CKS Security Quest · Metadata transfer
Block cloud metadata
Keep HTTPS egress, exclude one credential-bearing endpoint.
Task
In build, isolate egress for role=runner Pods. Allow TCP 443 to any IPv4 destination except 169.254.169.254/32. Permit nothing else.