AppArmorProfile *AppArmorProfile
}

// SeccompProfile defines a pod/container's seccomp profile settings.
// Only one profile source may be set.
// +union
type SeccompProfile struct {
	// +unionDiscriminator
	Type SeccompProfileType
	// Load a profile defined in static file on the node.
	// The profile must be preconfigured on the node to work.
	// LocalhostProfile cannot be an absolute nor a descending path.

                  - protocol
                  type: object
                type: array
              profiles:
                description: A list of identifiers of security Profile objects that
                  apply to this endpoint. Each profile is applied in the order that
                  they appear in this list.  Profile rules are applied after the selector-based
                  security policy.
                items:

- ValidatingAdmissionPolicy now exclude TokenReview, SelfSubjectReview, LocalSubjectAccessReview,...

	return allErrs
}

func ValidateAppArmorProfileFormat(profile string) error {
	if profile == "" || profile == v1.DeprecatedAppArmorBetaProfileRuntimeDefault || profile == v1.DeprecatedAppArmorBetaProfileNameUnconfined {
		return nil
	}
	if !strings.HasPrefix(profile, v1.DeprecatedAppArmorBetaProfileNamePrefix) {
		return fmt.Errorf("invalid AppArmor profile name: %q", profile)
	}
	return nil
}

	"localhostProfile": "localhostProfile indicates a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. Must match the loaded name of the profile. Must be set if and only if type is \"Localhost\".",...

}

// SeccompProfile defines a pod/container's seccomp profile settings.
// Only one profile source may be set.
// +union
type SeccompProfile struct {
	// type indicates which kind of seccomp profile will be applied.
	// Valid options are:
	//
	// Localhost - a profile defined in a file on the node should be used.
	// RuntimeDefault - the container runtime default profile should be used.

  // type indicates which kind of AppArmor profile will be applied.
  // Valid options are:
  //   Localhost - a profile pre-loaded on the node.
  //   RuntimeDefault - the container runtime's default profile.
  //   Unconfined - no AppArmor enforcement.
  // +unionDiscriminator
  optional string type = 1;

  // localhostProfile indicates a profile loaded on the node that should be used.
  // The profile must be preconfigured on the node to work.

        "properties": {
          "localhostProfile": {

	DefaultRevision string `protobuf:"bytes,40,opt,name=defaultRevision,proto3" json:"defaultRevision,omitempty"`
	// Specifies which installation configuration profile to apply.
	Profile string `protobuf:"bytes,42,opt,name=profile,proto3" json:"profile,omitempty"`
	// Specifies the compatibility version to use. When this is set, the control plane will
	// be configured with the same defaults as the specified version.

- Added "general", "baseline", and "restricted" debugging profiles for kubectl debug. ([#114280](https://github.com/kubernetes/kubernetes/pull/114280), [@sding3](https://github.com/sding3)) [SIG CLI]
- Added "netadmin" debugging profiles for kubectl debug. ([#115712](https://github.com/kubernetes/kubernetes/pull/115712), [@wedaly](https://github.com/wedaly)) [SIG CLI]