Detects successful GKE pod exec sessions where the executed command references Google Cloud instance metadata endpoints (metadata.google.internal, computeMetadata/v1, or the link-local 169.254.169.254). The rule processes GCP audit logs (gcp.audit) for k8s.io pods.exec.start/get events and filters for commands that contain metadata endpoint indicators in gcp.audit.labels.command.gke.io/command. Access to the GKE metadata service from inside a pod is a high-risk activity because it may expose short-lived credentials or workload identity attributes to code running within containers. The detection enables security teams to triage and investigate potential credential access tied to containerized workloads and the node’s metadata surface. Correlation with related IAM token issuance, workload identity activity, and RBAC changes is recommended during investigation.