36 lines
774 B
Markdown
36 lines
774 B
Markdown
# CKS-012 — Block cloud metadata
|
|
|
|
Domain: **1.4 Protect node metadata and endpoints**
|
|
Time: **3 minutes** · Reward: **100 XP clean win**
|
|
|
|
## Task
|
|
|
|
In namespace `build`, isolate egress for Pods labeled `role=runner`. Allow them to reach any IPv4 destination over TCP `443`, except the metadata endpoint `169.254.169.254/32`. Permit no other egress.
|
|
|
|
## Section B — scored answer
|
|
|
|
```yaml
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: metadata-protector
|
|
namespace: build
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
role: runner
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
except:
|
|
- 169.254.169.254/32
|
|
ports:
|
|
- protocol: TCP
|
|
port: 443
|
|
```
|
|
|
|
Say **Grade CKS-012** when saved.
|