Previously this only validated the ephemeral containers, but it's safer to validate the entire PodSpec in case other parts of validation add logic that checks ephemeral containers.