Comment by srcreigh

    name: project-build
    image: alpine:latest
    namespace: default
    egress_whitelist:
      - "1.1.1.1/32"      # Cloudflare DNS
      - "8.8.8.8/32"      # Google DNS

This is basically a wide-open network policy as far as data exfiltration goes, right?

Malicious code just has to resolve <secret>.evil.com and Google/CF will forward that query to evil resolver.