> ## Documentation Index
> Fetch the complete documentation index at: https://docs.changeguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Installation

> Install the ChangeGuard agent in your cluster

<Warning>
  **The standalone agent has been removed.** ChangeGuard is now operator-managed — a single Helm chart installs the operator, the read-only data collector, and all five scanners. The commands on this page are historical and no longer work against the current installer.

  To install, use the [Quickstart](/quickstart), the [operator installation guide](/operator/installation), or the [Helm chart](/operator/helm-chart).
</Warning>

## One-Line Install

```bash theme={null}
curl -sL https://install.changeguard.ai | bash -s -- \
  --api-key YOUR_API_KEY \
  --cluster my-cluster
```

## What the installer creates

The install script applies a single kubectl manifest that creates:

1. **Namespace** — `changeguard-agent` (isolated from your workloads)
2. **Secret** — stores your API key and configuration
3. **ServiceAccount + RBAC** — read-only cluster access
4. **Deployment** — single replica, the agent pod

## RBAC Permissions

The agent requests the minimum permissions needed:

| Resource                                                            | Verbs            | Purpose                     |
| ------------------------------------------------------------------- | ---------------- | --------------------------- |
| Pods, Nodes, Namespaces, Events, Services                           | get, list, watch | Cluster snapshot            |
| Pods/log                                                            | get, list        | Log collection              |
| Deployments, StatefulSets, DaemonSets, ReplicaSets                  | get, list, watch | Workload status             |
| Jobs, CronJobs                                                      | get, list, watch | Batch workload status       |
| Secrets                                                             | get              | ArgoCD token discovery only |
| Ingresses, NetworkPolicies, ConfigMaps, PVCs, HPAs, ServiceAccounts | get, list, watch | Full cluster visibility     |
| Metrics (metrics.k8s.io)                                            | get, list        | CPU/memory utilization      |

<Info>
  The agent never writes to your cluster. It is strictly read-only.
</Info>

## Security

* Runs as non-root user (UID 1000)
* Read-only root filesystem
* All capabilities dropped
* No privilege escalation
* Liveness and readiness probes configured
* Resource limits: 250m CPU, 256Mi memory

## Manual Install (YAML)

If you prefer to review the manifest before applying:

```bash theme={null}
curl -sL https://install.changeguard.ai | bash -s -- \
  --api-key YOUR_API_KEY \
  --cluster my-cluster \
  --dry-run
```

Or go to **Add Cluster** in the dashboard to generate and download the YAML.

## Multi-Cluster

Install the agent independently in each cluster. Each gets its own `--cluster` name:

```bash theme={null}
# Production
curl -sL https://install.changeguard.ai | bash -s -- \
  --api-key YOUR_API_KEY --cluster production --provider EKS --region us-east-1

# Staging
curl -sL https://install.changeguard.ai | bash -s -- \
  --api-key YOUR_API_KEY --cluster staging --provider EKS --region us-east-1
```

All clusters share the same API key and appear in the same dashboard.

## Image

The agent image is publicly available:

```text theme={null}
public.ecr.aws/m7g7b7v0/changeguard/agent:v2.4.0
```

Multi-arch: supports both `arm64` (Graviton) and `amd64`.