Simplify Disallow hostPorts in CEL expressions

pod-security-cel/baseline/disallow-host-ports/artifacthub-pkg.yml

@@ -19,5 +19,5 @@ annotations:
   kyverno/category: "Pod Security Standards (Baseline) in CEL"
   kyverno/kubernetesVersion: "1.26-1.27"
   kyverno/subject: "Pod"
-digest: b95cfe16e11be0b9507736687bd99b5ea78c455f8fc35194220326ea5ff3913c
+digest: 5380fdcd91c8bc331f46c6df2f4ae05e079a8e367ba071b3f3345858440a6fce
 createdAt: "2023-12-03T00:22:34Z"

pod-security-cel/baseline/disallow-host-ports/disallow-host-ports.yaml

@@ -30,24 +30,18 @@ spec:
         cel:
           expressions:
             - expression: >- 
-                object.spec.containers.all(container, !has(container.ports) || 
-                container.ports.all(port, !has(port.hostPort) || port.hostPort == 0))
-              message: >-
-                Use of host ports is disallowed. The field spec.containers[*].ports[*].hostPort
-                must either be unset or set to `0`.
+                [
+                  object.spec.containers,
+                  object.spec.initContainers,
+                  object.spec.ephemeralContainers
+                ].all(containers, !has(containers) ||
+                  containers.all(container, !has(container.ports) ||
+                  container.ports.all(port, !has(port.hostPort) || port.hostPort == 0)
+               )
+              )
+          message: >-
+            Use of host ports is disallowed. The field spec.containers[*].ports[*].hostPort,
+            spec.initContainers[*].ports[*].hostPort, and spec.ephemeralContainers[*].ports[*].hostPort
+            must either be unset or set to `0`.
 
-            - expression: >- 
-                !has(object.spec.initContainers) || 
-                object.spec.initContainers.all(container, !has(container.ports) || 
-                container.ports.all(port, !has(port.hostPort) || port.hostPort == 0))
-              message: >-
-                Use of host ports is disallowed. The field spec.initContainers[*].ports[*].hostPort
-                must either be unset or set to `0`.
 
-            - expression: >- 
-                !has(object.spec.ephemeralContainers) ||
-                object.spec.ephemeralContainers.all(container, !has(container.ports) ||
-                container.ports.all(port, !has(port.hostPort) || port.hostPort == 0))
-              message: >-
-                Use of host ports is disallowed. The field spec.ephemeralContainers[*].ports[*].hostPort
-                must either be unset or set to `0`.

pod-security-cel/baseline/restrict-sysctls/artifacthub-pkg.yml

@@ -19,5 +19,5 @@ annotations:
   kyverno/category: "Pod Security Standards (Baseline) in CEL"
   kyverno/kubernetesVersion: "1.26-1.27"
   kyverno/subject: "Pod"
-digest: 97f75f8cdd2e3ee9f9696cdceccc34cf0df5edbca0e3bbab76572494a26ce6e8
+digest: c9b480f97695316999bec53d4d9ee9b79d726eeb3038b941f64590bf98cb2486
 createdAt: "2023-12-03T00:22:33Z"