Restrict External IPs in CEL expressions

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: restrict-external-ips
 5  annotations:
 6    policies.kyverno.io/title: Restrict External IPs in CEL expressions
 7    policies.kyverno.io/category: Best Practices in CEL 
 8    policies.kyverno.io/minversion: 1.11.0
 9    kyverno.io/kubernetes-version: "1.26-1.27"
10    policies.kyverno.io/severity: medium
11    policies.kyverno.io/subject: Service
12    policies.kyverno.io/description: >-
13      Service externalIPs can be used for a MITM attack (CVE-2020-8554).
14      Restrict externalIPs or limit to a known set of addresses.
15      See: https://github.com/kyverno/kyverno/issues/1367. This policy validates
16      that the `externalIPs` field is not set on a Service.
17spec:
18  validationFailureAction: Audit
19  background: true
20  rules:
21  - name: check-ips
22    match:
23      any:
24      - resources:
25          kinds:
26          - Service
27          operations:
28          - CREATE
29          - UPDATE
30    validate:
31      cel:
32        expressions:
33          - expression: "!has(object.spec.externalIPs)"
34            # restrict external IP addresses
35            # you can alternatively restrict to a known set of addresses using:
36            #     !has(object.spec.externalIPs) || 
37            #     object.spec.externalIPs.all(ip, ip in ["37.10.11.53", "153.10.20.1"]) 
38            message: "externalIPs are not allowed."