kyverno/samples/best_practices/disallow_hostpid_hostipc.yaml

apiVersion: kyverno.io/v1alpha1
kind: ClusterPolicy
metadata:
  name: validate-hostpid-hostipc
  annotations:
    policies.kyverno.io/category: Security
    policies.kyverno.io/description: |
      Sharing the host's PID namespace allows visibility of process on the host, potentially exposing process information.
      Sharing the host's IPC namespace allows the container process to communicate with processes on the host.
      To avoid pod container from having visibility to host process space, validate that 'hostPID' and 'hostIPC' are set to 'false'.
spec:
  rules:
  - name: validate-hostpid-hostipc
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Disallow use of host's pid namespace and host's ipc namespace"
      pattern:
        spec:
          (hostPID): "!true"
          hostIPC: false