Skip to content
CKSCluster SetupSingle nodeMedium

Block the cloud metadata endpoint with an egress policy

Scenario cks-set-002 · about 6 minutes · 7 points · 6 grader checks

Protect node metadata by blocking pod egress to 169.254.169.254 while keeping in-cluster traffic and other egress open.

  • networkpolicy
  • egress
  • ipblock
  • metadata
  • cluster-setup

What you will practise

  • Use ipBlock with except to carve out a single address
  • Keep in-cluster egress working with a namespaceSelector rule
  • Restrict only egress with policyTypes

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-set-002

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Workloads in namespace "cloud-app" must not be able to reach the cloud instance metadata endpoint 169.254.169.254, which hands out node credentials on most cloud providers. Everything else must keep working. Create one NetworkPolicy "deny-metadata" in "cloud-app" that: - selects every pod in the namespace and only restricts egress (ingress stays unrestricted); - allows egress to all pods in all namespaces (cluster DNS, the "backend" Service); - allows egress to any other IP address except 169.254.169.254/32. The Deployment "app" must still get an HTTP answer from the Service "backend" in "cloud-app".

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Cluster Setup
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
6 minutes
Points
7
Grader checks
6
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 6 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Cluster Setup labs

CKSCluster SetupMedium

NetworkPolicy: default deny both directions with DNS

Lock a namespace down with a default-deny ingress and egress policy, keep cluster DNS working and open exactly one client-to-server path.

Single node · ~9 min · 10 points

  • networkpolicy
  • default-deny
  • egress
  • dns
  • cluster-setup

goldenkube start cks-set-001

CKSCluster SetupMedium

Kubelet CIS hardening on a worker

A worker's kubelet accepts anonymous, unauthorized requests and exposes the read-only port; harden its configuration in place.

Two nodes · ~8 min · 8 points

  • kubelet
  • cis-benchmark
  • authentication
  • authorization
  • node

goldenkube start cks-set-003

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.