landlock-genprof export
Renders an already-synthesized candidate to a target output format
Synopsis
Renders an already-synthesized candidate (see internal/exporter/landlockjson) to a target output format, without re-running synthesis. Never mutates a cluster — pure rendering; see a future apply for actually applying an approved artifact. Prints to stdout unless –out is given.
Installed as a kubectl plugin (the common case): run this as kubectl landlock-genprof <command>. Running this binary directly instead (standalone, not via kubectl) works the same way, without that prefix.
landlock-genprof export --candidate-file <path> --format podlock --pod <name> --container <name> --binary <path> [flags]
Examples
kubectl landlock-genprof export --candidate-file nginx-demo-candidate.json \
--format podlock --pod nginx-demo --namespace default --container nginx --binary /usr/sbin/nginx
kubectl landlock-genprof export --candidate-file nginx-demo-candidate.json \
--format podlock --pod nginx-demo --container nginx --binary /usr/sbin/nginx --out profile.yaml
Options
--binary string Binary path to label the output with (required)
--candidate-file string Path to a candidate JSON file (see internal/exporter/landlockjson) (required)
-c, --container string Container name to label the output with (required)
--format string Output format (supported today: podlock) (default "podlock")
-h, --help help for export
-n, --namespace string Namespace to label the output with (default "default")
-o, --out string Output file (default: stdout)
-p, --pod string Pod name to label the output with (required)
SEE ALSO
- landlock-genprof - Generates least-privilege Kubernetes security profiles by observing a running pod