apiVersion: "kyverno.io/v1alpha1"
kind: "ClusterPolicy"
metadata: 
  name: "deny-use-of-host-fs"
spec: 
  rules: 
  - name: "deny-use-of-host-fs"
    match: 
      resources: 
        kinds: 
        - "Pod"
    validate: 
      message: "Host path is not allowed"
      pattern: 
        spec: 
          volumes: 
          - X(hostPath): null