apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: tidb-serverless-deny-metadata-access
  namespace: tidb-serverless
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 169.254.169.254/32
        - namespaceSelector: {}