Protect node metadata & verify binaries

Block the cloud metadata endpoint; checksum platform binaries.

On a cloud node, the instance metadata service at 169.254.169.254 answers over plain HTTP with no authentication — and on many setups it will hand out the node’s cloud IAM credentials to anything that can reach it. From inside a compromised pod that is a straight line to the node’s role and, from there, into the cloud account: read S3 buckets, assume other roles, spin up infrastructure. It is one of the most common and highest-impact cluster-to-cloud escalation paths, and closing it is a NetworkPolicy one-liner.

The fix is an egress policy that allows everything except the metadata IP. Because NetworkPolicy has no explicit deny, you express “not the metadata address” with an ipBlock that permits the world and carves out 169.254.169.254/32 as an exception. Apply it to workload namespaces; the workloads that legitimately need cloud credentials should get them through a proper mechanism (IRSA / workload identity), not by scraping the node.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: deny-cloud-metadata, namespace: payments }
spec:
  podSelector: {}
  policyTypes: [Egress]
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 169.254.169.254/32     # the metadata endpoint — blocked
    ports: []                    # (add your DNS + app egress rules alongside)

# from a pod, before the policy: the node’s cloud role leaks
$ kubectl exec -it web -- curl -s \
    http://169.254.169.254/latest/meta-data/iam/security-credentials/
node-instance-role          # <- an attacker now enumerates and assumes this
 
# after the policy: the request times out
$ kubectl exec -it web -- curl -m 3 http://169.254.169.254/ ; echo exit=$?
exit=28

Verify the platform binaries

A tampered kubelet, kubectl, or kubeadm is a full compromise wearing a trusted name, so before you install or trust a downloaded binary, check its SHA-256 against the checksum the release publishes over TLS. It is a two-line habit that catches a corrupted download, a mirror that was poisoned, or a man-in-the-middle swap on an unencrypted link.

# download the binary and its published checksum, then verify
$ curl -LO "https://dl.k8s.io/release/v1.30.2/bin/linux/amd64/kubectl"
$ curl -LO "https://dl.k8s.io/release/v1.30.2/bin/linux/amd64/kubectl.sha256"
$ echo "$(cat kubectl.sha256)  kubectl" | sha256sum --check
kubectl: OK        # any other output = do not run it