Exercise: block the cloud metadata endpoint

Host: controlplane · Time: 5 min · Domain: Cluster Setup

Task

• Every Pod in prod must be unable to reach 169.254.169.254.
• Everything else (DNS, internal services, the internet) must keep working.

Acceptance criteria

• curl -m 2 http://169.254.169.254/ from any prod Pod times out.
• curl -m 2 http://kubernetes.default.svc/ still answers.

Solution

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: block-imds, namespace: prod}
spec:
  podSelector: {}
  policyTypes: [Egress]
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except: ["169.254.169.254/32"]
  - to:
    - namespaceSelector: {}
    ports:
    - {protocol: UDP, port: 53}
    - {protocol: TCP, port: 53}

Trap: do not put podSelector and ipBlock in the same to element — that
is invalid. Separate list items, as above.