Q: How do you restrict a pod from accessing the cloud metadata endpoint (e.g., 169.254.169.254)?
Without restriction, any pod can query the EC2 metadata endpoint and potentially steal the node's IAM role credentials. Block it with Net...
#Kubernetes #Additional Kubernetes Scenarios (Q101-Q200) #L2 #Container Orchestration #K8s #EC2
🎙️ Candidate Opening & Architectural Context
""When troubleshooting Kubernetes, I always follow a structured layered model: Pod status -> Events -> Logs -> Network. When addressing this question, I walk the interviewer through our production incident runbook: isolating the blast radius, checking diagnostic logs and metrics, and applying a safe fix.""
Advertisement
🛠️ Production Runbook & Step-by-Step Resolution
1️⃣
Production Solution & Architecture
Without restriction, any pod can query the EC2 metadata endpoint and potentially steal the node's IAM role credentials. Block it with NetworkPolicy: On EKS: use IMDSv2 which requires a hop limit of 1 (pods can't reach it since they're an extra hop). Configure in the launch template.
spec:
podSelector: {} # all pods
policyTypes: [Egress]
egress:
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 169.254.169.254/32
💡 The Senior SRE Gold Nugget (Key Architectural Takeaway)
"Pro-Tip: Without restriction, any pod can query the EC2 metadata endpoint and potentially steal the node's IAM role credentials. Block it w."
⚡ 60-Second Elevator Pitch Talking Points
- Immediate Triage: Without restriction, any pod can query the EC2 metadata endpoint and potentially steal the node
- Run targeted verification commands before modifying configuration.
- Automate permanent guardrails (CI check, alerts, IaC policy) to prevent recurrence.
Advertisement