add kyverno policies

Signed-off-by: gwg313 <gwg313@pm.me>

platform/kyverno/policies/30-disallow/disallow-hostpath-volumes.yaml

@@ -0,0 +1,20 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: disallow-hostpath-volumes
+spec:
+  validationFailureAction: Enforce
+
+  rules:
+    - name: no-hostpath
+      match:
+        any:
+          - resources:
+              kinds: ["Pod"]
+
+      validate:
+        message: "hostPath volumes are not allowed (escape risk)."
+        pattern:
+          spec:
+            volumes:
+              - (hostPath): null