postStart Hook Targets an Arbitrary Host

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: container-poststart-httpget-host
  annotations:
    kubeapt.io/uuid: "8aac94da-b019-408f-909d-edc75587c2f9"
    security.kubeapt.io/displayName: "postStart Hook Targets an Arbitrary Host"
    security.kubeapt.io/description: "A postStart HTTP hook aimed at another host makes the kubelet call an arbitrary URL from the node each time a container starts, reaching internal endpoints closed to pods and triggering side effects there."
    security.kubeapt.io/resource: "Containers"
    security.kubeapt.io/severity: "Low"
    security.kubeapt.io/remediation: "Remove the host field so the hook targets the pod IP, or set it to an empty string. Field: spec.containers[*].lifecycle.postStart.httpGet.host."
    security.kubeapt.io/product: "Kubernetes"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - ''
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - pods
  validations:
  - expression: |
      object.spec.containers.all(c,
        !has(c.lifecycle) ||
        !has(c.lifecycle.postStart) ||
        !has(c.lifecycle.postStart.httpGet) ||
        !has(c.lifecycle.postStart.httpGet.host) ||
        c.lifecycle.postStart.httpGet.host == ""
      )
    message: |
      spec.containers[*].lifecycle.postStart.httpGet.host must be undefined or empty ("").