Skip to main content
The ChangeGuardAgent CRD is the single configuration surface. Apply it, and the operator reconciles all components.

​
Minimal Example

apiVersion: changeguard.ai/v1alpha1
kind: ChangeGuardAgent
metadata:
  name: changeguard
  namespace: changeguard-system
spec:
  clusterName: production
  apiKeySecretRef:
    name: changeguard-api-key
This enables all defaults: data collection every 10s, KubeBench, Grype, Falco, Pluto, and Syft.

​
Security Spec

All scanners default to enabled when the security field is present.
ScannerScheduleWhat It Does
kubeBenchEvery 6hCIS Kubernetes Benchmark
grypeEvery 4h + on deployContainer image CVE scanning
syftEvery 8h + on deploySBOM generation (CycloneDX or SPDX)
falcoContinuousRuntime syscall monitoring via eBPF
plutoEvery 12hDeprecated/removed API detection

​
GitOps Spec

ChangeGuard discovers GitOps state by reading custom resources directly over the Kubernetes API — no ArgoCD or Flux API token is required. 
spec:
  gitops:
    argoCD:
      enabled: true   # discover ArgoCD Applications
    flux:
      enabled: true   # discover Kustomizations, HelmReleases, and Sources
Discovered ArgoCD applications and Flux resources are pushed to ChangeGuard and persisted, so fleet and GitOps views survive backend restarts and stay consistent across replicas. See ArgoCD Integration and Flux CD Integration.

​
AI Spec

FieldDefaultOptions
modedisabledcloud, aws, oncluster, disabled
modelmeta/llama-3.1-70b-instructAny NIM-supported model

​
Status

kubectl get changeguardagent -o wide
ColumnDescription
CLUSTERDisplay name
CSCCurrent CSC score (0–100)
PHASEPending, Running, Degraded, Error
PUSHESTotal successful pushes