Skip to main content
Short answers to the questions customers actually hit, each linking to the full page. If your question isn’t here, support would rather you ask than guess.

​
Connecting

For standard Kubernetes API-state evidence, nothing. ChangeGuard Fleet connects centrally using customer-authorized, read-only access — see Connect your EKS fleet. ChangeGuard Edge is an optional in-cluster install for signals that genuinely require local presence (runtime detection, node benchmarks) or environments Fleet cannot reach centrally.
No. The AWS connection authorizes discovery — listing and describing your EKS clusters with a role you create. Kubernetes read access is a separate, per-cluster grant you make explicitly through the generated authorization workflow, and you can revoke it per cluster at any time. See Connect your EKS fleet.
Fleet reverses the direction: ChangeGuard AI connects to your Kubernetes API endpoint centrally, so the cluster itself needs no outbound path to ChangeGuard AI for standard evidence. The direct-egress requirement below applies only to the optional Edge install.

​
Installing ChangeGuard Edge (optional)

Both CG_API_KEY and CG_CLUSTER_NAME are required — the installer refuses to run without them, and the Helm chart refuses to render without agent.clusterName. The correct commands are on Install ChangeGuard AI.
Your cluster connects within about a minute of install (up to ~2 minutes on a first-ever install while images pull), and the first CSC Score follows within ~10 seconds of connecting. If it’s been longer, the fix table covers the three causes — it’s almost always egress or the API key.
Not today. The cluster needs direct outbound HTTPS to api.changeguard.ai:443. This is tracked on Known Limitations & Roadmap.
Yes — mirror the images and repoint every one of them with --set global.imageRegistry=<your-registry>. The registry list is on Before you install.
One component: the Falco DaemonSet (runtime syscall detection), on by default with security scanning. Everything else runs unprivileged and read-only. What it mounts, why, and how to disable it: Permissions & RBAC.
Helm uninstall plus one manual step (deleting the CRD) — exact commands on Install ChangeGuard AI. Removing already-sent data is per-cluster in-app; full-tenant erasure goes through support.

​
Using ChangeGuard AI

The one verdict vocabulary, everywhere: SHIP = sufficient evidence supports proceeding. HOLD = ChangeGuard AI cannot establish that proceeding is safe enough — including when important evidence is missing or too stale to trust (it says so rather than pretending the evidence is available). BLOCK = affirmative evidence indicates the change should not proceed. Verdicts are advisory unless you wire the CI gate yourself.
A real score of 0 renders as a red 0/100; “Calculating your first score” means the first snapshot hasn’t arrived yet. If it turns into “Score unavailable,” the collector isn’t pushing — use Retry and the connection checks.
Expected — those are Early Access, off by default, and not self-serve. What’s GA for every tenant and how to join EA: Engineering Advisor and Product concepts.
Defaults are requests 25m/64Mi, limits 500m/512Mi (chart ≥ 5.3.6). Override any subset: --set agent.collector.resources.limits.memory=1Gi — see Operations.
Create the new key in-app, update the changeguard-credentials Secret, restart the collector, then revoke the old key — steps on Operations. There’s no self-serve rotation API yet; after a suspected exposure, also confirm invalidation with support.
Not unless you tell it to. Verdicts are advisory; the default autonomy level is Advise. Blocking only happens where you wire the CI gate or enable Approve/Auto autonomy with its RBAC — see How ChangeGuard AI Makes Decisions.

​
Troubleshooting

The two canonical fix tables:
  • Install and first connection — Connect your first cluster: repeated 401s, egress timeouts, cluster never appearing in Fleet, operator CrashLoopBackOff.
  • Day-2 operations — Operations handbook: collector crash loops, stale clusters, missing features, version skew.
Still stuck? support@changeguard.ai — include the collector logs (kubectl logs -n changeguard-agent deploy/changeguard-collector --tail=50); they contain no secrets.