Step 1 — Confirm the operator is running
deployment "changeguard-operator" successfully rolled out and the operator pod shows Running / 1/1.ChangeGuardAgent custom resource, which is what tells it to deploy the collector:
One
ChangeGuardAgent resource is listed, with phase Running.The
CSC and PUSHES columns in that output are not populated from the CR status today — a Running phase confirms the agent is healthy, and your live score and push activity are in the dashboard, not in kubectl output.Step 2 — Confirm the collector is connected
The collector pod is
Running / 1/1, and the logs show a successful push to api.changeguard.ai with no repeated 401 (bad key) or connection-refused (egress) errors.9090 (/healthz liveness, /readyz readiness). If Kubernetes reports it Ready, those probes are already passing.
Step 3 — See your cluster in the product
1
Open the app
Sign in at app.changeguard.ai.
2
Find your cluster
Your cluster appears in Fleet within about a minute (up to ~2 minutes on a first-ever install while container images pull), workload counts populate, and a CSC Score is computed — typically within ~10 seconds of the collector connecting.
3
Run a pre-flight check
Open Safe to Ship? and run a pre-flight check. You get a SHIP / HOLD / BLOCK verdict with the score and the reasons behind it. This is advisory — it never blocks your pipeline on its own.
Cluster visible in Fleet, CSC Score populated, and a pre-flight check returns a verdict. That is a successful install.
If a step didn’t produce the result shown
Next: Your First Recommendation →