landlock-genprof
Generates least-privilege Kubernetes security profiles by observing a running pod
Synopsis
Observes a running Kubernetes pod and generates least-privilege security profiles from what it actually saw — a PodLock LandlockProfile always, plus NetworkPolicy/seccomp/Linux capabilities/securityContext outputs behind their own flags.
Installed as a kubectl plugin (the common case): run this as kubectl landlock-genprof <command>. Running this binary directly instead (standalone, not via kubectl) works the same way, without that prefix.
Options
-h, --help help for landlock-genprof
SEE ALSO
- landlock-genprof abi - Inspects Landlock’s ABI-versioned right vocabulary
- landlock-genprof apply-proposal - Reviews and applies an approved, digest-bound SecurityProfileProposal
- landlock-genprof approve - Records an explicit approval decision on a SecurityProfileProposal
- landlock-genprof custody-epoch - Manages the ApplyAttempt custody qualification epoch
- landlock-genprof diff - Compares two synthesized candidates rule by rule
- landlock-genprof doctor - Checks this host’s (or a given kernel version’s) Landlock/eBPF prerequisites
- landlock-genprof evidence - Inspects raw captured evidence
- landlock-genprof explain - Explains why a synthesized candidate’s rules exist
- landlock-genprof export - Renders an already-synthesized candidate to a target output format
- landlock-genprof observe - Runs a bounded runtime Observation for a running Pod
- landlock-genprof policy - Inspects SecurityProfileProposal approval state
- landlock-genprof reject - Records an explicit rejection decision on a SecurityProfileProposal
- landlock-genprof review - Reviews a published SecurityProfileProposal
- landlock-genprof rollback - Explicitly rolls back an eligible ApplyAttempt
- landlock-genprof synthesize - Re-runs synthesis offline from previously captured evidence
- landlock-genprof trace - Starts a training run on a target pod and generates least-privilege security profiles
- landlock-genprof ui - Serves the local read-only Workbench HTTP boundary
- landlock-genprof verify - Checks a synthesized Landlock candidate against a target kernel’s ABI level
- landlock-genprof version - Prints the version