Repository: kubernetes
Issue: kubectl get pods command shows status AppArmor for pod on k8s v1.22
Labels: kind/bug,priority/important-soon,sig/node,help wanted,lifecycle/frozen,kind/regression,needs-triage

#### What happened:
I recently upgraded to k8s version 1.22 and made the following observations. I deployed hello-apparmor.yaml example from the kubernetes tutorial on [securing pods with AppArmor](https://kubernetes.io/docs/tutorials/clusters/apparmor/).
hello-apparmor.yaml
```
apiVersion: v1
kind: Pod
metadata:
  name: hello-apparmor
  annotations:
    container.apparmor.security.beta.kubernetes.io/hello: localhost/k8s-apparmor-example-deny-write
spec:
  containers:
  - name: hello
    image: busybox
    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]
```
Since I had not loaded corresponding apparmor profile yet I got this output using `kubectl describe pods`:
```
Annotations:  container.apparmor.security.beta.kubernetes.io/hello: localhost/k8s-apparmor-example-deny-write
Status:       Pending
Reason:       AppArmor
Message:      Cannot enforce AppArmor: profile "k8s-apparmor-example-deny-write" is not loaded
```
And `kubectl get pods -A` output:
```
vagrant@ubuntu-focal:~$ kubectl get po -A
NAMESPACE     NAME                                   READY   STATUS    RESTARTS      AGE
default       hello-apparmor                         0/1     Blocked   0             4s
kube-system   cilium-9x8xr                           1/1     Running   1 (19h ago)   20h
kube-system   cilium-operator-58874d67c7-lxwmq       1/1     Running   1 (10m ago)   20h
kube-system   coredns-78fcd69978-msf42               1/1     Running   1 (10m ago)   20h
kube-system   coredns-78fcd69978-tjvgd               1/1     Running   1 (19h ago)   20h
kube-system   etcd-ubuntu-focal                      1/1     Running   2 (10m ago)   20h
kube-system   kube-apiserver-ubuntu-focal            1/1     Running   2 (10m ago)   20h
kube-system   kube-controller-manager-ubuntu-focal   1/1     Running   2 (10m ago)   20h
kube-system   kube-proxy-894v8                       1/1     Running   1 (10m ago)   20h
kube-system   kube-scheduler-ubuntu-focal            1/1     Running   2 (19h ago)   20h
```
So to correct that I applied the desired apparmor profile(k8s-apparmor-example-deny-write). After doing so I get the following outputs:
`sudo aa-status`
```
30 profiles are in enforce mode.
   /snap/snapd/12883/usr/lib/snapd/snap-confine
   /snap/snapd/12883/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/tcpdump
   /{,usr/}sbin/dhclient
   docker-default
   k8s-apparmor-example-deny-write
```
`kubectl describe pods`
```
vagrant@ubuntu-focal:~$ kubectl get po -A
NAMESPACE     NAME                                   READY   STATUS     RESTARTS      AGE
default       hello-apparmor                         1/1     AppArmor   0             6m28s
kube-system   cilium-9x8xr                           1/1     Running    1 (19h ago)   20h
kube-system   cilium-operator-58874d67c7-lxwmq       1/1     Running    1 (16m ago)   20h
kube-system   coredns-78fcd69978-msf42               1/1     Running    1 (16m ago)   20h
kube-system   coredns-78fcd69978-tjvgd               1/1     Running    1 (19h ago)   20h
kube-system   etcd-ubuntu-focal                      1/1     Running    2 (16m ago)   20h
kube-system   kube-apiserver-ubuntu-focal            1/1     Running    2 (16m ago)   20h
kube-system   kube-controller-manager-ubuntu-focal   1/1     Running    2 (16m ago)   20h
kube-system   kube-proxy-894v8                       1/1     Running    1 (16m ago)   20h
kube-system   kube-scheduler-ubuntu-focal            1/1     Running    2 (19h ago)   20h
```
`kubectl describe pods`
```
Annotations:  container.apparmor.security.beta.kubernetes.io/hello: localhost/k8s-apparmor-example-deny-write
Status:       Running
Reason:       AppArmor
Message:      Cannot enforce AppArmor: profile "k8s-apparmor-example-deny-write" is not loaded
```
#### What you expected to happen:
I followed the same steps on k8s version 1.21 and couldn't produce the issue. I think we should get `Running` instead of `AppArmor` and the message shouldn't be displayed since the profile is already applied.
#### How to reproduce it (as minimally and precisely as possible):
Steps to reproduce:
1. Deploy a pod with apparmor annotations.
2. Enforce the associated apparmor profile.
#### Anything else we need to know?:
1. I checked whether profile is actually being enforced using `kubectl exec -ti hello-apparmor -- /bin/sh` and found that the profile is indeed enforced on the pod containers.
```
/ # touch newfile
touch: newfile: Permission denied
```
Here I tried creating newfile and apparmor blocks it since the profile denies write.
2. This doesn't go away even after waiting for several hours.
#### Environment:
- Kubernetes version (use `kubectl version`):
```
Client Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.0", GitCommit:"c2b5237ccd9c0f1d600d3072634ca66cefdf272f", GitTreeState:"clean", BuildDate:"2021-08-04T18:03:20Z", GoVersion:"go1.16.6", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.1", GitCommit:"632ed300f2c34f6d6d15ca4cef3d3c7073412212", GitTreeState:"clean", BuildDate:"2021-08-19T15:39:34Z", GoVersion:"go1.16.7", Compiler:"gc", Platform:"linux/amd64"}
```
- Cloud provider or hardware configuration:
Vagrant virtualbox VM
memory = 4096
cpus = 4
- OS (e.g: `cat /etc/os-release`):
```
NAME="Ubuntu"
VERSION="20.04.3 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.3 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal
```
- Kernel (e.g. `uname -a`):
```
Linux ubuntu-focal 5.4.0-84-generic #94-Ubuntu SMP Thu Aug 26 20:27:37 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
```
- Install tools:
- Others: