Procedure

1. Choose a dedicated namespace and create it:

   export NS=compliance
   kubectl create namespace "$NS"

2. Create the Kubernetes Secret containing your two API keys.
   The install fails fast with a preflight check if this Secret does not already exist, so create it before installing. By default the chart expects a Secret named compliance-collector-secrets with two keys, anthropic_compliance_key and vision_one_aiguard_key. If you manage secrets through GitOps (for example SOPS or sealed-secrets), commit an encrypted manifest in this shape and let your GitOps engine apply it before the Helm release reconciles:

   apiVersion: v1
   kind: Secret
   metadata:
     name: compliance-collector-secrets
     namespace: compliance
   type: Opaque
   stringData:
     anthropic_compliance_key: "sk-ant-api01-REPLACE-ME"
     vision_one_aiguard_key:   "V1-REPLACE-ME"

   Verify the Secret exists with both keys populated:

   kubectl -n "$NS" get secret compliance-collector-secrets \
     -o jsonpath='{.data.anthropic_compliance_key}{"\n"}{.data.vision_one_aiguard_key}{"\n"}' \
     | while read v; do [ -n "$v" ] && echo "key present" || echo "KEY MISSING"; done

   Note Using different Secret or key names? Override existingSecret.name and existingSecret.keys.anthropic / existingSecret.keys.visionOne in your values file. See Helm chart values reference. The key names double as the on-disk filenames mounted read-only into the pod at /var/run/secrets/compliance-collector/.

3. Prepare a values file.
   Only aiGuardUrl is required — everything else has a working default. For anything beyond a trivial install, use a values file rather than a long --set chain. Create values.yaml:

   aiGuardUrl: https://api.xdr.trendmicro.com/v3.0/aiSecurity/applyGuardrails
   
   schedule:
     cron: "0 0/4 * * *"     # hour/interval only — the MINUTE field is ignored
     timeZone: "UTC"
   scheduleOffsetMinutes: 0  # fire minute AND scan-window anchor (0-57); stagger tenants here
   
   existingSecret:
     name: compliance-collector-secrets

   For the full set of tunable values and their defaults and constraints, see Helm chart values reference.

   Important The released OCI chart already pins the container image (tag and digest) at release time. Do not set image.* for a normal install — only set it when using a mirrored or locally built image.

4. Validate your values and preview the install without touching the cluster:

   helm install collector \
     oci://public.ecr.aws/trendmicro/compliance-collector-chart \
     --version 1.0.0 -n "$NS" -f values.yaml --dry-run=server

   Use a server-side dry run (as shown) so the Secret preflight check still runs. For a purely offline render with no cluster or Secret available, use helm template with --set existingSecret.skipPreflightCheck=true.

   Important Never set existingSecret.skipPreflightCheck=true on a real install — it is intended for offline rendering only.

5. Install the chart:

   helm install collector \
     oci://public.ecr.aws/trendmicro/compliance-collector-chart \
     --version 1.0.0 \
     --namespace "$NS" \
     -f values.yaml

   The post-install notes echo the CronJob name, schedule, image, and the exact manual-run command for your release.

   Note With release name collector, the resulting CronJob is named collector-compliance-collector. Confirm the actual name with kubectl -n "$NS" get cronjob before running other management commands.

6. Verify the deployment:

   helm -n "$NS" status collector
   kubectl -n "$NS" get cronjob
   kubectl -n "$NS" get cronjob -o jsonpath='{.items[0].spec.schedule}{"\n"}'
   kubectl -n "$NS" get serviceaccount

   You should see one CronJob with SUSPEND=False and a schedule minute equal to your scheduleOffsetMinutes value. No pods run until the first scheduled fire, unless you trigger one manually.