---
- name: block access to the GCP metadata server
  command: iptables --wait -4 --insert OUTPUT -d 169.254.169.254 -m comment --comment "Prevent all users from reaching GCP API server" -j REJECT --reject-with icmp-host-prohibited

- name: enable root user access to the GCP metadata server
  command: iptables --wait -4 --insert OUTPUT -d 169.254.169.254 -j ACCEPT -m comment --comment "Enable root user to reach GCP API server" -m owner --uid-owner 0

- name: enable udp access to the GCP DNS
  command: iptables --wait -4 --insert OUTPUT -p udp -d 169.254.169.254 -j ACCEPT --destination-port 53 -m comment --comment "Enable udp access to the GCP DNS"

- name: enable tcp access to the GCP DNS
  command: iptables --wait -4 --insert OUTPUT -p tcp -d 169.254.169.254 -j ACCEPT --destination-port 53 -m comment --comment "Enable tcp access to the GCP DNS"

- name: block containers from access to the GCP metadata server
  command: iptables --wait -4 --insert FORWARD -d 169.254.169.254 -m comment --comment "Prevent containers from reaching GCP API server" -j REJECT --reject-with icmp-host-prohibited

- name: save iptables rules
  command: /usr/libexec/iptables/iptables.init save
