Fails Open or Uses an Off-Cluster Endpoint

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: mutatingwebhookconfiguration-hardening
  annotations:
    kubeapt.io/uuid: "065baa8b-6120-4ac7-9433-7ed2fe5ffda5"
    security.kubeapt.io/displayName: "Fails Open or Uses an Off-Cluster Endpoint"
    security.kubeapt.io/description: "A webhook that fails open is bypassed by anyone who can make it unreachable, and an external URL endpoint sends every intercepted object off-cluster and lets whoever runs it rewrite workloads at admission time."
    security.kubeapt.io/resource: "MutatingWebhookConfigurations"
    security.kubeapt.io/severity: "Moderate"
    security.kubeapt.io/remediation: "Set failurePolicy to Fail on every webhook and point clientConfig at an in-cluster service rather than a url. Fields: webhooks[*].failurePolicy, webhooks[*].clientConfig.url."
    security.kubeapt.io/product: "Kubernetes"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:
      - admissionregistration.k8s.io
      apiVersions:
      - v1
      operations:
      - CREATE
      - UPDATE
      resources:
      - mutatingwebhookconfigurations
  validations:
  - expression: |
      !has(object.webhooks) || object.webhooks.all(w,
        w.?failurePolicy.orValue('Fail') != 'Ignore'
      )
    message: |
      MutatingWebhookConfigurations must not set failurePolicy to Ignore.
  - expression: |
      !has(object.webhooks) || object.webhooks.all(w,
        !has(w.clientConfig.url)
      )
    message: |
      MutatingWebhookConfigurations must not use an external clientConfig.url; back the webhook with an in-cluster service.