Restrict Clusterrole for Mutating and Validating Admission Webhooks

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-clusterrole-mutating-validating-admission-webhooks
  annotations:
    policies.kyverno.io/title: Restrict Clusterrole for Mutating and Validating Admission Webhooks
    policies.kyverno.io/category: Other
    policies.kyverno.io/severity: medium
    kyverno.io/kyverno-version: 1.10.7
    kyverno.io/kubernetes-version: "1.27"
    policies.kyverno.io/subject: ClusterRole
    policies.kyverno.io/description: ClusterRoles that grant write permissions over admission webhook should be minimized to reduce powerful identities in the cluster. This policy checks to ensure write permissions are not provided to admission webhooks.
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: restrict-clusterrole
      match:
        any:
          - resources:
              kinds:
                - ClusterRole
      validate:
        message: Use of verbs `create`, `update`, and `patch` are forbidden for mutating and validating admission webhooks
        foreach:
          - list: request.object.rules[]
            deny:
              conditions:
                all:
                  - key: "{{ element.apiGroups || '' }}"
                    operator: AnyIn
                    value:
                      - admissionregistration.k8s.io
                  - key: "{{ element.resources || '' }}"
                    operator: AnyIn
                    value:
                      - mutatingwebhookconfigurations
                      - validatingwebhookconfigurations
                any:
                  - key: "{{ element.verbs }}"
                    operator: AnyIn
                    value:
                      - create
                      - update
                      - patch
                  - key: "{{ contains(element.verbs[], '*') }}"
                    operator: Equals
                    value: true