pseudo-global-netpol.yaml

{{- range .Values.netpol.namespaces }}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-egress-to-everything-but-specified-range
  namespace: {{ . }}
spec:
  # WARNING: targets all pods in the namespace
  # If pods were already targetted by a netpol rule, this netpol
  # will grant more permissions than wanted rather than restricting
  # them.
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              {{- range $.Values.netpol.except }}
              - {{ . }}
              {{- end }}
{{- end }}