Our team rolled out new egress firewall rules last night. Now the OpenAI Operator is throwing auth errors when trying to connect to our internal tools (Jira, internal APIs).

Before I spend all day digging through logs, has anyone already mapped what endpoints and IP ranges this thing actually needs?

Specifically:
* What outbound calls does the Operator make beyond the obvious OpenAI API?
* Does it connect directly to third-party service APIs, or does everything proxy through OpenAI?
* Are the calls from the cluster's IP, or from OpenAI's infrastructure?

Need concrete details, not guesses. If you've got a working setup with strict egress rules, post your allowed domains/IPs.

marcus