From 8c6ff125d5b0e0f6f783417512e936087d1c6c8c Mon Sep 17 00:00:00 2001
From: Lavish pal <lvishpal408@gmail.com>
Date: Tue, 30 Jul 2024 16:58:24 +0530
Subject: [PATCH] Enhanced: Simplify the CEL policy to disallow host ports

Signed-off-by: Lavish pal <lvishpal408@gmail.com>
---
 .../disallow-host-ports.yaml                  | 32 ++++++++-----------
 1 file changed, 13 insertions(+), 19 deletions(-)

diff --git a/pod-security-cel/baseline/disallow-host-ports/disallow-host-ports.yaml b/pod-security-cel/baseline/disallow-host-ports/disallow-host-ports.yaml
index b7603ecfb..4ec05497f 100644
--- a/pod-security-cel/baseline/disallow-host-ports/disallow-host-ports.yaml
+++ b/pod-security-cel/baseline/disallow-host-ports/disallow-host-ports.yaml
@@ -30,24 +30,18 @@ spec:
         cel:
           expressions:
             - expression: >- 
-                object.spec.containers.all(container, !has(container.ports) || 
-                container.ports.all(port, !has(port.hostPort) || port.hostPort == 0))
-              message: >-
-                Use of host ports is disallowed. The field spec.containers[*].ports[*].hostPort
-                must either be unset or set to `0`.
+                [
+                  object.spec.containers,
+                  object.spec.initContainers,
+                  object.spec.ephemeralContainers
+                ].all(containers, !has(containers) ||
+                  containers.all(container, !has(container.ports) ||
+                  container.ports.all(port, !has(port.hostPort) || port.hostPort == 0)
+               )
+              )
+          message: >-
+            Use of host ports is disallowed. The field spec.containers[*].ports[*].hostPort,
+            spec.initContainers[*].ports[*].hostPort, and spec.ephemeralContainers[*].ports[*].hostPort
+            must either be unset or set to `0`.
 
-            - expression: >- 
-                !has(object.spec.initContainers) || 
-                object.spec.initContainers.all(container, !has(container.ports) || 
-                container.ports.all(port, !has(port.hostPort) || port.hostPort == 0))
-              message: >-
-                Use of host ports is disallowed. The field spec.initContainers[*].ports[*].hostPort
-                must either be unset or set to `0`.
 
-            - expression: >- 
-                !has(object.spec.ephemeralContainers) ||
-                object.spec.ephemeralContainers.all(container, !has(container.ports) ||
-                container.ports.all(port, !has(port.hostPort) || port.hostPort == 0))
-              message: >-
-                Use of host ports is disallowed. The field spec.ephemeralContainers[*].ports[*].hostPort
-                must either be unset or set to `0`.