> ## Documentation Index
> Fetch the complete documentation index at: https://docs.changeguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Operator Installation

> Install the ChangeGuard operator to manage security scanning and data collection

The ChangeGuard operator manages the full lifecycle of data collection, security scanning, runtime detection, and AI analysis through a single `ChangeGuardAgent` custom resource.

## One-Line Install

```bash theme={null}
curl -sL https://install.changeguard.ai | \
  CG_API_KEY=YOUR_API_KEY \
  CG_CLUSTER_NAME=production \
  CG_PROVIDER=EKS sh
```

## What Gets Deployed

| Resource                | Type       | Purpose                                        |
| ----------------------- | ---------- | ---------------------------------------------- |
| `changeguard-operator`  | Deployment | Controller (watches ChangeGuardAgent CRDs)     |
| `changeguard-collector` | Deployment | Read-only data collector (snapshots every 10s) |
| `changeguard-bench`     | CronJob    | CIS benchmark scanner (KubeBench)              |
| `changeguard-grype`     | CronJob    | Container image CVE scanner                    |
| `changeguard-syft`      | CronJob    | SBOM generator                                 |
| `changeguard-pluto`     | CronJob    | Deprecated API detector                        |
| `changeguard-falco`     | DaemonSet  | Runtime syscall monitor (every node)           |
| `changeguard-sidekick`  | Deployment | Falco alert forwarder                          |

## RBAC

The operator creates a ClusterRole with read-only access. It reads pods, deployments, nodes, events, services, RBAC objects (for Identity & Access and Attack Paths), network policies, and metrics, plus ArgoCD `Application` and Flux (`Kustomization`, `HelmRelease`, `Source`) custom resources for GitOps discovery. GitOps state is read directly from those resources — no ArgoCD or Flux API token is required — and the agent never reads application Secrets.

<Info>
  The agent never reads or stores application secrets.
</Info>

## Requirements

* Kubernetes 1.25+
* `helm` 3.8+ and `kubectl` (for installation)
* Outbound HTTPS to `api.changeguard.ai`
* For Falco: Linux kernel 5.8+ (modern\_ebpf driver)

## Helm Install

```bash theme={null}
helm repo add changeguard https://charts.changeguard.ai
helm repo update
helm upgrade --install changeguard changeguard/changeguard-operator \
  --namespace changeguard-system --create-namespace \
  --set agent.apiKey=YOUR_API_KEY \
  --set agent.clusterName=production \
  --set agent.provider=EKS \
  --set agent.security.enabled=true
```

## Uninstall

```bash theme={null}
kubectl delete changeguardagent changeguard -n changeguard-system
helm uninstall changeguard -n changeguard-system
kubectl delete namespace changeguard-system
kubectl delete crd changeguardagents.changeguard.ai
```