The recent decision to remove policy from AppArmorProfiles breaks existing deployed resources. Changes to the schema should be rolled out as a new API Version so that existing resources are unaffected.

Further, it is unclear how complex policies are to be implemented now that the policy field is not available. It does not appear that abstract can handle exclusion, there is no clear way to limit signals/ptrace, and while I suspect it supports wildcards there is no documentation so even that is not certain. Much of this is easy to solve, but removing policy while abstract is still clearly so early in development seems preemptive.