}
	if spec.SecurityContext.HostPID {
		allErrs = append(allErrs, field.Forbidden(fldPath.Child("HostPID"), "when `pod.Spec.HostUsers` is false"))
	}
	if spec.SecurityContext.HostIPC {
		allErrs = append(allErrs, field.Forbidden(fldPath.Child("HostIPC"), "when `pod.Spec.HostUsers` is false"))
	}

	return allErrs
}

	// Use the host's ipc namespace.
	// Optional: Default to false.
	// +k8s:conversion-gen=false
	// +optional
	HostIPC bool `json:"hostIPC,omitempty" protobuf:"varint,13,opt,name=hostIPC"`
	// Share a single process namespace between all of the containers in a pod.
	// When this is set containers will be able to view and signal processes from other containers

  // +optional
  optional bool hostPID = 12;

  // Use the host's ipc namespace.
  // Optional: Default to false.
  // +k8s:conversion-gen=false
  // +optional
  optional bool hostIPC = 13;

  // Share a single process namespace between all of the containers in a pod.
  // When this is set containers will be able to view and signal processes from other containers

	// If the OS field is set to linux, the following fields must be unset:
	// - securityContext.windowsOptions
	//
	// If the OS field is set to windows, following fields must be unset:
	// - spec.hostPID
	// - spec.hostIPC
	// - spec.hostUsers
	// - spec.securityContext.appArmorProfile
	// - spec.securityContext.seLinuxOptions
	// - spec.securityContext.seccompProfile
	// - spec.securityContext.fsGroup

	"hostPID":                       "Use the host's pid namespace. Optional: Default to false.",
	"hostIPC":                       "Use the host's ipc namespace. Optional: Default to false.",

  // +optional
  optional bool hostPID = 12;

  // Use the host's ipc namespace.
  // Optional: Default to false.
  // +k8s:conversion-gen=false
  // +optional
  optional bool hostIPC = 13;

  // Share a single process namespace between all of the containers in a pod.
  // When this is set containers will be able to view and signal processes from other containers

	// INFO: in.HostNetwork opted out of conversion generation
	// INFO: in.HostPID opted out of conversion generation
	// INFO: in.HostIPC opted out of conversion generation
	// INFO: in.ShareProcessNamespace opted out of conversion generation
	// INFO: in.HostUsers opted out of conversion generation

              "ip"
            ],
            "x-kubernetes-list-type": "map",
            "x-kubernetes-patch-merge-key": "ip",
            "x-kubernetes-patch-strategy": "merge"
          },
          "hostIPC": {
            "description": "Use the host's ipc namespace. Optional: Default to false.",
            "type": "boolean"
          },
          "hostNetwork": {

* DenyEscalatingExec admission controller now checks psp HostNetwork as well as hostIPC and hostPID. hostNetwork is also checked to deny exec /attach. ([#56839](https://github.com/kubernetes/kubernetes/pull/56839), [@hzxuzhonghu](https://github.com/hzxuzhonghu))