# CKS-012 — Block cloud metadata

Domain: **1.4 Protect node metadata and endpoints**  
Time: **3 minutes** · Reward: **100 XP clean win**

## Task

In namespace `build`, isolate egress for Pods labeled `role=runner`. Allow them to reach any IPv4 destination over TCP `443`, except the metadata endpoint `169.254.169.254/32`. Permit no other egress.

## Section B — scored answer

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: metadata-protector
  namespace: build
spec:
  podSelector:
    matchLabels:
      role: runner
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 169.254.169.254/32
    ports:
    - protocol: TCP
      port: 443
```

Say **Grade CKS-012** when saved.