kyverno/examples/best_practices/resources/resource_validate_host_path.yaml

apiVersion: v1
kind: Pod
metadata:
  name: image-with-hostpath
  labels:
    app.type: prod
    namespace: "my-namespace"
spec:
  containers:
  - name: image-with-hostpath
    image: docker.io/nautiker/curl
    volumeMounts:
    - name: var-lib-etcd
      mountPath: /var/lib
  volumes:
  - name: var-lib-etcd
    hostPath:
      path: /var/lib