Now we're using Kubernetes to implement the PaaS service and users can ssh into the containers. Because container runs inside the network of Kubernetes, users can access the services like kube-apiserver.
We want to restrict the outbound of the user's pods. It seems that Kubernetes Network Policy is only for inbound traffic now.
Is that possible to do that? Should we setup the rules of iptables in compute nodes?
Outbound traffic is now supported by Network Policies since v1.8, you should check again and see if your use case is fully supported.