T1 schedule a pod that reaches metadata Workload identity is meant to give a pod its own scoped cloud credential and conceal the node's.
Concealment is a network control, not an RBAC one, so a pod that can still route to the metadata endpoint bypasses it without any special pod spec.
Node cloud identity reached past workload identity concealment
T1
Node cloud identity reached past workload identity concealment The metadata service answers any caller that can reach it, and returns credentials for the node identity rather than for any workload identity Whether an ordinary pod can reach it is a platform and provisioning property, not a Kubernetes one, so the required pod shape differs per cluster Where the address is redirected per pod network namespace, as GKE does with GKE_METADATA, a hostNetwork pod runs in the host namespace and reaches the real service Where nothing intercepts it, which is the AKS default and the eksctl default on EKS, a plain unprivileged pod reaches it with no host access at all On EKS the barrier is the IMDSv2 hop limit of 1, and it holds only while tokens are required. An IMDSv1 GET is not hop limited and returns the credentials anyway Workload identity does not prevent this. It changes which credential the SDK resolves, not which address the pod can reach, and a hostNetwork pod always reaches it Mounting the host root as root is an independent second route, reading the kubelet credentials and the cloud provider config from disk The node identity ceiling varies from no cloud permissions at all to full control of the node resource group, so read its role bindings before rating impact ↗ Kubernetes documentation cloud.google.com/kubernetes-engine/docs/how-to/protecting-cluster-metadata Break the chain. Block pod egress to the metadata endpoint with a NetworkPolicy, and require the metadata service version that refuses requests without a signed header.
query the instance metadata service A plain HTTP request to the link-local metadata address returns a token for the node's own cloud identity.
The node identity exists to pull images and attach volumes, and it is routinely granted more than that.
Precondition. The metadata service is reachable from the pod network. This is exactly the condition workload identity is supposed to remove.
Break the chain. Deny egress to the link-local metadata range from all pod networks, and keep node identities to the minimum the kubelet needs.
use the node identity against cloud APIs What this reaches depends entirely on the node identity's cloud permissions.
In practice it commonly includes the container registry, which allows a poisoned image to be pushed back into the cluster, and often a secret store.
Break the chain. Audit the node identity's cloud permissions as though every pod holds them, because every pod that can reach metadata does.
Sources: kubernetes.io, kubernetes.io