AppArmor set via deprecated pod annotation instead of securityContext.appArmorProfile in generated agent manifests

Start with hugo/static/resources/yaml/datadog-agent-all-features.yaml and review the Kubernetes Agent installation page's Manifest template links. Find the other templates containing the system-probe container, then compare their AppArmor settings. Done means affected manifests use securityContext.appArmorProfile instead of the deprecated annotation; verify with kubectl apply on Kubernetes 1.30 or newer.

Describe what happened

The sample manifest published at:

https://github.com/DataDog/documentation/blob/a979cf533a427c4a6146bd4b6a3da9d28077ac3a/hugo/static/resources/yaml/datadog-agent-all-features.yaml

sets the AppArmor profile for the system-probe container using the legacy pod annotation:

# Source: datadog/templates/daemonset.yaml
template:
  metadata:
    annotations:
      container.apparmor.security.beta.kubernetes.io/system-probe: unconfined

Applying this manifest to a cluster running Kubernetes 1.30+ produces the following deprecation warning on every kubectl apply:

Warning: spec.template.metadata.annotations[container.apparmor.security.beta.kubernetes.io/system-probe]: deprecated since v1.30; use the "appArmorProfile" field instead

Kubernetes deprecated the container.apparmor.security.beta.kubernetes.io/* annotation in favor of the securityContext.appArmorProfile field starting in v1.30 (GA/stable since v1.30). The annotation mechanism is expected to eventually be removed entirely.

This file is one of several "Manifest template" links on the Kubernetes Agent installation page (the grid with METRICS / LOGS / APM / PROCESS / NPM / SECURITY columns). Any manifest in that grid that includes the system-probe container (NPM and/or Security columns checked) likely has the same annotation, since they all appear to be generated from the same datadog/templates/daemonset.yaml source.

Describe what you expected

The system-probe container should set its AppArmor profile via the modern field, e.g.:

containers:
  - name: system-probe
    securityContext:
      appArmorProfile:
        type: Unconfined
      capabilities:
        # ...

with the deprecated annotation removed, and this fix propagated to all affected manifest templates in the Kubernetes Agent installation grid — not just datadog-agent-all-features.yaml.

Steps to reproduce the issue

1. Download the manifest:

   curl -O https://docs.datadoghq.com/resources/yaml/datadog-agent-all-features.yaml
   

2. Apply it to a cluster running Kubernetes >= 1.30:

   kubectl apply -f datadog-agent-all-features.yaml
   

3. Observe the deprecation warning on the datadog DaemonSet.

Additional environment details (Operating System, Cloud provider, etc)

• Kubernetes version: 1.35.0 (AWS EKS)
• File: hugo/static/resources/yaml/datadog-agent-all-features.yaml @ a979cf533a427c4a6146bd4b6a3da9d28077ac3a