networkpolicy-allow-traffic-to-cloud-metadata-service
Allow egress traffic to the cloud metadata service at 169.254.169.254 on ports 80 and 443.
A reference manifest to copy and adapt, not a rule cenroq enforces for you. It carries no severity, belongs to no bundle, and nothing on your cluster changes until you apply it yourself.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-traffic-to-cloud-metadata-service
annotations:
cenroq.io/displayName: "Allow Egress to Cloud Metadata Service"
cenroq.io/description: "Allow egress traffic to the cloud metadata service at 169.254.169.254 on ports 80 and 443."
spec:
podSelector: {}
policyTypes:
- Egress
egress:
- to:
- ipBlock:
cidr: 169.254.169.254/32
ports:
- protocol: TCP
port: 80
- protocol: TCP
port: 443Save it as networkpolicy-allow-traffic-to-cloud-metadata-service.yaml — the commands below assume that name.
This is a manifest, not an admission policy, so there is nothing for kubeapt validate to check it against. Adapt the selectors and namespace first, then:
$ kubectl apply -f ./networkpolicy-allow-traffic-to-cloud-metadata-service.yaml