---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-external-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress: 
    # allow traffic inside cluster
    - to:
      - namespaceSelector: {}
    - to:
      - ipBlock:
          cidr: 172.31.0.0/16