},
		{
			description:     "pod seccomp profile set to unconfined returns unconfined",
			podSc:           &v1.PodSecurityContext{SeccompProfile: &v1.SeccompProfile{Type: v1.SeccompProfileTypeUnconfined}},
			expectedProfile: unconfinedProfile,
		},
		{
			description:     "container seccomp profile set to unconfined returns unconfined",

		},
		expectedOldProfile: "runtime/default",
	}, {
		name:       "unconfined",
		podProfile: &v1.AppArmorProfile{Type: v1.AppArmorProfileTypeUnconfined},
		expectedProfile: &runtimeapi.SecurityProfile{
			ProfileType: runtimeapi.SecurityProfile_Unconfined,
		},
		expectedOldProfile: "unconfined",
	}, {
		name: "localhost",
		podProfile: &v1.AppArmorProfile{

			pod:             newSeccompPod(nil, nil, "unconfined", ""),
			expectedProfile: v1.SeccompProfileTypeRuntimeDefault,
		},
		{
			description:     "seccomp annotation defined at container level should not be honoured",
			pod:             newSeccompPod(nil, nil, "", "unconfined"),
			expectedProfile: v1.SeccompProfileTypeRuntimeDefault,
		},
	}

			},
		},
		validation: func(t *testing.T, pod *api.Pod) {
			assert.Empty(t, pod.Annotations)
			assert.Nil(t, pod.Spec.SecurityContext.AppArmorProfile)
		},
	}, {
		description: "Pod field unconfined and no annotation present",
		pod: &api.Pod{
			Spec: api.PodSpec{
				SecurityContext: &api.PodSecurityContext{
					AppArmorProfile: &api.AppArmorProfile{
						Type: api.AppArmorProfileTypeUnconfined,

				},
			},
			Spec: validPodSpec(nil),
		},
		"unconfined seccomp profile": {
			ObjectMeta: metav1.ObjectMeta{
				Name:      "123",
				Namespace: "ns",
				Annotations: map[string]string{
					core.SeccompPodAnnotationKey: "unconfined",
				},
			},
			Spec: validPodSpec(nil),
		},
		"localhost seccomp profile": {

// SeccompProfileType defines the supported seccomp profile types.
type SeccompProfileType string

const (
	// SeccompProfileTypeUnconfined is when no seccomp profile is applied (A.K.A. unconfined).
	SeccompProfileTypeUnconfined SeccompProfileType = "Unconfined"
	// SeccompProfileTypeRuntimeDefault represents the default container runtime seccomp profile.
	SeccompProfileTypeRuntimeDefault SeccompProfileType = "RuntimeDefault"

// +enum
type SeccompProfileType string

const (
	// SeccompProfileTypeUnconfined indicates no seccomp profile is applied (A.K.A. unconfined).
	SeccompProfileTypeUnconfined SeccompProfileType = "Unconfined"
	// SeccompProfileTypeRuntimeDefault represents the default container runtime seccomp profile.
	SeccompProfileTypeRuntimeDefault SeccompProfileType = "RuntimeDefault"

	"type":             "type indicates which kind of AppArmor profile will be applied. Valid options are:\n  Localhost - a profile pre-loaded on the node.\n  RuntimeDefault - the container runtime's default profile.\n  Unconfined - no AppArmor enforcement.",

  // type indicates which kind of AppArmor profile will be applied.
  // Valid options are:
  //   Localhost - a profile pre-loaded on the node.
  //   RuntimeDefault - the container runtime's default profile.
  //   Unconfined - no AppArmor enforcement.
  // +unionDiscriminator
  optional string type = 1;

  // localhostProfile indicates a profile loaded on the node that should be used.
  // The profile must be preconfigured on the node to work.

            "description": "type indicates which kind of AppArmor profile will be applied. Valid options are:\n  Localhost - a profile pre-loaded on the node.\n  RuntimeDefault - the container runtime's default profile.\n  Unconfined - no AppArmor enforcement.",
            "type": "string"
          }
        },
        "required": [
          "type"
        ],
        "type": "object",
        "x-kubernetes-unions": [