Configure MCP Server Egress Containment with Obot on EKS

resource "aviatrix_spoke_gateway" "mcp_containment" {
  cloud_type   = var.cloud_type
  account_name = var.account_name
  gw_name      = "mcp-containment-spoke"
  vpc_id       = var.cluster_vpc_id
  vpc_reg      = var.region
  gw_size      = var.gateway_size
  subnet       = var.subnet_cidr
}

helm install --repo https://aviatrixsystems.github.io/k8s-firewall-charts --version <chart-version> k8s-firewall k8s-firewall

kubectl get crds | grep aviatrix

firewallpolicies.networking.aviatrix.com        <timestamp>
webgrouppolicies.networking.aviatrix.com        <timestamp>

resource "null_resource" "k8s_dcf_features" {
  triggers = { controller_ip = var.controller_ip }

  provisioner "local-exec" {
    command     = <<-EOT
      set -euo pipefail
      CID=$(curl -sk "https://$${CONTROLLER}/v2/api" \
        -d "action=login&username=$${USERNAME}&password=$${PASSWORD}" \
        | python3 -c "import sys,json; print(json.load(sys.stdin).get('CID',''))")
      if [ -z "$${CID}" ]; then echo "ERROR: controller login failed" >&2; exit 1; fi
      for feature in k8s k8s_dcf_policies dcf_multi_policies k8s_discovery log_enrichment; do
        curl -sk "https://$${CONTROLLER}/v2/api" \
          --data-urlencode "action=enable_controller_feature" \
          --data-urlencode "CID=$${CID}" \
          --data-urlencode "feature=$${feature}" > /dev/null
      done
      echo "DCF feature flags enabled"
    EOT
    interpreter = ["/bin/bash", "-c"]
    environment = {
      CONTROLLER = var.controller_ip
      USERNAME   = var.controller_username
      PASSWORD   = var.controller_password
    }
  }

  depends_on = [aviatrix_distributed_firewalling_config.enabled]
}

# Allow the controller's Cloud Asset Inventory to sync Kubernetes workload metadata
# before creating SmartGroups that use k8s selectors.
resource "time_sleep" "cai_sync" {
  create_duration = "30s"
  depends_on      = [aviatrix_spoke_gateway.mcp_containment]
}

# SmartGroup: EKS VPC CIDR (source for infrastructure rules)
resource "aviatrix_smart_group" "eks_vpc" {
  name = "eks-vpc"
  selector {
    match_expressions { cidr = var.vpc_cidr }
  }
  depends_on = [time_sleep.cai_sync]
}

# SmartGroup: Obot orchestration pods (K8s namespace selector)
resource "aviatrix_smart_group" "obot_system" {
  name = "obot-system"
  selector {
    match_expressions {
      type          = "k8s"
      k8s_namespace = var.obot_namespace
    }
  }
  depends_on = [time_sleep.cai_sync]
}

# WebGroup: EKS infrastructure domains
resource "aviatrix_web_group" "eks_infra_egress" {
  name = "eks-infra-egress"
  selector {
    match_expressions { snifilter = "*.eks.amazonaws.com" }
    match_expressions { snifilter = "*.ecr.aws" }
    match_expressions { snifilter = "*.dkr.ecr.*.amazonaws.com" }
    match_expressions { snifilter = "ecr.*.amazonaws.com" }
    match_expressions { snifilter = "api.ecr.*.amazonaws.com" }
    match_expressions { snifilter = "*.s3.*.amazonaws.com" }
    match_expressions { snifilter = "*.s3.amazonaws.com" }
    match_expressions { snifilter = "ec2.*.amazonaws.com" }
    match_expressions { snifilter = "ssm.*.amazonaws.com" }
    match_expressions { snifilter = "sts.amazonaws.com" }
    match_expressions { snifilter = "sts.*.amazonaws.com" }
    match_expressions { snifilter = "ghcr.io" }
    match_expressions { snifilter = "*.ghcr.io" }
    match_expressions { snifilter = "pkg-containers.githubusercontent.com" }
    match_expressions { snifilter = "charts.obot.ai" }
  }
}

# WebGroup: Obot orchestration pod domains
resource "aviatrix_web_group" "obot_pod_egress" {
  name = "obot-pod-egress"
  selector {
    match_expressions { snifilter = "charts.obot.ai" }
    match_expressions { snifilter = "api.anthropic.com" }
    match_expressions { snifilter = "github.com" }
    match_expressions { snifilter = "*.github.com" }
    match_expressions { snifilter = "raw.githubusercontent.com" }
    match_expressions { snifilter = "*.githubusercontent.com" }
  }
}

# V1 policy list: infra permits evaluated before the K8S_POLICY_LIST block
resource "aviatrix_distributed_firewalling_policy_list" "obot_mcp" {
  # P1: EKS infrastructure domain egress
  policies {
    name             = "eks-infra-egress"
    action           = "PERMIT"
    priority         = 1
    protocol         = "TCP"
    logging          = true
    port_ranges { lo = 443 }
    src_smart_groups = [aviatrix_smart_group.eks_vpc.uuid]
    dst_smart_groups = ["def000ad-0000-0000-0000-000000000001"] # Aviatrix anywhere group
    web_groups       = [aviatrix_web_group.eks_infra_egress.uuid]
  }

  # P2: Obot orchestration pod egress
  policies {
    name             = "obot-pod-egress"
    action           = "PERMIT"
    priority         = 2
    protocol         = "TCP"
    logging          = true
    port_ranges { lo = 443 }
    src_smart_groups = [aviatrix_smart_group.obot_system.uuid]
    dst_smart_groups = ["def000ad-0000-0000-0000-000000000001"] # Aviatrix anywhere group
    web_groups       = [aviatrix_web_group.obot_pod_egress.uuid]
  }

  depends_on = [aviatrix_distributed_firewalling_config.enabled]
}

# Default deny at POST_RULES level.
# POST_RULES evaluates after both V1 and K8S_POLICY_LIST. A V1 deny would
# evaluate before K8S_POLICY_LIST and block all MCPNetworkPolicy PERMIT rules.
resource "aviatrix_distributed_firewalling_default_action_rule" "deny_all" {
  action  = "DENY"
  logging = true

  depends_on = [aviatrix_distributed_firewalling_policy_list.obot_mcp]
}

resource "helm_release" "obot" {
  name             = "obot"
  repository       = "https://charts.obot.ai"
  chart            = "obot"
  version          = var.obot_version  # minimum 0.21.0
  namespace        = var.obot_namespace
  reuse_values     = true

  values = [
    yamlencode({
      config = {
        OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_REPO    = "https://charts.obot.ai"
        OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_NAME    = "aviatrix-network-policy-controller"
        OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_VERSION = var.npc_chart_version
        OBOT_SERVER_MCPDEFAULT_DENY_ALL_EGRESS               = "true"
      }
    })
  ]

  depends_on = [
    helm_release.aviatrix_crds,  # CRDs must exist before NPC starts
    aviatrix_distributed_firewalling_policy_list.obot_mcp,
    aviatrix_distributed_firewalling_default_action_rule.deny_all,
    null_resource.k8s_dcf_features,
  ]
}

curl -X POST http://<obot-host>/api/mcp-servers \
  -H "Content-Type: application/json" \
  -d '{
    "manifest": {
      "name": "github",
      "runtime": "npx",
      "npxConfig": {
        "package": "@modelcontextprotocol/server-github",
        "egressDomains": ["api.github.com", "*.githubusercontent.com"]
      }
    }
  }'