Find what your plan check missed, in your first hour.

1 Before you start

• A Kubernetes cluster you can run kubectl and helm against.
• Read-only credentials for at least one thing to scan: an Azure subscription, AWS account, GCP project, or the cluster itself.
• Helm 3. That’s the whole list.

2 Install the chart

One command pulls the chart straight from the public OCI registry: no clone required. Generate your own secrets and keep them yours.

$ helm install dd oci://registry-1.docker.io/driftdetective/d-detective --version 0.3.8 \
    --namespace ddetective --create-namespace \
    --set ingress.host=d-detective.your-domain.com \
    --set secrets.fernetKey='<fernet-key>' \
    --set secrets.dataKeyWrapped='<data-key-wrapped>' \
    --set secrets.jwtSecret='<jwt-secret>' \
    --set postgresql.auth.password='<db-password>'

The Fernet key and the wrapped data key are immutable once set: together they encrypt your stored credentials. Generate them once and keep them safe; changing either one orphans every stored secret. The docs walk through generating all three secrets in one copy-paste.

Scans run unmetered for 30 days from your first install. After that it settles onto the Free plan: 1 scope, 3 users, every feature, forever. Nothing stops and nothing is deleted. To cover more scopes later, add a licence key with a helm upgrade: no new install needed.

3 Open the app

No ingress host handy? Port-forward the frontend and open it locally.

$ kubectl -n ddetective port-forward svc/dd-frontend 3000:3000→ open http://localhost:3000

4 Register & connect a scope

First run has no seeded login: register a tenant right from the app, then connect your first integration with test-before-save. Run a scan, and real drift, unmanaged resources, and policy violations show up in the dashboard.