From b3240919399a2270e6cd5756f45d499c831cce6f Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Sun, 2 Aug 2026 03:18:34 -0300
Subject: [PATCH] ai(hermes-chat): permit Atlas OIDC egress

---
 services/hermes-chat/networkpolicy.yaml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/services/hermes-chat/networkpolicy.yaml b/services/hermes-chat/networkpolicy.yaml
index 7a5260b99..1c6451204 100644
--- a/services/hermes-chat/networkpolicy.yaml
+++ b/services/hermes-chat/networkpolicy.yaml
@@ -45,6 +45,18 @@ spec:
       ports:
         - protocol: TCP
           port: 8080
+    # Atlas OIDC uses the public sso.bstein.dev issuer, which resolves to the
+    # in-cluster Traefik load balancer for pods on the Atlas network.
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+          podSelector:
+            matchLabels:
+              app: traefik
+      ports:
+        - protocol: TCP
+          port: 443
     - to:
         - ipBlock:
             cidr: 10.43.0.1/32