From 4676dfcd9f53b913d8b5621d9e2055a310c33068 Mon Sep 17 00:00:00 2001
From: Raul Cabello <raulcabm@gmail.com>
Date: Wed, 20 May 2026 10:20:45 +0200
Subject: [PATCH 1/3] MCP NetworkPolicy

The NetworkPolicy restricts the rancher-mcp-server pod so that:

Ingress: only allows traffic from pods with label app: rancher-ai-agent
Egress: only allows traffic to pods with label app: rancher-ai-agent
All other inbound and outbound traffic to/from the MCP pod will be denied.
---
 chart/agent/templates/mcp-network-policy.yaml | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 chart/agent/templates/mcp-network-policy.yaml

diff --git a/chart/agent/templates/mcp-network-policy.yaml b/chart/agent/templates/mcp-network-policy.yaml
new file mode 100644
index 00000000..21942f56
--- /dev/null
+++ b/chart/agent/templates/mcp-network-policy.yaml
@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: rancher-mcp-server
+  namespace: cattle-ai-agent-system
+  labels:
+    app: rancher-mcp-server
+spec:
+  podSelector:
+    matchLabels:
+      app: rancher-mcp-server
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: rancher-ai-agent
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app: rancher-ai-agent

From 97996a2b209b03723b14ab4ea79f69679b618b0f Mon Sep 17 00:00:00 2001
From: Raul Cabello Martin <raul.cabello@suse.com>
Date: Thu, 18 Jun 2026 17:24:47 +0200
Subject: [PATCH 2/3] Update chart/agent/templates/mcp-network-policy.yaml

Co-authored-by: Andy Pitcher <andy.pitcher@suse.com>
---
 chart/agent/templates/mcp-network-policy.yaml | 23 +++++++++++++------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/chart/agent/templates/mcp-network-policy.yaml b/chart/agent/templates/mcp-network-policy.yaml
index 21942f56..76f5e992 100644
--- a/chart/agent/templates/mcp-network-policy.yaml
+++ b/chart/agent/templates/mcp-network-policy.yaml
@@ -1,24 +1,33 @@
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name: rancher-mcp-server
+  name: rancher-mcp-server-ingress
   namespace: cattle-ai-agent-system
-  labels:
-    app: rancher-mcp-server
 spec:
   podSelector:
     matchLabels:
       app: rancher-mcp-server
   policyTypes:
     - Ingress
-    - Egress
   ingress:
     - from:
         - podSelector:
             matchLabels:
               app: rancher-ai-agent
-  egress:
-    - to:
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: rancher-ai-agent-ingress
+  namespace: cattle-ai-agent-system
+spec:
+  podSelector:
+    matchLabels:
+      app: rancher-ai-agent
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
         - podSelector:
             matchLabels:
-              app: rancher-ai-agent
+              app: rancher-mcp-server

From 61d304d240afe10542b04f66e7ae30981bb9f388 Mon Sep 17 00:00:00 2001
From: Raul Cabello <raulcabm@gmail.com>
Date: Tue, 30 Jun 2026 15:36:48 +0200
Subject: [PATCH 3/3] remove ai agent ingress

---
 chart/agent/templates/mcp-network-policy.yaml | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/chart/agent/templates/mcp-network-policy.yaml b/chart/agent/templates/mcp-network-policy.yaml
index 76f5e992..ee5cc53b 100644
--- a/chart/agent/templates/mcp-network-policy.yaml
+++ b/chart/agent/templates/mcp-network-policy.yaml
@@ -14,20 +14,3 @@ spec:
         - podSelector:
             matchLabels:
               app: rancher-ai-agent
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: rancher-ai-agent-ingress
-  namespace: cattle-ai-agent-system
-spec:
-  podSelector:
-    matchLabels:
-      app: rancher-ai-agent
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              app: rancher-mcp-server