Deny access to IMDS using Network Policy
The Azure Instance Metadata Service (IMDS) provides information about currently running virtual machine instances. You can use it to manage and configure your virtual machines. This information includes the SKU, storage, network configurations, and upcoming maintenance events.
IMDS is a REST API that's available at a well-known, non-routable IP address (169.254.169.254). You can only access it from within the VM. Communication between the VM and IMDS never leaves the host.
Kubelet has its own Managed Identity (MSI) attached to AKS. Kubelet uses IMDS endpoint to access the MSI and get an access token. These credentials can be accessed by the kubelet via the instance metadata service (IMDS). IMDS can be accessed via an HTTP request on a link-local IP address: 169.254.169.254. By default, this metadata service is reachable to all pods on the nodes.
Source code: https://github.com/HoussemDellai/dock...
Follow me on Twitter for more content: / houssemdellai
