Operator Installation

The ChangeGuard operator manages the full lifecycle of data collection, security scanning, runtime detection, and AI analysis through a single ChangeGuardAgent custom resource.

One-Line Install

curl -sL https://install.changeguard.ai | \
  CG_API_KEY=YOUR_API_KEY \
  CG_CLUSTER_NAME=production \
  CG_PROVIDER=EKS sh

What Gets Deployed

Resource	Type	Purpose
`changeguard-operator`	Deployment	Controller (watches ChangeGuardAgent CRDs)
`changeguard-collector`	Deployment	Read-only data collector (snapshots every 10s)
`changeguard-bench`	CronJob	CIS benchmark scanner (KubeBench)
`changeguard-grype`	CronJob	Container image CVE scanner
`changeguard-syft`	CronJob	SBOM generator
`changeguard-pluto`	CronJob	Deprecated API detector
`changeguard-falco`	DaemonSet	Runtime syscall monitor (every node)
`changeguard-sidekick`	Deployment	Falco alert forwarder

RBAC

The operator creates a ClusterRole with read-only access. It reads pods, deployments, nodes, events, services, RBAC objects (for Identity & Access and Attack Paths), network policies, and metrics, plus ArgoCD Application and Flux (Kustomization, HelmRelease, Source) custom resources for GitOps discovery. GitOps state is read directly from those resources — no ArgoCD or Flux API token is required — and the agent never reads application Secrets.

The agent never reads or stores application secrets.

Requirements

Kubernetes 1.25+
helm 3.8+ and kubectl (for installation)
Outbound HTTPS to api.changeguard.ai
For Falco: Linux kernel 5.8+ (modern_ebpf driver)

Helm Install

helm repo add changeguard https://charts.changeguard.ai
helm repo update
helm upgrade --install changeguard changeguard/changeguard-operator \
  --namespace changeguard-system --create-namespace \
  --set agent.apiKey=YOUR_API_KEY \
  --set agent.clusterName=production \
  --set agent.provider=EKS \
  --set agent.security.enabled=true

Uninstall

kubectl delete changeguardagent changeguard -n changeguard-system
helm uninstall changeguard -n changeguard-system
kubectl delete namespace changeguard-system
kubectl delete crd changeguardagents.changeguard.ai

Getting Started

Concepts & Architecture

Integrations

Operations

Operator

Security Scanning

Platform

Autonomous Remediation

AI Analysis

Agent (Legacy)

Security

Releases

Operator Installation

One-Line Install

What Gets Deployed

RBAC

Requirements

Helm Install

Uninstall

​One-Line Install

​What Gets Deployed

​RBAC

​Requirements

​Helm Install

​Uninstall

One-Line Install

What Gets Deployed

RBAC

Requirements

Helm Install

Uninstall