MTA-7133-LLM-Proxy-Disconnection-Network-Isolation-Procedures

[anarnold97]

---

JIRA

• MTA-7133

---

PREVIEW

• 7. LLM proxy interaction monitoring

  • 7.1. LLM proxy request and data handling

  • 7.2. Accessing LLM proxy pod logs

  • 7.3. Planned audit logging capabilities

---

DESCRIPTION

Adds emergency LLM proxy shutdown and network isolation procedures to the Developer Lightspeed guide.

New file: proc_emergency-llm-proxy-shutdown.adoc

Centralized mode (Operator / OpenShift deployments)

• Disable the LLM proxy by setting kai_llm_proxy_enabled: false in the Tackle CR
• Covers both the OpenShift web console and oc patch CLI methods
• Warns against directly scaling the Deployment to zero — the Operator will re-create it
• Documents expected developer impact: 503/connection refused errors in the IDE, standard IDE functions unaffected
• Includes re-enablement procedure once the incident is resolved

Standalone mode (manual desktop setup)

• No central proxy to disable — documents the firewall egress block approach instead
• Reference table of common LLM provider hostnames to block (OpenAI, Azure OpenAI, IBM watsonx.ai, custom)
• Notes DNS-based filtering as an alternative (Pi-hole, Cisco Umbrella, Zscaler)

Validation

• End-to-end procedure to confirm isolation is active from the IDE
• Table of expected error responses per deployment mode
• Optional curl-based network-level check

Assembly change

docs/developer-lightspeed-guide/master.adoc — new module included after con_developer-lightspeed-logs.adoc

[coderabbitai]

Warning

Review limit reached

@anarnold97, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 13 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: edefda4d-adfd-44a9-b643-901af8d1512b

📥 Commits

Reviewing files that changed from the base of the PR and between 6a1684d and f5d9890.

📒 Files selected for processing (2)

• docs/developer-lightspeed-guide/master.adoc
• docs/topics/developer-lightspeed/proc_emergency-llm-proxy-shutdown.adoc

📝 Walkthrough

Walkthrough

This PR adds a new AsciiDoc procedure documenting emergency shutdown of the LLM proxy to isolate developer environments during security incidents, covering centralized (Tackle CR toggle) and standalone (firewall/network policy) modes, with verification and re-enable steps. It is wired into the master developer guide via an include directive.

Changes

Emergency LLM Proxy Shutdown Documentation

Layer / File(s)	Summary
Guide inclusion and procedure introduction docs/developer-lightspeed-guide/master.adoc, docs/topics/developer-lightspeed/proc_emergency-llm-proxy-shutdown.adoc	Master guide includes the new topic before the Developer Lightspeed attribute toggle; new document introduces module metadata, title, and an incident-response warning.
Centralized mode shutdown, verification, and re-enable docs/topics/developer-lightspeed/proc_emergency-llm-proxy-shutdown.adoc	Documents disabling/re-enabling the proxy via web console and oc patch on kai_llm_proxy_enabled, verification of proxy pod state, and expected developer-facing error behavior.
Standalone mode blocking and validation docs/topics/developer-lightspeed/proc_emergency-llm-proxy-shutdown.adoc	Documents blocking LLM provider endpoints at the firewall/network policy layer with example rules and DNS filtering, plus IDE and curl-based validation steps for confirming isolation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• migtools/mta-documentation#324: Adds emergency shutdown procedure using the same kai_llm_proxy_enabled Tackle CR field referenced in the related "enable LLM proxy" documentation.

Suggested reviewers: djzager, fabianvf

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the new LLM proxy disconnection and network isolation procedures added in this PR.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/topics/developer-lightspeed/proc_emergency-llm-proxy-shutdown.adoc`:
- Around line 175-182: Correct the provider name typo in the provider list so it
reads “Azure OpenAI Service” instead of “zure OpenAI Service.” Update the
relevant entry in the developer-lightspeed emergency LLM proxy shutdown document
where the OpenAI/Azure OpenAI providers are listed, keeping the rest of the
table content unchanged.
- Around line 93-104: The verification step in
proc_emergency-llm-proxy-shutdown.adoc is misleading because `oc get pods ... |
grep proxy` will not produce the stated “No resources found...” output; update
the expected result to reflect the actual shell behavior for this command, using
the existing “Verify that no proxy pods are running” step and its “Expected
output” block as the place to adjust the wording.
- Around line 243-264: The curl validation is targeting the public
`api.openai.com` endpoint instead of the actual isolation/proxy path, so it does
not validate centralized deployments correctly. Update the `curl` example in the
emergency shutdown docs to use the proxy or workstation-specific endpoint used
by the isolation flow, and make the expected output reflect that path for both
isolated and centralized modes. Keep the guidance aligned with the surrounding
`curl` validation section so readers verify the real traffic route rather than a
single provider host.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 23625628-72fe-4a48-8b6d-a0bc320e3992

📥 Commits

Reviewing files that changed from the base of the PR and between 50da7d6 and 6a1684d.

📒 Files selected for processing (2)

• docs/developer-lightspeed-guide/master.adoc
• docs/topics/developer-lightspeed/proc_emergency-llm-proxy-shutdown.adoc

[Pkylas007]

Really minor nits and requested a clarification but thanks for the draft!

[Pkylas007]

Please confirm with the engineering peeps if we have an AI assistant chat input?

IIUC, On the {ProductShortName} Analysis View page, {ProductShortName} shows an error message even before the user performs a code analysis since the LLM provider connection is blocked but please confirm with the engg folks if this is the expected behavior.

[rromannissen]

Some changes required.

[Pkylas007]

LGTM, thank you!