Network Policy can be used to selectively allow metadata access to the pods

[sotoiwa]

Is your idea request related to a problem that you've solved? Please describe.

• Restrict access to the instance profile assigned to the worker node
• When your application needs access to IDMS, use IMDSv2 and increase the hop limit on EC2 instances to 2
• Alternative approaches

The above topics describes how to block access to instance metadata

In my experience, the Kinesis Client Library used by some Pods does not support IRSA. So I could not block metadata access because using only IMDSv2 and setting hop count to 1 or using iptables would target all the Pods on the node.

However I could use Kubernetes Network Policy to selectively allow metadata access to the pods.

How about adding a description of how to block metadata access using Network Policy?

Describe the best practice

You can use Kubernetes Network Policy to block metadata access and selectively allow to some pods.

At first, block access to the metadata service from all pods by adding following policy.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-metadata-access
  namespace: example
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 169.254.169.254/32

Then allow access from some pods by adding following policy.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-metadata-access
  namespace: example
spec:
  podSelector:
    matchLabels:
      app: myapp  
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 169.254.169.254/32

[jicowan]

Updated documentation. Thanks for the suggestion.

[wyike]

@jicowan @sotoiwa per my understanding, deny-metadata-access and allow-metadata-access networkpolicy take effect namespace-wide. If we want to implement in several namespaces, we need to create them in different namespaces, am i right. Is it worth to point out as well in documentation?

[sotoiwa]

It is true that the Kubernetes standard NetworkPolicy is namespace scoped. However, I think there are cases where CNI's own global scope policies are available, such as Calico's GlobalNetworkPolicy or Cilium's CiliumClusterwideNetworkPolicy.