name               string
		podProfile         *v1.AppArmorProfile
		expectedProfile    *runtimeapi.SecurityProfile
		expectedOldProfile string
		expectError        bool
	}{{
		name:            "no appArmor",
		expectedProfile: nil,
	}, {
		name:       "runtime default",
		podProfile: &v1.AppArmorProfile{Type: v1.AppArmorProfileTypeRuntimeDefault},
		expectedProfile: &runtimeapi.SecurityProfile{

    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
    #
    # annotations:
    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
    #

				ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{
					`container.apparmor.security.beta.kubernetes.io/foo`: `unconfined`,
				}},
				Spec: api.PodSpec{Containers: []api.Container{{Name: "foo"}}},
			},
			expected: []string{
				`template.metadata.annotations[container.apparmor.security.beta.kubernetes.io/foo]: deprecated since v1.30; use the "appArmorProfile" field instead`,
			},
		},

    # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
    #
    # annotations:
    #   apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
    #   apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
    #

	if err != nil {
		return nil, err
	}

	// set ApparmorProfile.
	synthesized.Apparmor, synthesized.ApparmorProfile, err = getAppArmorProfile(pod, container)
	if err != nil {
		return nil, err
	}

	// set RunAsUser.
	if synthesized.RunAsUser == nil {
		if uid != nil {

		{
			desc:      "ModifyEscapedPathValue",
			path:      `values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy`,
			value:     `runtime/default`,
			wantFound: true,
			want: `
values:
  sidecarInjectorWebhook:
    injectedAnnotations:
      container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
`,
		},
	}
	for _, tt := range tests {

				}
			}

			return true
		})
}

// appArmorFieldForAnnotation takes a pod apparmor profile field and returns the
// converted annotation value
func appArmorAnnotationForField(field *api.AppArmorProfile) string {
	// If only apparmor fields are specified, add the corresponding annotations.
	// This ensures that the fields are enforced even if the node version

		pod            api.Pod
	}{{
		description:    "with AppArmor Annotations",
		hasAnnotations: true,
		pod: api.Pod{
			ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1", v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "foo": "default"}},
			Spec:       api.PodSpec{},
		},
	}, {
		description:    "with AppArmor Annotations & fields",
		hasAnnotations: true,
		hasFields:      true,

	}

	if !utilfeature.DefaultFeatureGate.Enabled(features.AppArmor) && !appArmorAnnotationsInUse(oldPodAnnotations) {
		for k := range podAnnotations {
			if strings.HasPrefix(k, api.DeprecatedAppArmorAnnotationKeyPrefix) {
				delete(podAnnotations, k)
			}
		}
	}

  # To override a setting that includes dots, escape them with a backslash (\).  Your shell may require enclosing quotes.
  istioctl manifest generate --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default"
`,
		Args: func(cmd *cobra.Command, args []string) error {
			if len(args) != 0 {
				return fmt.Errorf("generate accepts no positional arguments, got %#v", args)