Sets a Non-Standard AppArmor Annotation

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: pod-apparmor-annotation-values
  annotations:
    kubeapt.io/uuid: "79f6f10f-1013-45a8-bd05-cd509c20383a"
    security.kubeapt.io/displayName: "Sets a Non-Standard AppArmor Annotation"
    security.kubeapt.io/description: "A legacy AppArmor annotation set to unconfined leaves the named container with no mandatory access control profile, so its file, capability and mount operations run unrestricted against the host kernel."
    security.kubeapt.io/resource: "Pods"
    security.kubeapt.io/severity: "Moderate"
    security.kubeapt.io/remediation: "Set the annotation value to runtime/default, or to localhost/ followed by a profile loaded on the node. Field: metadata.annotations[container.apparmor.security.beta.kubernetes.io/<container-name>]."
    security.kubeapt.io/product: "Kubernetes"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - ''
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - pods
  validations:
  - expression: |
      !has(object.metadata.annotations) || !object.metadata.annotations.exists(k,
        k.startsWith("container.apparmor.security.beta.kubernetes.io/") &&
        !(object.metadata.annotations[k] == "runtime/default" ||
          object.metadata.annotations[k].startsWith("localhost/"))
      )
    message: |
      Annotations under container.apparmor.security.beta.kubernetes.io/* must be "runtime/default" or start with "localhost/". Other values are not allowed.