Fails Open or Uses an Off-Cluster Endpoint

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: validatingwebhookconfiguration-hardening
  annotations:
    kubeapt.io/uuid: "49e3a715-8dd1-4862-b25e-ce373af957cb"
    security.kubeapt.io/displayName: "Fails Open or Uses an Off-Cluster Endpoint"
    security.kubeapt.io/description: "A webhook that fails open is bypassed by anyone who can make it unreachable, and an external URL endpoint sends every reviewed object off-cluster and lets whoever runs it decide what admission accepts."
    security.kubeapt.io/resource: "ValidatingWebhookConfigurations"
    security.kubeapt.io/severity: "Moderate"
    security.kubeapt.io/remediation: "Set failurePolicy to Fail on every webhook and point clientConfig at an in-cluster service rather than a url. Fields: webhooks[*].failurePolicy, webhooks[*].clientConfig.url."
    security.kubeapt.io/product: "Kubernetes"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - admissionregistration.k8s.io
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - validatingwebhookconfigurations
  validations:
  - expression: |
      !has(object.webhooks) || object.webhooks.all(w,
        w.?failurePolicy.orValue('Fail') != 'Ignore'
      )
    message: |
      ValidatingWebhookConfigurations must not set failurePolicy to Ignore.
  - expression: |
      !has(object.webhooks) || object.webhooks.all(w,
        !has(w.clientConfig.url)
      )
    message: |
      ValidatingWebhookConfigurations must not use an external clientConfig.url; back the webhook with an in-cluster service.