Glossary
hostPath volume
A Kubernetes volume that mounts a node path into a Pod; mounts of /, /etc, the kubelet directory or a runtime socket expose the whole node.
A hostPath volume mounts a path of the node's filesystem into a Pod. Mounting / exposes the whole node; /etc, /root and /var/lib/kubelet expose configuration, keys and kubelet credentials; /var/run/docker.sock or the containerd and CRI-O sockets let the pod start containers outside Kubernetes.
The Kubernetes RBAC good practices note that the right to create PersistentVolumes can amount to host filesystem access through hostPath. In the audit log, look for volumes[].hostPath.path in workload request bodies. See privileged pods and container escape.