Ingress rules protect the receiver. Egress rules constrain the sender: a selected Pod may only call out to what the rules list. The shape is the mirror image, to instead of from.

Isolating a sender

spec:
  podSelector:
    matchLabels:
      app: client
  policyTypes: [Egress]
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: market-web

policyTypes: [Egress] makes this a policy about outgoing traffic only; the Pod's incoming side is untouched. With it applied, client may open connections to market-web Pods and nothing else.

The DNS surprise

kubectl exec client -- wget -qO- market-web

wget: bad address 'market-web'

The connection to market-web would be allowed, but the Pod never gets that far. Turning the name into an IP is itself an outgoing packet, UDP port 53 to CoreDNS in kube-system, and the rule above does not allow it. Every egress policy needs a DNS rule:

    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP

Reaching outside the cluster

    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except: ["10.0.0.0/8"]
      ports:
        - port: 443

ipBlock matches addresses, not Pods. 0.0.0.0/0 with the cluster's own ranges in except means "anywhere but here", the usual way to allow HTTPS to the internet.

Reading it

  Allowing egress traffic:
    To Port: <any> (traffic allowed to all ports)
    To:
      PodSelector: app=market-web
    ----------
    To Port: 53/UDP
    To:
      NamespaceSelector: kubernetes.io/metadata.name=kube-system
  Policy Types: Egress