fluent-bit sidecar Mount hostPath /var/log/pods

[g-bohncke]

Currently all the fluent-bit sidecars mount the host file system.

- name: podlogs
  hostPath:
    path: /var/log/pods
    type: Directory

example

This is a security risk since this allows access to logs of other pods on the host. Normaly the practice with a fluent-bit sidcar is to mount an empty volume which is used to ship the logs from.
This would also eliminate the issue mention in some of the config file # GitHub issue: fluent/fluent-bit#872 (comment) since you don't need to access /var/log/pods

apiVersion: v1
kind: Deployment
metadata:
  ...
spec:
  ...
  template: 
    metadata: 
      ...
    spec:
      volumes:
        - name: app-logs
          emptyDir: {}
      containers:
        - name: application
          volumeMounts:
            - name: app-logs
              mountPath: /var/log/app
          ...
        - name: fluent-bit
          volumeMounts:
            - name: app-logs
              mountPath: /var/log/app
          ...