### What happened?

If I define the podSecurityContext with appArmorProfile unconfined, containerd does not take it into account and use the default cri-containerd.apparmor.d profile.
I don't have the problem if I use the deprecated annotations.

### What did you expect to happen?

The securityContext should give the same result as the annotations. According to #123811 containerd uses both methods.

### How can we reproduce it (as minimally and precisely as possible)?

This deployment works with annotations:
```
apiVersion: apps/v1                                                                                                                                          
kind: Deployment                                                                                                                                             
metadata:                                                                                                                                                    
  name: test                                                                                                                                                 
  namespace: test                                                                                                                                            
spec:                                                                                                                                                        
  selector:                                                                                                                                                  
    matchLabels:                                                                                                                                             
      mytest: test
  template:
    metadata:
      labels:
        mytest: test
      annotations:
        container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined
    spec:
      initContainers:
      - name: mount-cgroup
        image: quay.io/cilium/cilium:v1.15.4
        env:
        - name: CGROUP_ROOT
          value: /run/cilium/cgroupv2
        - name: BIN_PATH
          value: /opt/cni/bin
        securityContext:
          appArmorProfile:
            type: Unconfined
          capabilities:
            add:
            - SYS_ADMIN
            - SYS_CHROOT
            - SYS_PTRACE
            drop:
            - ALL
          seLinuxOptions:
            level: s0
            type: spc_t
        command:
        - sh
        - -ec
        - ls -la /hostproc/1/ns/cgroup
        volumeMounts:
        - name: hostproc
          mountPath: /hostproc
      containers:
      - name: busybox
        image: busybox
        command:
        - sleep
        - "300"
        securityContext:
          appArmorProfile:
            type: Unconfined
      volumes:
      - name: hostproc
        hostPath:
          path: /proc
          type: Directory
```
But this one doesn't.
```
apiVersion: apps/v1                                                                                                                                          
kind: Deployment                                                                                                                                             
metadata:                                                                                                                                                    
  name: test                                                                                                                                                 
  namespace: test                                                                                                                                            
spec:                                                                                                                                                        
  selector:                                                                                                                                                  
    matchLabels:                                                                                                                                             
      mytest: test
  template:
    metadata:
      labels:
        mytest: test
    spec:
      initContainers:
      - name: mount-cgroup
        image: quay.io/cilium/cilium:v1.15.4
        env:
        - name: CGROUP_ROOT
          value: /run/cilium/cgroupv2
        - name: BIN_PATH
          value: /opt/cni/bin
        securityContext:
          appArmorProfile:
            type: Unconfined
          capabilities:
            add:
            - SYS_ADMIN
            - SYS_CHROOT
            - SYS_PTRACE
            drop:
            - ALL
          seLinuxOptions:
            level: s0
            type: spc_t
        command:
        - sh
        - -ec
        - ls -la /hostproc/1/ns/cgroup
        volumeMounts:
        - name: hostproc
          mountPath: /hostproc
      containers:
      - name: busybox
        image: busybox
        command:
        - sleep
        - "300"
        securityContext:
          appArmorProfile:
            type: Unconfined
      volumes:
      - name: hostproc
        hostPath:
          path: /proc
          type: Directory
```
dmesg on the node where the container is launched gives:
`type=1400 audit(1716404572.354:231): apparmor="DENIED" operation="ptrace" profile="cri-containerd.apparmor.d" pid=1852196 comm="ls" requested_mask="read" denied_mask="read" peer="unconfined"`

### Anything else we need to know?

_No response_

### Kubernetes version

<details>

```console
$ kubectl version
Client Version: v1.30.1
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.30.1
```

</details>


### Cloud provider

<details>
Bare Metal K8s on Ubuntu 22.04 servers
</details>


### OS version

<details>

```console
# On Linux:
$ cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.4 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.4 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy
$ uname -a
# Linux k8s-master-01 5.15.0-88-generic #98-Ubuntu SMP Mon Oct 2 15:18:56 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here
```

</details>


### Install tools

<details>

</details>


### Container runtime (CRI) and version (if applicable)

<details>
Version:  0.1.0
RuntimeName:  containerd
RuntimeVersion:  v1.7.17
RuntimeApiVersion:  v1
</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>
cilium-cli: v0.16.7 compiled with go1.22.2 on linux/amd64
cilium image (default): v1.15.4
cilium image (stable): v1.15.5
cilium image (running): 1.15.4
</details>

Bug: securityContext appArmorProfile unconfined not working with containerd
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : Bug: securityContext appArmorProfile unconfined not working with containerd
Issue date:

--- start body ---
### What happened?

If I define the podSecurityContext with appArmorProfile unconfined, containerd does not take it into account and use the default cri-containerd.apparmor.d profile.
I don't have the problem if I use the deprecated annotations.

### What did you expect to happen?

The securityContext should give the same result as the annotations. According to #123811 containerd uses both methods.

### How can we reproduce it (as minimally and precisely as possible)?

This deployment works with annotations:
```
apiVersion: apps/v1                                                                                                                                          
kind: Deployment                                                                                                                                             
metadata:                                                                                                                                                    
  name: test                                                                                                                                                 
  namespace: test                                                                                                                                            
spec:                                                                                                                                                        
  selector:                                                                                                                                                  
    matchLabels:                                                                                                                                             
      mytest: test
  template:
    metadata:
      labels:
        mytest: test
      annotations:
        container.apparmor.security.beta.kubernetes.io/mount-cgroup: unconfined
    spec:
      initContainers:
      - name: mount-cgroup
        image: quay.io/cilium/cilium:v1.15.4
        env:
        - name: CGROUP_ROOT
          value: /run/cilium/cgroupv2
        - name: BIN_PATH
          value: /opt/cni/bin
        securityContext:
          appArmorProfile:
            type: Unconfined
          capabilities:
            add:
            - SYS_ADMIN
            - SYS_CHROOT
            - SYS_PTRACE
            drop:
            - ALL
          seLinuxOptions:
            level: s0
            type: spc_t
        command:
        - sh
        - -ec
        - ls -la /hostproc/1/ns/cgroup
        volumeMounts:
        - name: hostproc
          mountPath: /hostproc
      containers:
      - name: busybox
        image: busybox
        command:
        - sleep
        - "300"
        securityContext:
          appArmorProfile:
            type: Unconfined
      volumes:
      - name: hostproc
        hostPath:
          path: /proc
          type: Directory
```
But this one doesn't.
```
apiVersion: apps/v1                                                                                                                                          
kind: Deployment                                                                                                                                             
metadata:                                                                                                                                                    
  name: test                                                                                                                                                 
  namespace: test                                                                                                                                            
spec:                                                                                                                                                        
  selector:                                                                                                                                                  
    matchLabels:                                                                                                                                             
      mytest: test
  template:
    metadata:
      labels:
        mytest: test
    spec:
      initContainers:
      - name: mount-cgroup
        image: quay.io/cilium/cilium:v1.15.4
        env:
        - name: CGROUP_ROOT
          value: /run/cilium/cgroupv2
        - name: BIN_PATH
          value: /opt/cni/bin
        securityContext:
          appArmorProfile:
            type: Unconfined
          capabilities:
            add:
            - SYS_ADMIN
            - SYS_CHROOT
            - SYS_PTRACE
            drop:
            - ALL
          seLinuxOptions:
            level: s0
            type: spc_t
        command:
        - sh
        - -ec
        - ls -la /hostproc/1/ns/cgroup
        volumeMounts:
        - name: hostproc
          mountPath: /hostproc
      containers:
      - name: busybox
        image: busybox
        command:
        - sleep
        - "300"
        securityContext:
          appArmorProfile:
            type: Unconfined
      volumes:
      - name: hostproc
        hostPath:
          path: /proc
          type: Directory
```
dmesg on the node where the container is launched gives:
`type=1400 audit(1716404572.354:231): apparmor="DENIED" operation="ptrace" profile="cri-containerd.apparmor.d" pid=1852196 comm="ls" requested_mask="read" denied_mask="read" peer="unconfined"`

### Anything else we need to know?

_No response_

### Kubernetes version

<details>

```console
$ kubectl version
Client Version: v1.30.1
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.30.1
```

</details>


### Cloud provider

<details>
Bare Metal K8s on Ubuntu 22.04 servers
</details>


### OS version

<details>

```console
# On Linux:
$ cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.4 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.4 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy
$ uname -a
# Linux k8s-master-01 5.15.0-88-generic #98-Ubuntu SMP Mon Oct 2 15:18:56 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here
```

</details>


### Install tools

<details>

</details>


### Container runtime (CRI) and version (if applicable)

<details>
Version:  0.1.0
RuntimeName:  containerd
RuntimeVersion:  v1.7.17
RuntimeApiVersion:  v1
</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>
cilium-cli: v0.16.7 compiled with go1.22.2 on linux/amd64
cilium image (default): v1.15.4
cilium image (stable): v1.15.5
cilium image (running): 1.15.4
</details>

--- end body ---
