Keep Pods Away From the Metadata Service

medium 20 XP ~8 minHands-on lab

The cluster runs on cloud VMs. Every VM has an instance metadata service at 169.254.169.254, which hands out the node's cloud credentials to anyone who asks. Pods in support can currently reach it.

Task

No Pod in support, now or in the future, can reach 169.254.169.254, on any port.
Everything else stays reachable from support: the internet, every Pod and Service in the cluster, the cluster DNS, and the rest of 169.254.0.0/16.
Incoming traffic to support is not affected.

Use one NetworkPolicy.

About this machine

Ubuntu 24.04 with a private practice cluster: a real Kubernetes API server, scheduler and controllers, and three nodes (controlplane, node01, node02). Containers are simulated, so images never download and kubectl logs/exec are not available. k is an alias for kubectl, with completion. The grader checks the cluster's final state, not the commands you typed.

cks networkpolicy metadata egress ipblock