The README currently says,
Run it as a sidecar, on loopback. The provider endpoints have no authentication. Binding them to 0.0.0.0 grants DNS write access to every pod that can reach the port; the webhook warns at startup if you do.
This warning should be upgraded as a failure to run, and allowing it to run on 0.0.0.0 should only be allowed by explicitly setting a variable. By that measure, the webhook is never accidentally exposed by someone who doesn't read warnings.
The README currently says,
This warning should be upgraded as a failure to run, and allowing it to run on 0.0.0.0 should only be allowed by explicitly setting a variable. By that measure, the webhook is never accidentally exposed by someone who doesn't read warnings.