apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-hostpath-volumes
spec:
  validationFailureAction: Enforce

  rules:
    - name: no-hostpath
      match:
        any:
          - resources:
              kinds: ["Pod"]
      exclude:
        any:
          - resources:
              namespaceSelector:
                matchLabels:
                  policy.home.arpa/allow-hostpath: "true"

      validate:
        message: "hostPath volumes are not allowed (escape risk)."
        pattern:
          spec:
            volumes:
              - (hostPath): null