From 3ecb3d230f39a351ba2b760f4e29a274e62590a8 Mon Sep 17 00:00:00 2001
From: Tim Allclair <tallclair@google.com>
Date: Tue, 27 May 2025 10:40:31 -0700
Subject: [PATCH] Remove unused appArmor*InUse functions

---
 pkg/api/pod/util.go      | 29 ------------
 pkg/api/pod/util_test.go | 99 ----------------------------------------
 2 files changed, 128 deletions(-)

diff --git a/pkg/api/pod/util.go b/pkg/api/pod/util.go
index a5b0776fd8d..f4805115a4c 100644
--- a/pkg/api/pod/util.go
+++ b/pkg/api/pod/util.go
@@ -1232,35 +1232,6 @@ func procMountInUse(podSpec *api.PodSpec) bool {
 	return inUse
 }
 
-// appArmorAnnotationsInUse returns true if the pod has apparmor annotations
-func appArmorAnnotationsInUse(podAnnotations map[string]string) bool {
-	for k := range podAnnotations {
-		if strings.HasPrefix(k, api.DeprecatedAppArmorAnnotationKeyPrefix) {
-			return true
-		}
-	}
-	return false
-}
-
-// appArmorFieldsInUse returns true if the pod has apparmor fields set
-func appArmorFieldsInUse(podSpec *api.PodSpec) bool {
-	if podSpec == nil {
-		return false
-	}
-	if podSpec.SecurityContext != nil && podSpec.SecurityContext.AppArmorProfile != nil {
-		return true
-	}
-	hasAppArmorContainer := false
-	VisitContainers(podSpec, AllContainers, func(c *api.Container, _ ContainerType) bool {
-		if c.SecurityContext != nil && c.SecurityContext.AppArmorProfile != nil {
-			hasAppArmorContainer = true
-			return false
-		}
-		return true
-	})
-	return hasAppArmorContainer
-}
-
 // restartableInitContainersInUse returns true if the pod spec is non-nil and
 // it has any init container with ContainerRestartPolicyAlways.
 func restartableInitContainersInUse(podSpec *api.PodSpec) bool {
diff --git a/pkg/api/pod/util_test.go b/pkg/api/pod/util_test.go
index 6015214623c..304063aa95b 100644
--- a/pkg/api/pod/util_test.go
+++ b/pkg/api/pod/util_test.go
@@ -25,10 +25,8 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"k8s.io/component-base/featuregate"
 
-	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/sets"
@@ -849,103 +847,6 @@ func TestDropProcMount(t *testing.T) {
 	}
 }
 
-func TestDropAppArmor(t *testing.T) {
-	tests := []struct {
-		description    string
-		hasAnnotations bool
-		hasFields      bool
-		pod            api.Pod
-	}{{
-		description:    "with AppArmor Annotations",
-		hasAnnotations: true,
-		pod: api.Pod{
-			ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1", v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "foo": "default"}},
-			Spec:       api.PodSpec{},
-		},
-	}, {
-		description:    "with AppArmor Annotations & fields",
-		hasAnnotations: true,
-		hasFields:      true,
-		pod: api.Pod{
-			ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1", v1.DeprecatedAppArmorBetaContainerAnnotationKeyPrefix + "foo": "default"}},
-			Spec: api.PodSpec{
-				SecurityContext: &api.PodSecurityContext{
-					AppArmorProfile: &api.AppArmorProfile{
-						Type: api.AppArmorProfileTypeRuntimeDefault,
-					},
-				},
-			},
-		},
-	}, {
-		description: "with pod AppArmor profile",
-		hasFields:   true,
-		pod: api.Pod{
-			ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1"}},
-			Spec: api.PodSpec{
-				SecurityContext: &api.PodSecurityContext{
-					AppArmorProfile: &api.AppArmorProfile{
-						Type: api.AppArmorProfileTypeRuntimeDefault,
-					},
-				},
-			},
-		},
-	}, {
-		description: "with container AppArmor profile",
-		hasFields:   true,
-		pod: api.Pod{
-			ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1"}},
-			Spec: api.PodSpec{
-				Containers: []api.Container{{
-					SecurityContext: &api.SecurityContext{
-						AppArmorProfile: &api.AppArmorProfile{
-							Type: api.AppArmorProfileTypeRuntimeDefault,
-						},
-					},
-				}},
-			},
-		},
-	}, {
-		description: "without AppArmor",
-		pod: api.Pod{
-			ObjectMeta: metav1.ObjectMeta{Annotations: map[string]string{"a": "1"}},
-			Spec:       api.PodSpec{},
-		},
-	}}
-
-	for _, test := range tests {
-
-		t.Run(fmt.Sprintf("%v", test.description), func(t *testing.T) {
-			newPod := test.pod.DeepCopy()
-
-			if hasAnnotations := appArmorAnnotationsInUse(newPod.Annotations); hasAnnotations != test.hasAnnotations {
-				t.Errorf("appArmorAnnotationsInUse does not match expectation: %t != %t", hasAnnotations, test.hasAnnotations)
-			}
-			if hasFields := appArmorFieldsInUse(&newPod.Spec); hasFields != test.hasFields {
-				t.Errorf("appArmorFieldsInUse does not match expectation: %t != %t", hasFields, test.hasFields)
-			}
-
-			DropDisabledPodFields(newPod, newPod)
-			require.Equal(t, &test.pod, newPod, "unchanged pod should never be mutated")
-
-			DropDisabledPodFields(newPod, nil)
-			assert.Equal(t, &test.pod, newPod, "pod should not be mutated when both feature gates are enabled")
-
-			expectAnnotations := test.hasAnnotations
-			assert.Equal(t, expectAnnotations, appArmorAnnotationsInUse(newPod.Annotations), "AppArmor annotations expectation")
-			if expectAnnotations == test.hasAnnotations {
-				assert.Equal(t, test.pod.Annotations, newPod.Annotations, "annotations should not be mutated")
-			}
-
-			expectFields := test.hasFields
-			assert.Equal(t, expectFields, appArmorFieldsInUse(&newPod.Spec), "AppArmor fields expectation")
-			if expectFields == test.hasFields {
-				assert.Equal(t, &test.pod.Spec, &newPod.Spec, "PodSpec should not be mutated")
-			}
-		})
-
-	}
-}
-
 func TestDropDynamicResourceAllocation(t *testing.T) {
 	resourceClaimName := "external-claim"