Comment 1 for bug 1816372

Here's an example of how to trigger this:

    sudo microk8s.kubectl apply -f \
        https://github.com/knative/serving/releases/download/v0.24.0/serving-core.yaml

= AppArmor =
Time: Mar 17 17:27:43
Log: apparmor="DENIED" operation="open" profile="snap.microk8s.kubectl" name="/etc/ssl/certs/java/" pid=682863 comm="kubectl" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
File: /etc/ssl/certs/java/ (read)
Suggestions:
* adjust program to read necessary files from $SNAP, $SNAP_DATA, $SNAP_COMMON, $SNAP_USER_DATA or $SNAP_USER_COMMON
* adjust snap to use snap layouts (https://forum.snapcraft.io/t/snap-layouts/7207)
* add 'system-files (see https://forum.snapcraft.io/t/the-system-files-interface for acceptance criteria)' to 'plugs'