Skip to main content
Short answers to the questions customers actually hit, each linking to the full page. If your question isn’t here, support would rather you ask than guess.

​
Installing

Both CG_API_KEY and CG_CLUSTER_NAME are required — the installer refuses to run without them, and the Helm chart refuses to render without agent.clusterName. The correct commands are on Install ChangeGuard.
Your cluster connects within about a minute of install (up to ~2 minutes on a first-ever install while images pull), and the first CSC Score follows within ~10 seconds of connecting. If it’s been longer, the fix table covers the three causes — it’s almost always egress or the API key.
Not today. The cluster needs direct outbound HTTPS to api.changeguard.ai:443. This is tracked on Known Limitations & Roadmap.
Yes — mirror the images and repoint every one of them with --set global.imageRegistry=<your-registry>. The registry list is on Before you install.
One component: the Falco DaemonSet (runtime syscall detection), on by default with security scanning. Everything else runs unprivileged and read-only. What it mounts, why, and how to disable it: Permissions & RBAC.
Helm uninstall plus one manual step (deleting the CRD) — exact commands on Install ChangeGuard. Removing already-sent data is per-cluster in-app; full-tenant erasure goes through support.

​
Using ChangeGuard

The one verdict vocabulary, everywhere: SHIP = safe to ship, HOLD = caution — review before shipping, BLOCK = expected to fail (and, at Approve/Auto autonomy, gated until a human approves). Verdicts are advisory unless you wire the CI gate yourself.
A real score of 0 renders as a red 0/100; “Calculating your first score” means the first snapshot hasn’t arrived yet. If it turns into “Score unavailable,” the collector isn’t pushing — use Retry and the connection checks.
Expected — those are Early Access, off by default, and not self-serve. What’s GA for every tenant and how to join EA: Engineering Advisor and Product concepts.
Defaults are requests 25m/64Mi, limits 500m/512Mi (chart ≥ 5.3.6). Override any subset: --set agent.collector.resources.limits.memory=1Gi — see Operations.
Create the new key in-app, update the changeguard-credentials Secret, restart the collector, then revoke the old key — steps on Operations. There’s no self-serve rotation API yet; after a suspected exposure, also confirm invalidation with support.
Not unless you tell it to. Verdicts are advisory; the default autonomy level is Advise. Blocking only happens where you wire the CI gate or enable Approve/Auto autonomy with its RBAC — see How ChangeGuard Makes Decisions.

​
Troubleshooting

The two canonical fix tables:
  • Install and first connection — Connect your first cluster: repeated 401s, egress timeouts, cluster never appearing in Fleet, operator CrashLoopBackOff.
  • Day-2 operations — Operations handbook: collector crash loops, stale clusters, missing features, version skew.
Still stuck? support@changeguard.ai — include the collector logs (kubectl logs -n changeguard-agent deploy/changeguard-collector --tail=50); they contain no secrets.