secure-enterprise-chat: LibreChat blueprint for Aviatrix-protected k8s - #65
Merged
Conversation
…ted k8s Pure-Helm blueprint that layers LibreChat onto an already-deployed, Aviatrix-protected cluster and enforces least-privilege egress via a generated FirewallPolicy CRD. - chart/: overlay for the official LibreChat OCI chart (official image, no custom build, no vendored source) + librechat.yaml + .env template - egress-policy/: vendored translator shim (librechat.yaml -> FirewallPolicy CRD) - argocd/: multi-source GitOps example - optional thin Terraform helm_release wrapper (validated) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- default-deny is a hard prereq (permits alone don't deny); add verification - troubleshooting: docker-credential-desktop, Bitnami mongodb relocation, default StorageClass / EBS CSI, deny-not-enforced check - validation status: deploy + CRD reconcile verified; deny enforcement requires base default-deny (absent on test cluster) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…efault-deny) Generator now appends a trailing per-pod deny rule (tcp/443 -> 0.0.0.0/0) after the permits, so the FirewallPolicy enforces least-privilege without depending on a fabric-wide default-deny. --no-default-deny opts out. Proven live: allowlisted FQDNs (registry.librechat.ai, bedrock-runtime) connect; unlisted (example.org, api.openai.com) are reset. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…s secret Chart doesn't set ALLOW_REGISTRATION/ALLOW_EMAIL_LOGIN (LibreChat treats unset as disabled -> no Sign Up button). They must go in the credentials secret, not Helm configEnv (which only templates fixed keys). Added to .env.example + troubleshooting. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…gnore) The root repo .gitignore (.env.*) was hiding the credentials template, so operators never received it. Re-include it via the blueprint .gitignore and commit it (now includes ALLOW_REGISTRATION/ALLOW_EMAIL_LOGIN). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
LibreChat resolves Bedrock creds from the AWS default provider chain when the BEDROCK_AWS_* keys are unset, so IRSA/Pod Identity work. Adds serviceAccount annotation support (values + irsa_role_arn TF var), .env.example guidance (region required, keys omitted under IRSA), and a README IRSA section with the trust policy. Egress already covers sts + bedrock-runtime. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… IRSA proof Claude 3.5+ needs a us./eu. inference-profile id for on-demand invoke (bare id fails with ValidationException). Note in librechat.yaml + troubleshooting. Record the live IRSA->Bedrock end-to-end proof in validation status. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…6 (Bedrock) Set BEDROCK_AWS_MODELS to the us. inference profiles for Haiku 4.5 and Sonnet 4.6 (controls the UI model dropdown); titleModel -> Haiku 4.5. Proven live via IRSA: both profile ids invoke through the permitted bedrock-runtime.us-east-1 path. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…or (tests in-repo) - examples/with-mcp/: worked example showing remote MCP (host added), subprocess MCP (npm registry + OBOT VCA warning), and internal MCP (skipped) in the allowlist. Verified live: mcp.deepwiki.com permitted, example.org denied. - egress-policy is now the source of record (not a vendored copy): bring the pytest suite in-repo (34 tests), add default-deny / --no-default-deny coverage, regenerate golden fixtures to include the trailing deny rule. - harden .gitignore for pycache/pytest_cache. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Generator: drop image-registry domains (image pulls are node-level, not governed by a pod-scoped policy) and gate sts.amazonaws.com on Bedrock being enabled (IRSA token exchange only). Catalog/tests/goldens updated; +sts-gating test (35 tests). chart/librechat.yaml: add the DeepWiki remote MCP server. Docs updated. Proven live: allowlist = sts + bedrock-runtime.us-east-1 + mcp.deepwiki.com only; MCP host + Bedrock(IRSA) reachable, registry.librechat.ai/example.org now denied. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
New
blueprints/secure-enterprise-chat/— deploys LibreChat onto analready-running, Aviatrix-protected Kubernetes cluster and enforces least-privilege
egress via a generated Aviatrix
FirewallPolicyCRD. It is a pure-Helm blueprint(official chart + images, no custom build, no vendored app source).
What it ships
chart/— values overlay for the official LibreChat OCI chart,librechat.yaml(the single source of truth for both the app and the egress allowlist), and
.env.example.egress-policy/— the egress-policy generator (source of record, with a 35-testpytestsuite): readslibrechat.yaml→ emits aFirewallPolicyCRD permitting onlythe backends/MCP servers actually configured, with a trailing per-pod default-deny
so it's self-enforcing (doesn't depend on a fabric-wide default-deny).
examples/with-mcp/— worked example showing remote / subprocess / internal MCPservers flowing into the allowlist.
argocd/— multi-source GitOps example. Optional thin Terraformhelm_releasewrapper.Validated live (EKS + real Aviatrix controller)
sts.amazonaws.com(Bedrock/IRSA),bedrock-runtime.<region>,and configured MCP hosts are permitted;
example.organd container registries are denied(image pulls are node-level, not pod egress).
default StorageClass / EBS CSI, registration via the credentials secret, Bedrock
inference-profile requirement).
Test Plan
pytestfor the egress generator (35 tests) passesterraform fmt/validateon the wrappereks-singlecluster🤖 Generated with Claude Code