{
  "id": "cks-network-policy-metadata",
  "title": "Block Cloud Metadata",
  "category": "Network Security",
  "difficulty": "Hard",
  "type": "task",
  "weight": 6,
  "description": "## Restricting Cloud Metadata Access\n\nCloud providers expose sensitive instance metadata at `169.254.169.254`. An attacker exploiting an SSRF vulnerability can use this to steal cloud credentials.\n\n**Your task:**\n\nCreate a NetworkPolicy named `deny-metadata` in the `default` namespace that applies to all pods. It should explicitly **deny** all Egress traffic to the IP block `169.254.169.254/32`, while **allowing** all other Egress traffic.\n\n```bash\n# Tip: Use an ipBlock exception (except).\n```",
  "hints": [
    {
      "title": "Except IPBlock",
      "body": "Create an Egress rule that allows all traffic (`0.0.0.0/0`) EXCEPT `169.254.169.254/32`.",
      "command": "cat <<EOF | kubectl apply -f -\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n  name: deny-metadata\n  namespace: default\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - ipBlock:\n        cidr: 0.0.0.0/0\n        except:\n        - 169.254.169.254/32\nEOF"
    }
  ],
  "setup_commands": [],
  "validation": {
    "commands": [
      {
        "description": "NetworkPolicy deny-metadata exists",
        "command": "kubectl get networkpolicy deny-metadata -o jsonpath='{.metadata.name}'",
        "expected_output": "deny-metadata",
        "match": "exact"
      },
      {
        "description": "Policy applies to all pods",
        "command": "kubectl get networkpolicy deny-metadata -o jsonpath='{.spec.podSelector.matchLabels}'",
        "expected_output": "",
        "match": "exact"
      },
      {
        "description": "Policy blocks metadata server",
        "command": "kubectl get networkpolicy deny-metadata -o jsonpath='{.spec.egress[0].to[0].ipBlock.except[0]}' 2>/dev/null",
        "expected_output": "169.254.169.254/32",
        "match": "exact"
      }
    ]
  },
  "default_namespace": "default",
  "teardown_commands": [
    {
      "command": "kubectl delete networkpolicy deny-metadata --ignore-not-found"
    }
  ]
}