kyverno/samples/best_practices/disallow_host_filesystem.yaml

apiVersion: "kyverno.io/v1alpha1"
kind: "ClusterPolicy"
metadata: 
  name: "deny-use-of-host-fs"
  annotations:
    policies.kyverno.io/category: Data Protection
    policies.kyverno.io/description: The volume of type `hostPath` allows pods to use host bind 
      mounts (i.e. directories and volumes mounted to a host path) in containers. Using host 
      resources can be used to access shared data or escalate priviliges. Also, this couples pods 
      to a specific host and data persisted in the `hostPath` volume is coupled to the life of the 
      node leading to potential pod scheduling failures. It is highly recommeded that applications 
      are designed to be decoupled from the underlying infrstructure (in this case, nodes).

spec: 
  rules: 
  - name: "deny-use-of-host-fs"
    match: 
      resources: 
        kinds: 
        - "Pod"
    validate: 
      message: "Host path is not allowed"
      pattern: 
        spec: 
          volumes: 
          - X(hostPath): null