Skip to main content
ChangeGuard has two halves: a small, read-only footprint in your cluster, and the control plane that does correlation, scoring, and analysis. This page shows exactly how they fit together and where your data lives.

​
Deployment topology

The operator runs in changeguard-system and manages the collector (and optional scanners) in changeguard-agent through a CRD. Only the collector talks to the outside world.
There is no inbound path into your cluster. The control plane never connects to you — the collector always initiates the connection out.

​
Communication paths

Exactly three network relationships exist, and all cluster-originated traffic is outbound HTTPS on 443.
There is no HTTP-proxy support today. The collector’s push client does not honor HTTP_PROXY / HTTPS_PROXY. The cluster needs direct outbound HTTPS to api.changeguard.ai:443. For air-gapped image pulls you can point global.imageRegistry at your own mirror, but the egress requirement stands.

​
What leaves your cluster — and what never does

This is the boundary that matters most for review. The collector sends the metadata needed to correlate and score change; it does not send your code, images, or secret values.
Optional code graph. If you enable the code-graph feature, ChangeGuard reads your repositories in-cluster and ships only the derived knowledge graph — never your raw source. Your source code still does not leave the cluster.
Data the control plane stores is tenant-isolated at the database level using PostgreSQL row-level security, so one tenant’s data is never visible to another.

​
Where the AI runs

All correlation, scoring, and AI reasoning run in the control plane — not in your cluster. AI analysis is powered by Amazon Bedrock (Claude models). The in-cluster collector does no analysis; it reads state and pushes it out. This keeps the cluster footprint tiny (a ~50m / 64Mi collector with no persistent storage) and means model/analysis changes ship on the control-plane side without touching your cluster.
The deterministic CSC Score and the AI reasoning capabilities are distinct. Scoring is deterministic and generally available; the reasoning layers (Engineering Advisor, Engineering Opinion, and related) are Early Access and off by default. See Product concepts.

​
Where data lives

​
Cluster footprint at a glance

Tiny

Collector requests ~50m CPU / 64Mi memory (limits 200m / 128Mi). No PersistentVolumeClaims.

Hardened

Runs non-root with a read-only root filesystem and dropped Linux capabilities.

Read-only

get / list / watch only — no writes to your workloads unless you opt into remediation.
For the exact RBAC grants behind this, see Permissions & RBAC.