update examples/best_practices/validate_host_path.yaml
-# apiVersion : kyverno.io/v1alpha1
-# kind: ClusterPolicy
-# metadata:
-# name: validate-host-dirs
-# spec:
-# rules:
-# - name: validate-host-path
-# match:
-# resources:
-# kinds:
-# - Pod
-# validate:
-# message: "Host path is not allowed"
-# pattern:
-# spec:
-# volumes:
-# - (name): "*"
-# hostPath:
-# path: ""
-
apiVersion : kyverno.io/v1alpha1
kind: ClusterPolicy
metadata:
@@ -34,6 +14,6 @@ spec:
pattern:
spec:
volumes:
- - (name): "*"
- +(hostPath):
- path: "!/var/lib/*"
+ - name: "*"
+ (hostPath):
+ path: "!/var/lib"
