Evidence-driven Least-Privilege Governance for Kubernetes

Learn what it needs.
Review what the evidence supports.

Runtime learning produces evidence, not deployment authority. landlock-genprof preserves attribution and uncertainty, derives a reviewable candidate-v2 Proposal, and keeps approval and application authority outside the browser.

v0.7 introduces the Observation Workbench: a workload-centric surface for durable Observations, bounded evidence, candidate-v2 derivation, provenance, and read-only governance facts. This is the technically certified development baseline, not a released v0.7.0 tag. Backend-specific evidence is scoped: NetworkPolicy denial is demonstrated only within the qualified Cilium scope; PodLock/Landlock kernel denial and capability enforcement remain unproven. Artifact application or backend readiness is not itself enforcement evidence. UNKNOWN remains first-class. Progress is the engineering record of what is demonstrated.

Try it in 4 commands Choose your path

PLAT · nginx-demo / defaultobserved 60s

broad, hand-authored — never trimmed back direct evidence, confidence-annotated where applicable

LEARNED ≠ AUTHORIZED

the boundary

Runtime learning is a solved problem, and other systems do it better. security-profiles-operator records syscalls with a production eBPF recorder, generates a SeccompProfile, installs it on every node and enforces it.

What no learner provides is a decision. A recorded profile describes what a workload did; enforcing it is a statement about what it is allowed to do. Those are not the same claim.

Direct observation: landlock-genprof acquires filesystem, network, and applicable capability evidence. SPO-derived policy: in SPO mode, Security Profiles Operator owns syscall observation and produces the real SeccompProfile; landlock-genprof imports it as derived policy with provenance preserved.

Different origins converge in one reviewable SecurityProfileProposal. SPO-derived syscalls do not enter landlock-genprof TrainingHistory and receive no invented confidence.

CandidateDigest is deterministic content identity, not authority. Human approval binds authority to that exact digest; changed content cannot inherit stale approval. See the governed workflow and ADR-0008.

Observe, review, approve, apply

the governed loop

Four commands, in this order. Approval is bound to the exact candidate digest. Governed apply revalidates that authority and implemented backend readiness, refusing missing, stale, or mismatched approval. External systems enforce: applied ≠ enforced; enforced ≠ verified.

01 — trace

Watch it run

Collects direct evidence for the selected source mode and publishes a candidate. In SPO mode, syscall policy comes from the named SPO-derived SeccompProfile.

kubectl landlock-genprof trace \
  --pod nginx-demo -n default \
  --binary /usr/sbin/nginx \
  --duration 60s

02 — review

See what it saw

Prints the mixed-origin candidate, preserved provenance, applicable confidence, artifact readiness, and the CandidateDigest identifying its exact content.

kubectl landlock-genprof review \
  nginx-demo

03 — approve

Authorize that exact candidate

Approval binds to the digest review printed, not to the proposal's name — so a later run that changes the candidate does not inherit it.

kubectl landlock-genprof approve \
  nginx-demo \
  --expected-digest sha256:<from-review>

04 — apply-proposal

Apply only what was approved

Re-reads the proposal and re-checks the digest before applying anything; a missing, stale, or changed binding fails closed. The confirmation prompt is an extra operator safeguard on top, not the authority gate.

kubectl landlock-genprof \
  apply-proposal nginx-demo

See it run

real recording, not staged

A short interactive capture from a live cluster. For the complete current SPO-derived-policy, digest-bound approval, stale-authority rejection, and governed-apply scenario, follow the canonical demo.

RECORDING · nginx-demo / defaultclick to play on asciinema →

One candidate, four domains

what gets governed

Direct observations can carry cross-run confidence. SPO-derived syscalls are different: they enter as derived policy with provenance, never as landlock-genprof observations, and receive no fabricated TrainingHistory confidence.

Filesystem

Landlock policy

→ PodLock LandlockProfile seen on every run

Network

Egress rights

→ Kubernetes NetworkPolicy seen on every run

Syscalls

Seccomp profile

→ security-profiles-operator CR SPO-derived: provenance, no invented confidence

Capabilities

Linux capabilities

→ securityContext fragment review before prod

Where to start

pick one

No cluster yet

Set up a test environment

A disposable kind cluster, from nothing — one script.

docs/test-environment → Already have one

Install

Get the CLI, apply the RBAC/CRDs, against a cluster you already run.

INSTALL → Reference

Usage & CLI reference

Every flag, one section each — plus a generated page per command.

docs/usage → Under the hood

Architecture

Components and interactions, at a glance — deep dives nested underneath.

docs/architecture →

Working on the codebase itself? See the contributor quickstart instead — git workflow, code walkthrough, first tasks per role.

Complementary, not competing

positioning

landlock-genprof doesn't implement the kernel enforcement mechanisms itself — it feeds three existing, independent backends, one per domain, in the format each expects. None of them are installed by this project, and generating or applying an artifact is not the same as enforcing it: each card below says how far v0.2.0 actually goes. What each mechanism needs: enforcement prerequisites. Full positioning against PodLock/SPO/static compliance scanners: product definition.

Filesystem (Landlock)

PodLock

Kubewarden ecosystem — enforces at container startup generated · approval-bound · API applied kernel enforcement not demonstrated in v0.2.0

Syscalls (seccomp)

security-profiles-operator

materializes the profile onto every node generated · API plumbing tested tested Seccomp boundary demonstrated on a real node not a universal least-privilege claim