Add AppArmor Annotations

apiVersion: policies.kyverno.io/v1alpha1
kind: MutatingPolicy
metadata:
  name: add-apparmor-annotations
  annotations:
    policies.kyverno.io/title: Add AppArmor Annotations
    policies.kyverno.io/category: PSP Migration
    policies.kyverno.io/subject: Pod,Annotation
    pod-policies.kyverno.io/autogen-controllers: none
    policies.kyverno.io/description: In the earlier Pod Security Policy controller, it was possible to define a setting which would enable AppArmor for all the containers within a Pod so they may be assigned the desired profile. Assigning an AppArmor profile, accomplished via an annotation, is useful in that it allows secure defaults to be defined and may also result in passing other validation rules such as those in the Pod Security Standards. This policy mutates Pods to add an annotation for every container to enabled AppArmor at the runtime/default level.
spec:
  evaluation:
    admission:
      enabled: true
  matchConstraints:
    resourceRules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        operations:
          - CREATE
          - UPDATE
        resources:
          - pods
  variables:
    - name: allContainers
      expression: "object.spec.containers +  (has(object.spec.initContainers) ? object.spec.initContainers : []) +  (has(object.spec.ephemeralContainers) ? object.spec.ephemeralContainers : [])"
  mutations:
    - patchType: JSONPatch
      jsonPatch:
        expression: |
          !has(object.metadata.annotations) ?
          [
            JSONPatch{
              op: "add",
              path: "/metadata/annotations",
              value: {}
            }
          ] : []
    - patchType: JSONPatch
      jsonPatch:
        expression: |
          variables.allContainers.map(c,
            JSONPatch{
              op: "add",
              path: "/metadata/annotations/" + jsonpatch.escapeKey("container.apparmor.security.beta.kubernetes.io/" + c.name),
              value: "runtime/default"
            }
          )