psp-hostpaths-policy

January 20, 2026 ยท View on GitHub

Important

Notice: Starting from Kubewarden release 1.32.0, all code from this repository has been merged into github.com/kubewarden/policies, which is now a monorepo containing policies. Please refer to that repository for future updates and development. This repository is now archived. Development continues in the new location.

Kubewarden Policy Repository Stable

psp-hostpaths-policy

Replacement for the Kubernetes Pod Security Policy that controls the usage of hostPath volumes. The policy inspects both the containers and the init containers that are using hostPath volumes.

Settings

allowedHostPaths:
- pathPrefix: "/foo"
  readOnly: true
- pathPrefix: "/bar"
  readOnly: false

allowedHostPaths is a list of host paths that are allowed to be used by hostPath volumes.

An empty allowedHostPaths list means there is no restriction on host paths used.

Each entry of allowedHostPaths must have:

  • A pathPrefix field, which allows hostPath volumes to mount a path that begins with an allowed prefix.
  • a readOnly field indicating it must be mounted read-only.

Special behaviour

It's possible to have host paths sharing part of the prefix. In that case, the readOnly attribute of the most specific path takes precedence.

For example, given the following configuration:

allowedHostPaths:
- pathPrefix: "/foo"
  readOnly: false
- pathPrefix: "/foo/bar"
  readOnly: true

Paths such as /foo/bar/dir1, /foo/bar must be read only.