Constant ALLOWED_USER_MOUNT_PREFIXES 

pub const ALLOWED_USER_MOUNT_PREFIXES: &[&str];

Mount-path prefixes allowed for user-supplied volumeMounts.

Anything outside these prefixes is rejected at reconcile time. Operator- managed mounts (/etc/bind/..., /var/cache/bind) are added by the resource builder and bypass this check.