Install ChangeGuard Edge

ChangeGuard Edge is optional. For standard Kubernetes API-state evidence you don’t need to install anything — Connect your EKS fleet collects it centrally over read-only access you authorize. Install Edge when you want evidence that requires local presence — runtime signals (Falco), node benchmarks (kube-bench) — or when Fleet can’t reach the environment centrally.

This page is written so that if you run each step in order and see the result shown under it, you are done — with no guesswork about whether it worked.

You should have finished Before you install. You need a cluster on Kubernetes 1.24+ reachable with kubectl, Helm 3.8+, cluster-scoped install rights (no cluster-admin required), outbound HTTPS to api.changeguard.ai:443 (no proxy), and a ChangeGuard AI API key.

Step 1 — Point kubectl at the right cluster

Confirm your context

kubectl config current-context

You should see: the name of the cluster you intend to install into. If it isn’t, switch with kubectl config use-context <name> before continuing.

Confirm Helm

helm version --short

You should see: v3.8 or newer.

Step 2 — Install the operator and collector

Pick one of the two options. Both install the same thing: the operator into changeguard-system, which then creates the read-only collector in changeguard-agent.

One-line installer (simplest)
Helm directly (most control)

The installer validates your API key first, then runs Helm for you.

curl -sL https://install.changeguard.ai | CG_API_KEY=<YOUR_API_KEY> CG_CLUSTER_NAME=<YOUR_CLUSTER_NAME> sh

Replace <YOUR_API_KEY> with your real key. Never paste a real key into a shared terminal, a ticket, or a screenshot.

Optional environment variables: CG_PROVIDER (EKS, GKE, AKS, or Kubernetes; default Kubernetes) and CG_REGION (default us-east-1) — both are display metadata for the dashboard.

Use this in CI, GitOps, or when you want to see every flag.

helm repo add changeguard https://charts.changeguard.ai
helm repo update

helm upgrade --install changeguard changeguard/changeguard-operator \
  --namespace changeguard-system --create-namespace \
  --set agent.clusterName=<YOUR_CLUSTER_NAME> \
  --set agent.apiKey=<YOUR_API_KEY>

agent.clusterName and agent.apiKey are both required — the chart refuses to render without a cluster name. Optionally add --set agent.provider=<EKS|GKE|AKS|Kubernetes> (default Kubernetes) and --set agent.region=<region> (default us-east-1) for dashboard display. Security scanning is on by default (agent.security.enabled=true), which includes a privileged Falco DaemonSet — see Permissions & RBAC.If you prefer to manage the Secret yourself, create changeguard-credentials (key api-key) in changeguard-agent and reference it instead of passing agent.apiKey.

The command exits 0 and prints the installed release name (changeguard). That’s the install done — verification is the next page.

What the install created

So you can review — or fully remove — everything:

Kind	Name	Namespace
Namespace	`changeguard-system`, `changeguard-agent`	—
CRD	`changeguardagents.changeguard.ai`	cluster-scoped
Deployment	`changeguard-operator` (+ its RBAC)	`changeguard-system`
Custom resource	a `ChangeGuardAgent`	`changeguard-agent`
Deployment	`changeguard-collector`	`changeguard-agent`
Secret	`changeguard-credentials` (key `api-key`)	`changeguard-agent`
CronJob / DaemonSet	security scanners (optional)	`changeguard-agent`

No PersistentVolumeClaims are created, and none of your existing workloads are modified. ChangeGuard AI is read-only until you explicitly opt into remediation and grant its namespaced RBAC.

Uninstall / rollback

The in-cluster footprint comes out cleanly:

helm uninstall changeguard -n changeguard-system
kubectl delete changeguardagent --all -A
kubectl delete namespace changeguard-agent changeguard-system
kubectl delete crd changeguardagents.changeguard.ai

This removes ChangeGuard AI from your cluster. To remove data already sent to the control plane, remove the cluster in-app (per-cluster removal). Full-tenant data erasure is handled through support.

Next: Connect your first cluster →

Start here

Going deeper

ChangeGuard Edge (in-cluster)

Integrations

Policy-Governed Remediation

Security

Concepts & Architecture

Operations

Platform

Security Scanning

AI Analysis

Advanced configuration

Agent (Legacy)

Releases

Step 1 — Point kubectl at the right cluster

Step 2 — Install the operator and collector

What the install created

Uninstall / rollback

​Step 1 — Point kubectl at the right cluster

​Step 2 — Install the operator and collector

​What the install created

​Uninstall / rollback

Step 1 — Point kubectl at the right cluster

Step 2 — Install the operator and collector

What the install created

Uninstall / rollback