Step 1 — Confirm the operator is running
deployment "changeguard-operator" successfully rolled out and the operator pod shows Running / 1/1.ChangeGuardAgent custom resource, which is what tells it to deploy the collector:
One
ChangeGuardAgent resource is listed, with phase Running.The
CSC and PUSHES columns in that output are not populated from the CR status today — a Running phase confirms the agent is healthy, and your live score and push activity are in the dashboard, not in kubectl output.Step 2 — Confirm the collector is connected
The collector pod is
Running / 1/1, and the logs show a successful push to api.changeguard.ai with no repeated 401 (bad key) or connection-refused (egress) errors.9090 (/healthz liveness, /readyz readiness). If Kubernetes reports it Ready, those probes are already passing.
Step 3 — See your cluster in the product
1
Open the app
Sign in at app.changeguard.ai.
2
Find your cluster
Your cluster reads Ready in Environments → Connected environments (evidence source: Edge) within about a minute (up to ~2 minutes on a first-ever install while container images pull), workload counts populate, and a CSC Score is computed — typically within ~10 seconds of the collector connecting. Edge → Edge status shows the collector’s own health.
3
Run a pre-flight check
Open Preflight → Judge a change and evaluate a change against this environment. You get a SHIP / HOLD / BLOCK verdict with the score and the reasons behind it. A verdict is a judgment, not an authorization: here it blocks nothing, and in CI the shipped templates fail the job on BLOCK by default — your choice to enforce.
Cluster visible in Fleet, CSC Score populated, and a pre-flight check returns a verdict. That is a successful install.
If a step didn’t produce the result shown
Next: Your First Recommendation →