Skip to main content
This page is written so that if you run each step in order and see the result shown under it, you are done — with no guesswork about whether it worked.
You should have finished Before you install. You need a cluster on Kubernetes 1.24+ reachable with kubectl, Helm 3.8+, cluster-scoped install rights (no cluster-admin required), outbound HTTPS to api.changeguard.ai:443 (no proxy), and a ChangeGuard API key.

​
Step 1 — Point kubectl at the right cluster

1

Confirm your context

You should see: the name of the cluster you intend to install into. If it isn’t, switch with kubectl config use-context <name> before continuing.
2

Confirm Helm

You should see: v3.8 or newer.

​
Step 2 — Install the operator and collector

Pick one of the two options. Both install the same thing: the operator into changeguard-system, which then creates the read-only collector in changeguard-agent.
The installer validates your API key first, then runs Helm for you.
Replace <YOUR_API_KEY> with your real key. Never paste a real key into a shared terminal, a ticket, or a screenshot.
The command exits 0 and prints the installed release name (changeguard).

​
Step 3 — Confirm the operator is running

deployment "changeguard-operator" successfully rolled out and the operator pod shows Running / 1/1.
The operator creates a ChangeGuardAgent custom resource, which is what tells it to deploy the collector:
One ChangeGuardAgent resource is listed.

​
Step 4 — Confirm the collector is connected

The collector pod is Running / 1/1, and the logs show a successful push to api.changeguard.ai with no repeated 401 (bad key) or connection-refused (egress) errors.
The collector serves health on port 9090 (/healthz liveness, /readyz readiness). If Kubernetes reports it Ready, those probes are already passing.

​
Step 5 — Confirm your cluster appears in the product

1

Open the app

Sign in at app.changeguard.ai.
2

Find your cluster

Within a few minutes your cluster appears in Fleet, workload counts populate, and a CSC Score is computed.
3

Run a pre-flight check

Open Safe to Ship? and run a pre-flight check. You get a SHIP / HOLD / BLOCK verdict with the score and the reasons behind it. This is advisory — it never blocks your pipeline on its own.
Cluster visible in Fleet, CSC Score populated, and a pre-flight check returns a verdict. That is a successful install.

​
What the install created

So you can review — or fully remove — everything: No PersistentVolumeClaims are created, and none of your existing workloads are modified. ChangeGuard is read-only until you explicitly opt into remediation and grant its namespaced RBAC.

​
If a step didn’t produce the result shown

​
Uninstall / rollback

The in-cluster footprint comes out cleanly:
This removes ChangeGuard from your cluster. To remove data already sent to the control plane, remove the cluster in-app (per-cluster removal). Full-tenant data erasure is handled through support.
Next: Your first 30 minutes →