landlock-genprof diff
Compares two synthesized candidates rule by rule
Synopsis
Compares two synthesized candidates (see internal/exporter/landlockjson), reporting rules added, removed, or whose rights changed — the check for a dependency bump silently widening or narrowing what a workload needs between two training runs. –output junit renders one testcase per rule path (failed = changed) instead of text, for CI dashboards that already render JUnit results — the exit-code contract (0/1/3) is unchanged either way.
Installed as a kubectl plugin (the common case): run this as kubectl landlock-genprof <command>. Running this binary directly instead (standalone, not via kubectl) works the same way, without that prefix.
landlock-genprof diff <old-candidate-file> <new-candidate-file> [flags]
Examples
kubectl landlock-genprof diff nginx-demo-candidate-old.json nginx-demo-candidate-new.json
kubectl landlock-genprof diff old.json new.json --output junit > diff.xml
Options
-h, --help help for diff
--output string Output format: text or junit (default "text")
SEE ALSO
- landlock-genprof - Generates least-privilege Kubernetes security profiles by observing a running pod