apiVersion: v1
kind: Pod
metadata:
  name: nginx
  annotations:
    container.apparmor.security.beta.kubernetes.io/hello: localhost/k8s-apparmor-example-deny-write
spec:
  containers:
  - image: busybox
    name: hello
    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]
  nodeSelector:
    pod: apparmor
