege escalation
  • Liveness and readiness probes configured
  • Resource limits: 250m CPU, 256Mi memory

​
Manual Install (YAML)

If you prefer to review the manifest before applying: 
curl -sL https://install.changeguard.ai | bash -s -- \
  --api-key YOUR_API_KEY \
  --cluster my-cluster \
  --dry-run
Or go to Add Cluster in the dashboard to generate and download the YAML.

​
Multi-Cluster

Install the agent independently in each cluster. Each gets its own --cluster name: 
# Production
curl -sL https://install.changeguard.ai | bash -s -- \
  --api-key YOUR_API_KEY --cluster production --provider EKS --region us-east-1

# Staging
curl -sL https://install.changeguard.ai | bash -s -- \
  --api-key YOUR_API_KEY --cluster staging --provider EKS --region us-east-1
All clusters share the same API key and appear in the same dashboard.

​
Image

The agent image is publicly available: 
public.ecr.aws/m7g7b7v0/changeguard/agent:v2.4.0
Multi-arch: supports both arm64 (Graviton) and amd64.