A workload specifies a local AppArmor profile by name. What must be true on a node for that profile to be used successfully?

1. A ConfigMap with the profile's name must exist in any namespace
2. AppArmor must be available and the named profile loaded on that node
3. The Pod must use hostNetwork to enable AppArmor
4. The profile name must match the Service's cluster IP