postStart Hook Targets an Arbitrary Host

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: initcontainer-poststart-httpget-host
  annotations:
    kubeapt.io/uuid: "fbef4cf3-cf91-4c11-af0b-ab80b64edff8"
    security.kubeapt.io/displayName: "postStart Hook Targets an Arbitrary Host"
    security.kubeapt.io/description: "A postStart HTTP hook aimed at another host makes the kubelet call an arbitrary URL from the node each time an init container starts, reaching internal endpoints closed to pods and triggering side effects there."
    security.kubeapt.io/resource: "InitContainers"
    security.kubeapt.io/severity: "Low"
    security.kubeapt.io/remediation: "Remove the host field so the hook targets the pod IP, or set it to an empty string. Field: spec.initContainers[*].lifecycle.postStart.httpGet.host."
    security.kubeapt.io/product: "Kubernetes"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - ''
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - pods
  validations:
  - expression: |
      !has(object.spec.initContainers) || object.spec.initContainers.all(ic,
        !has(ic.lifecycle) ||
        !has(ic.lifecycle.postStart) ||
        !has(ic.lifecycle.postStart.httpGet) ||
        !has(ic.lifecycle.postStart.httpGet.host) ||
        ic.lifecycle.postStart.httpGet.host == ""
      )
    message: |
      spec.initContainers[*].lifecycle.postStart.httpGet.host must be undefined or empty ("").