> ## Documentation Index
> Fetch the complete documentation index at: https://docs.changeguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Install the operator and see your first score

## Prerequisites

* A Kubernetes cluster (EKS, GKE, AKS, or any CNCF-conformant cluster)
* `kubectl` configured and pointing at your cluster
* `helm` 3.8+ installed — the installer is a thin wrapper around a Helm install
* A ChangeGuard account ([start free trial](https://app.changeguard.ai))

## Step 1: Get Your API Key

After signing up, your API key is shown on the confirmation screen. You can also create keys in **Settings → API Keys → Create Key**.

<Warning>
  Save your API key immediately — it cannot be retrieved after creation. Only the prefix is stored.
</Warning>

## Step 2: Install the Operator

```bash theme={null}
curl -sL https://install.changeguard.ai | \
  CG_API_KEY=YOUR_API_KEY CG_CLUSTER_NAME=my-cluster-name sh
```

The installer deploys the ChangeGuard operator, which creates and manages:

* **Data collector** — read-only snapshot agent pushing every 10 seconds
* **KubeBench** — CIS Kubernetes benchmark scanning (every 6 hours)
* **Grype** — container image CVE scanning (every 4 hours + on new deploys)
* **Falco** — runtime syscall threat detection (continuous, every node)
* **Pluto** — deprecated Kubernetes API detection (every 12 hours)
* **Syft** — software bill of materials generation (every 8 hours)

## Step 3: Verify

```bash theme={null}
kubectl get changeguardagent -n changeguard-system
```

```text theme={null}
NAME          CLUSTER        CSC   PHASE     PUSHES   AGE
changeguard   my-cluster     87    Running   142      2m
```

## Step 4: View Your Dashboard

Go to [app.changeguard.ai](https://app.changeguard.ai) and log in. Your cluster appears in the sidebar within 10 seconds, with its first CSC score. Full scan evidence (CIS, CVE, SBOM) fills in over the first scan cycle.

## Step 5: Gate Your Pipeline

The score becomes useful the day it can say no. Wire the [validate endpoint into CI](/gate-your-pipeline) — GitHub Actions, GitLab, ArgoCD PreSync, or any shell — and risky deploys are held before they land.

## Install Options

The one-liner is configured with environment variables:

| Variable          | Default      | Description                                  |
| ----------------- | ------------ | -------------------------------------------- |
| `CG_API_KEY`      | *required*   | Your ChangeGuard API key (starts with `cg_`) |
| `CG_CLUSTER_NAME` | *required*   | Display name for this cluster                |
| `CG_PROVIDER`     | `Kubernetes` | `EKS`, `GKE`, `AKS`, or `Kubernetes`         |

The operator installs into the `changeguard-system` namespace. For a custom namespace, air-gapped or OCI installs, GitOps, or finer-grained values, install the [Helm chart](/operator/helm-chart) directly.

## Uninstall

```bash theme={null}
kubectl delete changeguardagent changeguard -n changeguard-system
helm uninstall changeguard -n changeguard-system
kubectl delete namespace changeguard-system
kubectl delete crd changeguardagents.changeguard.ai
```