Skip to main content
The standalone agent has been removed. ChangeGuard is now operator-managed — a single Helm chart installs the operator, the read-only data collector, and all five scanners. The commands on this page are historical and no longer work against the current installer.To install, use the Quickstart, the operator installation guide, or the Helm chart.

​
One-Line Install

​
What the installer creates

The install script applies a single kubectl manifest that creates:
  1. Namespace — changeguard-agent (isolated from your workloads)
  2. Secret — stores your API key and configuration
  3. ServiceAccount + RBAC — read-only cluster access
  4. Deployment — single replica, the agent pod

​
RBAC Permissions

The agent requests the minimum permissions needed:
The agent never writes to your cluster. It is strictly read-only.

​
Security

  • Runs as non-root user (UID 1000)
  • Read-only root filesystem
  • All capabilities dropped
  • No privilege escalation
  • Liveness and readiness probes configured
  • Resource limits: 250m CPU, 256Mi memory

​
Manual Install (YAML)

If you prefer to review the manifest before applying:
Or go to Add Cluster in the dashboard to generate and download the YAML.

​
Multi-Cluster

Install the agent independently in each cluster. Each gets its own --cluster name:
All clusters share the same API key and appear in the same dashboard.

​
Image

The agent image is publicly available:
Multi-arch: supports both arm64 (Graviton) and amd64.