kyverno/test/best_practices/disallow_bind_mounts.yaml

---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  annotations:
    policies.kyverno.io/category: Workload Isolation
    policies.kyverno.io/description: The volume of type `hostPath` allows pods to
      use host bind mounts (i.e. directories and volumes mounted to a host path) in
      containers. Using host resources can be used to access shared data or escalate
      privileges. Also, this couples pods to a specific host and data persisted in
      the `hostPath` volume is coupled to the life of the node leading to potential
      pod scheduling failures. It is highly recommended that applications are designed
      to be decoupled from the underlying infrastructure (in this case, nodes).
  name: disallow-bind-mounts
spec:
  admission: true
  background: true
  rules:
  - match:
      any:
      - resources:
          kinds:
          - Pod
    name: validate-hostPath
    validate:
      message: Host path volumes are not allowed
      pattern:
        spec:
          =(volumes):
          - X(hostPath): "null"
  validationFailureAction: Audit