kubectl kguardian
The kguardian CLI is a kubectl plugin that generates security policies from observed runtime behavior.Installation
See the Installation Guide for detailed instructions.Global Flags
Available for all commands:--broker-namespace and --broker-service matter when kguardian is
installed outside the default kguardian namespace — the CLI
port-forwards to the broker and needs to find it.
Commands
gen networkpolicy
Generate Network Policies from observed traffic
gen seccomp
Generate Seccomp profiles from syscall usage
audit promote
Convert an AuditNetworkPolicy into an enforced networking.k8s.io/v1 NetworkPolicy ready for kubectl apply.
audit promote-cluster
Convert an AuditClusterNetworkPolicy into one NetworkPolicy per matched namespace (discovery from
namespaceSelector).serve
Run the advisor as an in-cluster HTTP service exposing
/generate/networkpolicy, /generate/seccomp, and /healthz — used by the MCP server’s chat tools.version
Print client version information. Also available as
-v / --version on the root command.