Changing the SSRF_ALLOW_PRIVATE_NETWORKS value after deploying on Kubernetes?

[EricWilson-BluePrism]

I'll preface this by saying I'm not a kube guy. :-)

The RC2 release of ContextForge was deployed on a dev Kubernetes instance, but the change to the default SSRF values was missed. Is it possible to change these values in the deployed instance (maybe a setting in the Postgres instance or something on nginx), or does this just require redeploying the helm chart with the proper values set?

[omni-front]

you'll need to update the config and redeploy the helm chart with the new SSRF_ALLOW_PRIVATE_NETWORKS value. kubernetes won't let you change environment variables directly in a running pod. after updating the values in your chart, run a helm upgrade to apply the changes.

[crivetimihai]

Hi @EricWilson-BluePrism, @omni-front is correct — Kubernetes environment variables require a pod redeploy. Here are the exact steps:

Option 1 — Helm upgrade (recommended):

helm upgrade mcp-stack charts/mcp-stack -n mcp-private \
  --set "mcpContextForge.config.SSRF_ALLOW_PRIVATE_NETWORKS=true" \
  --wait

Option 2 — Allow only specific CIDRs (more secure than blanket-allowing all private networks):

helm upgrade mcp-stack charts/mcp-stack -n mcp-private \
  --set 'mcpContextForge.config.SSRF_ALLOW_PRIVATE_NETWORKS=false' \
  --set 'mcpContextForge.config.SSRF_ALLOWED_NETWORKS=["10.96.0.0/12"]' \
  --wait

SSRF_ALLOWED_NETWORKS lets you allowlist specific CIDR ranges while keeping blanket private network access blocked. This is the recommended approach for Kubernetes deployments where your MCP servers are on the cluster network — you can allowlist just your cluster CIDR.

These settings live in values.yaml under mcpContextForge.config (lines 397-398). After helm upgrade, pods restart with the new values. No need to touch the database or nginx.

[itxashancode]

The helm upgrade really is your simplest path here - it's not as scary as it sounds. K8s won't let you mutate env vars in a running pod, and there's no postgres or nginx setting that maps to this; it's an app-level config baked into the container at deploy time.

That said, if you want to minimize friction: helm upgrade --reuse-values will carry forward everything you've already set and only apply the one change you specify. It handles the restart automatically.

helm upgrade mcp-stack charts/mcp-stack -n mcp-private \
 --set "mcpContextForge.config.SSRF_ALLOW_PRIVATE_NETWORKS=true" \
 --reuse-values