From 2caaa137feda39a072c03561003be9521f7ab21a Mon Sep 17 00:00:00 2001 From: oliverclyde Date: Tue, 1 Sep 2026 16:08:59 +0100 Subject: [PATCH 1/2] [fix] Declare agent-sandbox proxy Service port as TCP for service-mesh compatibility Sandboxes reach the agent-sandbox proxy with forward-proxy (absolute-form) requests and CONNECT tunnels on port 3019. Naming the Service port "http" opts it into mesh L7 handling (Istio protocol selection), and Envoy's re-serialization rewrites absolute-form request targets to origin-form, so the proxy no longer recognizes them and 404s silently. Declaring the port tcp-proxy keeps sidecars in TCP passthrough: bytes survive verbatim, the hop stays in-mesh with auto-mTLS, and no exclusion annotations or DestinationRules are needed. Field-validated on a customer AKS cluster with namespace-wide Istio injection (case 00121616). Co-Authored-By: Claude Fable 5 --- charts/retool/Chart.yaml | 2 +- charts/retool/templates/deployment_agent_sandbox.yaml | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/charts/retool/Chart.yaml b/charts/retool/Chart.yaml index bcd97ca7..e61ded67 100644 --- a/charts/retool/Chart.yaml +++ b/charts/retool/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: retool description: A Helm chart for Kubernetes type: application -version: 6.11.23 +version: 6.11.24 maintainers: - name: Retool Engineering email: engineering+helm@retool.com diff --git a/charts/retool/templates/deployment_agent_sandbox.yaml b/charts/retool/templates/deployment_agent_sandbox.yaml index daf4a70a..16f26da1 100644 --- a/charts/retool/templates/deployment_agent_sandbox.yaml +++ b/charts/retool/templates/deployment_agent_sandbox.yaml @@ -685,7 +685,9 @@ spec: - port: {{ $as.proxy.port }} targetPort: http protocol: TCP - name: http + # tcp-, not http-: this port carries forward-proxy requests and CONNECT + # tunnels, which service-mesh L7 handling rewrites and breaks. + name: tcp-proxy selector: {{- include "retool.agentSandbox.proxy.selectorLabels" . | nindent 4 }} --- From f9d6797bb8ed717ad668fccfd71f8726aa80bd80 Mon Sep 17 00:00:00 2001 From: oliverclyde Date: Tue, 1 Sep 2026 16:17:38 +0100 Subject: [PATCH 2/2] remove comment --- charts/retool/templates/deployment_agent_sandbox.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/charts/retool/templates/deployment_agent_sandbox.yaml b/charts/retool/templates/deployment_agent_sandbox.yaml index 16f26da1..08392433 100644 --- a/charts/retool/templates/deployment_agent_sandbox.yaml +++ b/charts/retool/templates/deployment_agent_sandbox.yaml @@ -685,8 +685,6 @@ spec: - port: {{ $as.proxy.port }} targetPort: http protocol: TCP - # tcp-, not http-: this port carries forward-proxy requests and CONNECT - # tunnels, which service-mesh L7 handling rewrites and breaks. name: tcp-proxy selector: {{- include "retool.agentSandbox.proxy.selectorLabels" . | nindent 4 }}