cks-final/submissions/CKS-012-clean-win.md

CKS-012 — Block cloud metadata

Domain: 1.4 Protect node metadata and endpoints
Time: 3 minutes · Reward: 100 XP clean win

Task

In namespace build, isolate egress for Pods labeled role=runner. Allow them to reach any IPv4 destination over TCP 443, except the metadata endpoint 169.254.169.254/32. Permit no other egress.

Section B — scored answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: metadata-protector
  namespace: build
spec:
  podSelector:
    matchLabels:
      role: runner
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 169.254.169.254/32
    ports:
    - protocol: TCP
      port: 443

Say Grade CKS-012 when saved.