CKS_FINALE

submissions/CKS-012-clean-win.md

@@ -0,0 +1,35 @@
+# CKS-012 — Block cloud metadata
+
+Domain: **1.4 Protect node metadata and endpoints**  
+Time: **3 minutes** · Reward: **100 XP clean win**
+
+## Task
+
+In namespace `build`, isolate egress for Pods labeled `role=runner`. Allow them to reach any IPv4 destination over TCP `443`, except the metadata endpoint `169.254.169.254/32`. Permit no other egress.
+
+## Section B — scored answer
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: metadata-protector
+  namespace: build
+spec:
+  podSelector:
+    matchLabels:
+      role: runner
+  policyTypes:
+  - Egress
+  egress:
+  - to:
+    - ipBlock:
+        cidr: 0.0.0.0/0
+        except:
+        - 169.254.169.254/32
+    ports:
+    - protocol: TCP
+      port: 443
+```
+
+Say **Grade CKS-012** when saved.