netpol.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: unblu-egress
spec:
  egress:
    - to:
        - ipBlock:
            # ipinfo.io hostname
            cidr: 34.117.186.192/32
        # Workaround: allow coredns service
        # Problem: hard-coding the service IP seems like a really bad idea
        #- ipBlock:
        #    cidr: 10.247.3.10/32
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: coredns
              #k8s-app: kube-dns
  podSelector:
    matchLabels:
      component: test
  policyTypes:
    - Egress

pod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: test
  labels:
    component: test
spec:
  containers:
  - name: test
    image: curlimages/curl
    resources:
      limits:
        memory: "128Mi"
        cpu: "500m"
    command:
      - sleep
    args:
      - "3600"

test.sh

# setup
kubectl create namespace netpol-test
kubens netpol-test
kubectl apply -f pod.yaml
kubectl apply -f netpol.yaml
# should work
kubectl exec -it test -- curl -v ipinfo.io
# should NOT work
kubectl exec -it test -- curl -v google.com
# cleanup
kubectl delete namespace netpol-test