Keep Pods Away From the Metadata Service
The cluster runs on cloud VMs. Every VM has an instance metadata service at 169.254.169.254, which hands out the node's cloud credentials to anyone who asks. Pods in support can currently reach it.
support, now or in the future, can reach 169.254.169.254, on any port.support: the internet, every Pod and Service in the cluster, the cluster DNS, and the rest of 169.254.0.0/16.support is not affected.Use one NetworkPolicy.
About this machine
Ubuntu 24.04 with a private practice cluster: a real Kubernetes API server, scheduler and controllers, and three nodes (controlplane, node01, node02). Containers are simulated, so images never download and kubectl logs/exec are not available. k is an alias for kubectl, with completion. The grader checks the cluster's final state, not the commands you typed.
Your machine is ready to start
Create a free account to open a machine and get graded.