Disallow Localhost ExternalName Services in CEL expressions

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: no-localhost-service
 5  annotations:
 6    policies.kyverno.io/title: Disallow Localhost ExternalName Services in CEL expressions
 7    policies.kyverno.io/category: Sample in CEL 
 8    policies.kyverno.io/severity: medium
 9    policies.kyverno.io/subject: Service
10    policies.kyverno.io/minversion: 1.11.0
11    kyverno.io/kubernetes-version: "1.26-1.27"
12    policies.kyverno.io/description: >-
13      A Service of type ExternalName which points back to localhost can potentially be used to exploit
14      vulnerabilities in some Ingress controllers. This policy audits Services of type ExternalName
15      if the externalName field refers to localhost.
16spec:
17  validationFailureAction: Audit
18  background: true
19  rules:
20  - name: no-localhost-service
21    match:
22      any:
23      - resources:
24          kinds:
25          - Service
26          operations:
27          - CREATE
28          - UPDATE
29    validate:
30      cel:
31        expressions:
32          - expression: "object.spec.type != 'ExternalName' || object.spec.externalName != 'localhost'"
33            message: "Service of type ExternalName cannot point to localhost."
34