[fix] Declare agent-sandbox proxy Service port as TCP for service-mesh compatibility - #367
Open
oliverclyde wants to merge 2 commits into
Open
[fix] Declare agent-sandbox proxy Service port as TCP for service-mesh compatibility#367oliverclyde wants to merge 2 commits into
oliverclyde wants to merge 2 commits into
Conversation
…h compatibility Sandboxes reach the agent-sandbox proxy with forward-proxy (absolute-form) requests and CONNECT tunnels on port 3019. Naming the Service port "http" opts it into mesh L7 handling (Istio protocol selection), and Envoy's re-serialization rewrites absolute-form request targets to origin-form, so the proxy no longer recognizes them and 404s silently. Declaring the port tcp-proxy keeps sidecars in TCP passthrough: bytes survive verbatim, the hop stays in-mesh with auto-mTLS, and no exclusion annotations or DestinationRules are needed. Field-validated on a customer AKS cluster with namespace-wide Istio injection (case 00121616). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
| Filename | Overview |
|---|---|
| charts/retool/templates/deployment_agent_sandbox.yaml | Changes only the agent-sandbox forward-proxy Service’s protocol-signaling port name; the port number, TCP protocol, target port, selectors, and numeric Ingress backend reference remain aligned. |
| charts/retool/Chart.yaml | Applies the expected patch-level chart version increment for the template fix. |
Reviews (1): Last reviewed commit: "[fix] Declare agent-sandbox proxy Servic..." | Re-trigger Greptile
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On clusters with a service mesh (verified: Istio with namespace-wide sidecar injection), R²/App Builder fails completely and silently: git clones from sandboxes return 404 "repository not found", sessions die ~5s after WebSocket connect, and the agent-sandbox-proxy log shows zero forwarded requests.
Root cause: sandboxes reach the agent-sandbox-proxy (port 3019) using forward-proxy semantics — absolute-form request lines (
GET http://host/path HTTP/1.1) and CONNECT tunnels. The proxy dispatches on exactly that shape (agent_executor/proxy/src/handlers.ts—req.url.startsWith('http://')). The Service declares the port asname: http, which mesh protocol selection reads as an instruction to L7-parse traffic on that port. Envoy's re-serialization normalizes absolute-form to origin-form + Host header, so the proxy no longer recognizes the request as proxy traffic, falls through to its Express routes, and returns Express's default 404 — with no log line on any Retool component.Fix
Declare the port
tcp-proxy. Mesh sidecars then handle 3019 as an opaque TCP stream: request bytes survive verbatim, and the hop stays fully in-mesh (sidecars on path, auto-mTLS intact). No exclusion annotations, no DestinationRules, no plaintext holes.The headless
*-agent-sandbox-podsService keepsname: httpdeliberately — it carries ordinary origin-form HTTP/WebSocket, which meshes handle correctly.Field validation (customer AKS cluster, Istio, injection enabled everywhere, case 00121616)
name: http)excludeOutboundPortsannotation onlytls.mode: DISABLEDestinationRuletcp-proxy, no annotations/DR)Non-mesh clusters are unaffected: vanilla Kubernetes treats Service port names as labels; the Service's
targetPort: httpstill refers to the (unchanged) container port name.🤖 Generated with Claude Code