Replace envoy proxy with Traefik ingress in sandbox#7134
Merged
Conversation
Remove the envoy proxy from the sandbox and replace it with k3s's built-in Traefik ingress controller. This reduces the sandbox image size by ~50MB compressed while preserving the single-port localhost:30080 experience. Changes: - Delete envoy proxy templates (configmap, deployment, service) - Add Traefik HelmChartConfig for NodePort 30080 with streaming timeout - Add Kubernetes Ingress resources for all routed services - Add Traefik Middleware CRDs for prefix stripping (dashboard, minio) - Remove envoy image from sandbox image manifest - Re-enable Traefik in k3s (Dockerfile and k3d config) - Remove unused proxy values and README entries - Regenerate bundled manifests Signed-off-by: Kevin Su <[email protected]>
Resolve conflicts: - _helpers.tpl: v2 removed buildkit helpers, we removed envoy helpers — both removals kept - values.yaml: v2 removed buildkit section, we removed proxy section — both removals kept - manifests: regenerated from merged templates Signed-off-by: Kevin Su <[email protected]>
Use a template variable for the backend service name instead of repeating the if/else conditional in each path entry. Signed-off-by: Kevin Su <[email protected]>
…bility - Change websecure.expose from nested object format to boolean (v25.0.2 Traefik chart uses `expose: false`, not `expose.default: false`) - Move streaming timeout into ports.web.transport instead of additionalArguments Signed-off-by: Kevin Su <[email protected]>
Resolve conflicts: - manifest.txt: v2 removed postgresql, we removed envoy — both kept - manifests: regenerated from merged templates Signed-off-by: Kevin Su <[email protected]>
The embedded-postgres binary was added but never launched in the entrypoint script. Start it in the background and wait for its ready file before proceeding, so PostgreSQL is available when the flyte-binary pod's wait-for-db init container runs. Signed-off-by: Kevin Su <[email protected]>
When reusing a docker volume from a previous sandbox run that used the old bitnami PostgreSQL (uid 1001), the embedded-postgres (uid 999) cannot clean up the data directory. Fix by chowning the directory as root in the entrypoint before starting embedded-postgres. Signed-off-by: Kevin Su <[email protected]>
Signed-off-by: Kevin Su <[email protected]>
Signed-off-by: Kevin Su <[email protected]>
AdilFayyaz
approved these changes
Apr 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
envoyproxy/envoyimagelocalhost:30080experience using Kubernetes Ingress resources + Traefik Middleware CRDsMotivation
With the flyte-sdk replacing gRPC with connectRPC (flyteorg/flyte-sdk#844), envoy's HTTP/2 protocol bridging is no longer needed. ConnectRPC works over plain HTTP/1.1, so any standard L7 ingress controller can handle routing. Traefik is already bundled in k3s at zero additional image cost.
Changes
HelmChartConfigto configure NodePort 30080 with unlimited streaming timeoutIngressresources for all routed services (/flyteidl2.*,/v2,/kubernetes-dashboard/,/minio/)MiddlewareCRDs for prefix stripping (dashboard, minio)envoyproxy/envoyfrom sandbox image manifest--disable=traefikfrom Dockerfile and k3d config)sandbox.proxyvalues and stale README entriesTest plan
helm lint charts/flyte-sandboxpasseshelm templaterenders correctly in standard and dev modesflytectl demo startor equivalentlocalhost:30080(API, console, dashboard, minio)main