landlock-genprof approve
Records an explicit approval decision on a SecurityProfileProposal
Synopsis
Records an explicit approval decision on a SecurityProfileProposal, binding approval to the reviewed candidate digest. Governed apply-proposal requires a valid Approved state with that digest and the supported candidate-v1 mechanism; its confirmation prompt is additional operator confirmation.
Installed as a kubectl plugin (the common case): run this as kubectl landlock-genprof <command>. Running this binary directly instead (standalone, not via kubectl) works the same way, without that prefix.
landlock-genprof approve <proposal> [flags]
Examples
kubectl landlock-genprof approve nginx-demo
kubectl landlock-genprof approve nginx-demo --reason "reviewed with the platform team, looks right" --expected-digest sha256:...
Options
--expected-digest string (approve only) Expected candidate digest to bind approval to (format: sha256:<hex>)
-h, --help help for approve
-n, --namespace string Kubernetes namespace (default "default")
--reason string Optional free-text note explaining this decision
SEE ALSO
- landlock-genprof - Generates least-privilege Kubernetes security profiles by observing a running pod