<p>Is it possible to allow egress traffic only to the specific service?
This is my naive try to do that:</p>
<pre><code>kind: NetworkPolicy
metadata:
  name: default-deny-all-egress
  namespace: default
spec:
  podSelector: {}
  egress:
  - ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
    to:
      - podSelector:
          matchLabels:
            k8s-app: kube-dns
    
  policyTypes:
    - Egress
</code></pre>

<p>No, as far as I know you can do that only using <code>podSelector</code>.
However, if you have an access to cluster, I think you can still manually add additional labels for needed pods and use <code>podSelector</code></p>
<p><a href="https://docs.projectcalico.org/security/kubernetes-network-policy#create-egress-policies" rel="nofollow noreferrer">Create egress policies</a> provides you good template of <code>NetworkPolicy</code> structure. The following policy allows pod outbound traffic to other pods in the same namespace that match the pod selector.</p>
<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-egress-same-namespace
  namespace: default
spec:
  podSelector:
    matchLabels:
      color: blue
  egress:
  - to:
    - podSelector:
        matchLabels:
          color: red
    ports:
    - port: 80
</code></pre>
<p>I know that you can use <a href="https://docs.projectcalico.org/security/kubernetes-network-policy#allow-ingress-traffic-from-pods-in-a-different-namespace" rel="nofollow noreferrer">namespaceSelector</a> for ingress like below. Not sure you can use it with egress- havent tried. But to access to pods from other namespace you  should somehow  point it in the configuration</p>
<pre><code>  namespaceSelector:
    matchLabels:
      shape: square
</code></pre>
