preStop Hook Targets an Arbitrary Host

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: container-prestop-httpget-host
  annotations:
    kubeapt.io/uuid: "a4a204b3-86fa-42d3-bf58-ed97453603a9"
    security.kubeapt.io/displayName: "preStop Hook Targets an Arbitrary Host"
    security.kubeapt.io/description: "A preStop HTTP hook aimed at another host makes the kubelet call an arbitrary URL from the node whenever a container shuts down, reaching internal endpoints closed to pods and triggering side effects there."
    security.kubeapt.io/resource: "Containers"
    security.kubeapt.io/severity: "Low"
    security.kubeapt.io/remediation: "Remove the host field so the hook targets the pod IP, or set it to an empty string. Field: spec.containers[*].lifecycle.preStop.httpGet.host."
    security.kubeapt.io/product: "Kubernetes"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - ''
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - pods
  validations:
  - expression: |
      object.spec.containers.all(c,
        !has(c.lifecycle) ||
        !has(c.lifecycle.preStop) ||
        !has(c.lifecycle.preStop.httpGet) ||
        !has(c.lifecycle.preStop.httpGet.host) ||
        c.lifecycle.preStop.httpGet.host == ""
      )
    message: |
      spec.containers[*].lifecycle.preStop.httpGet.host must be undefined or empty ("").