Configure MCP Server Egress Containment with Obot on AKS

resource "aviatrix_spoke_gateway" "mcp_containment" {
  cloud_type   = var.cloud_type
  account_name = var.account_name
  gw_name      = "mcp-containment-spoke"
  vpc_id       = var.cluster_vpc_id
  vpc_reg      = var.region
  gw_size      = var.gateway_size
  subnet       = var.subnet_cidr
}

resource "kubernetes_config_map_v1" "ip_masq_config" {
  metadata {
    name      = "azure-ip-masq-agent-config"
    namespace = "kube-system"
    labels = {
      component                         = "ip-masq-agent"
      "kubernetes.io/cluster-service"   = "true"
      "addonmanager.kubernetes.io/mode" = "EnsureExists"
    }
  }
  data = {
    "ip-masq-agent" = <<-EOT
      nonMasqueradeCIDRs:
        - "0.0.0.0/0"
    EOT
  }
}

helm install --repo https://aviatrixsystems.github.io/k8s-firewall-charts --version <chart-version> k8s-firewall k8s-firewall

kubectl get crds | grep aviatrix

firewallpolicies.networking.aviatrix.com        <timestamp>
webgrouppolicies.networking.aviatrix.com        <timestamp>

data "azurerm_kubernetes_cluster" "this" {
  name                = var.cluster_name
  resource_group_name = var.resource_group
}

resource "aviatrix_kubernetes_cluster" "this" {
  cluster_id          = lower(data.azurerm_kubernetes_cluster.this.id)
  use_csp_credentials = true
}

resource "null_resource" "k8s_dcf_features" {
  triggers = { controller_ip = var.controller_ip }

  provisioner "local-exec" {
    command     = <<-EOT
      set -euo pipefail
      CID=$(curl -sk "https://$${CONTROLLER}/v2/api" \
        -d "action=login&username=$${USERNAME}&password=$${PASSWORD}" \
        | python3 -c "import sys,json; print(json.load(sys.stdin).get('CID',''))")
      if [ -z "$${CID}" ]; then echo "ERROR: controller login failed" >&2; exit 1; fi
      for feature in k8s k8s_dcf_policies dcf_multi_policies k8s_discovery log_enrichment; do
        curl -sk "https://$${CONTROLLER}/v2/api" \
          --data-urlencode "action=enable_controller_feature" \
          --data-urlencode "CID=$${CID}" \
          --data-urlencode "feature=$${feature}" > /dev/null
      done
      echo "DCF feature flags enabled"
    EOT
    interpreter = ["/bin/bash", "-c"]
    environment = {
      CONTROLLER = var.controller_ip
      USERNAME   = var.controller_username
      PASSWORD   = var.controller_password
    }
  }

  depends_on = [aviatrix_distributed_firewalling_config.enabled]
}

# Allow the controller's Cloud Asset Inventory to sync Kubernetes workload metadata
# before creating SmartGroups that use k8s selectors.
resource "time_sleep" "cai_sync" {
  create_duration = "30s"
  depends_on = [
    aviatrix_spoke_gateway.mcp_containment,
    aviatrix_kubernetes_cluster.this,
  ]
}

# SmartGroup: AKS node subnet
resource "aviatrix_smart_group" "aks_subnet" {
  name = "aks-subnet"
  selector {
    match_expressions { cidr = var.aks_node_subnet_cidr }
  }
  depends_on = [time_sleep.cai_sync]
}

# SmartGroup: Kubernetes API server public IP (/32)
resource "aviatrix_smart_group" "k8s_api_server" {
  name = "k8s-api-server"
  selector {
    match_expressions { cidr = "${var.aks_api_server_ip}/32" }
  }
  depends_on = [time_sleep.cai_sync]
}

# SmartGroup: Obot orchestration pods (K8s namespace selector)
resource "aviatrix_smart_group" "obot_system" {
  name = "obot-system"
  selector {
    match_expressions {
      type          = "k8s"
      k8s_namespace = var.obot_namespace
    }
  }
  depends_on = [time_sleep.cai_sync]
}

# WebGroup: AKS infrastructure domains
resource "aviatrix_web_group" "aks_infra_egress" {
  name = "aks-infra-egress"
  selector {
    match_expressions { snifilter = "*.hcp.${var.azure_region}.azmk8s.io" }
    match_expressions { snifilter = "*.azurecr.io" }
    match_expressions { snifilter = "*.blob.core.windows.net" }
    match_expressions { snifilter = "*.servicebus.windows.net" }
    match_expressions { snifilter = "mcr.microsoft.com" }
    match_expressions { snifilter = "*.data.mcr.microsoft.com" }
    match_expressions { snifilter = "management.azure.com" }
    match_expressions { snifilter = "login.microsoftonline.com" }
    match_expressions { snifilter = "packages.microsoft.com" }
    match_expressions { snifilter = "acs-mirror.azureedge.net" }
    match_expressions { snifilter = "*.aks.azure.com" }
    match_expressions { snifilter = "ghcr.io" }
    match_expressions { snifilter = "*.ghcr.io" }
    match_expressions { snifilter = "pkg-containers.githubusercontent.com" }
    match_expressions { snifilter = "charts.obot.ai" }
  }
}

# WebGroup: Obot orchestration pod domains
resource "aviatrix_web_group" "obot_pod_egress" {
  name = "obot-pod-egress"
  selector {
    match_expressions { snifilter = "charts.obot.ai" }
    match_expressions { snifilter = "api.anthropic.com" }
    match_expressions { snifilter = "github.com" }
    match_expressions { snifilter = "*.github.com" }
    match_expressions { snifilter = "raw.githubusercontent.com" }
    match_expressions { snifilter = "*.githubusercontent.com" }
  }
}

# V1 policy list: infra permits evaluated before the K8S_POLICY_LIST block
resource "aviatrix_distributed_firewalling_policy_list" "obot_mcp" {
  # P1: K8s API server CIDR permit
  # Pod→ClusterIP DNAT to API server IP has no SNI; WebGroup matching skips.
  # This CIDR rule must be priority 1 to preserve control-plane access.
  policies {
    name             = "k8s-api-server-cidr"
    action           = "PERMIT"
    priority         = 1
    protocol         = "TCP"
    logging          = true
    port_ranges { lo = 443 }
    src_smart_groups = [aviatrix_smart_group.aks_subnet.uuid]
    dst_smart_groups = [aviatrix_smart_group.k8s_api_server.uuid]
  }

  # P2: AKS infrastructure domain egress
  policies {
    name             = "aks-infra-egress"
    action           = "PERMIT"
    priority         = 2
    protocol         = "TCP"
    logging          = true
    port_ranges { lo = 443 }
    src_smart_groups = [aviatrix_smart_group.aks_subnet.uuid]
    dst_smart_groups = ["def000ad-0000-0000-0000-000000000001"] # Aviatrix anywhere group
    web_groups       = [aviatrix_web_group.aks_infra_egress.uuid]
  }

  # P3: Obot orchestration pod egress
  policies {
    name             = "obot-pod-egress"
    action           = "PERMIT"
    priority         = 3
    protocol         = "TCP"
    logging          = true
    port_ranges { lo = 443 }
    src_smart_groups = [aviatrix_smart_group.obot_system.uuid]
    dst_smart_groups = ["def000ad-0000-0000-0000-000000000001"] # Aviatrix anywhere group
    web_groups       = [aviatrix_web_group.obot_pod_egress.uuid]
  }

  depends_on = [aviatrix_distributed_firewalling_config.enabled]
}

# Default deny at POST_RULES level.
# POST_RULES evaluates after both V1 and K8S_POLICY_LIST. A V1 deny would
# evaluate before K8S_POLICY_LIST and block all MCPNetworkPolicy PERMIT rules.
resource "aviatrix_distributed_firewalling_default_action_rule" "deny_all" {
  action  = "DENY"
  logging = true

  depends_on = [aviatrix_distributed_firewalling_policy_list.obot_mcp]
}

resource "helm_release" "obot" {
  name             = "obot"
  repository       = "https://charts.obot.ai"
  chart            = "obot"
  version          = var.obot_version  # minimum 0.21.0
  namespace        = var.obot_namespace
  reuse_values     = true

  values = [
    yamlencode({
      config = {
        OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_REPO    = "https://charts.obot.ai"
        OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_NAME    = "aviatrix-network-policy-controller"
        OBOT_SERVER_MCPNETWORK_POLICY_PROVIDER_CHART_VERSION = var.npc_chart_version
        OBOT_SERVER_MCPDEFAULT_DENY_ALL_EGRESS               = "true"
      }
    })
  ]

  depends_on = [
    helm_release.aviatrix_crds,  # CRDs must exist before NPC starts
    kubernetes_config_map_v1.ip_masq_config,
    aviatrix_distributed_firewalling_policy_list.obot_mcp,
    aviatrix_distributed_firewalling_default_action_rule.deny_all,
    null_resource.k8s_dcf_features,
  ]
}

curl -X POST http://<obot-host>/api/mcp-servers \
  -H "Content-Type: application/json" \
  -d '{
    "manifest": {
      "name": "github",
      "runtime": "npx",
      "npxConfig": {
        "package": "@modelcontextprotocol/server-github",
        "egressDomains": ["api.github.com", "*.githubusercontent.com"]
      }
    }
  }'