In https://docs.openshift.com/container-platform/4.14/networking/ovn_kubernetes_network_provider/configuring-egress-firewall-ovn.html#egressnetworkpolicy-example_configuring-egress-firewall-ovn the example for EgressFirewall has an example for denying a single IP:

~~~
apiVersion: k8s.ovn.org/v1
kind: EgressFirewall
metadata:
  name: default
spec:
  egress:
  - type: Deny
    to:
      cidrSelector: 172.16.1.1
[..]
~~~

However, the "cidrSelector" should be specified as "172.16.1.1/32"

Documentation OCP 4.14 / 4.15 / 4.16

`cidrSelector: 172.16.1.1` should be written as `cidrSelector: 172.16.1.1/32`