ai(hermes-chat): permit Atlas OIDC egress

services/hermes-chat/networkpolicy.yaml

@@ -45,6 +45,18 @@ spec:
       ports:
         - protocol: TCP
           port: 8080
+    # Atlas OIDC uses the public sso.bstein.dev issuer, which resolves to the
+    # in-cluster Traefik load balancer for pods on the Atlas network.
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+          podSelector:
+            matchLabels:
+              app: traefik
+      ports:
+        - protocol: TCP
+          port: 443
     - to:
         - ipBlock:
             cidr: 10.43.0.1/32