#7134 Replace envoy proxy with Traefik ingress in sandbox Pull request opened by pingsutw Summary • Remove the envoy proxy from the flyte sandbox and replace it with k3s's built-in Traefik ingress controller • Reduces sandbox image size by ~50MB compressed (~130-170MB uncompressed) by removing the

envoyproxy/envoy

image • Preserves the single-port

localhost:30080

experience using Kubernetes Ingress resources + Traefik Middleware CRDs Motivation With the flyte-sdk replacing gRPC with connectRPC (flyteorg/flyte-sdk#844), envoy's HTTP/2 protocol bridging is no longer needed. ConnectRPC works over plain HTTP/1.1, so any standard L7 ingress controller can handle routing. Traefik is already bundled in k3s at zero additional image cost. Changes • Delete envoy proxy Helm templates (configmap, deployment, service) • Add Traefik

HelmChartConfig

to configure NodePort 30080 with unlimited streaming timeout • Add Kubernetes

Ingress

resources for all routed services (

/flyteidl2.*

,

/v2

,

/kubernetes-dashboard/

,

/minio/

) • Add Traefik

Middleware

CRDs for prefix stripping (dashboard, minio) • Remove

envoyproxy/envoy

from sandbox image manifest • Re-enable Traefik in k3s (remove

--disable=traefik

from Dockerfile and k3d config) • Remove unused

sandbox.proxy

values and stale README entries • Regenerate bundled manifests Test plan •

helm lint charts/flyte-sandbox

passes •

helm template

renders correctly in standard and dev modes • No envoy references remain in rendered output • Sandbox starts successfully with

flytectl demo start

or equivalent • All services accessible via

localhost:30080

(API, console, dashboard, minio) • Streaming RPCs (e.g., log tailing) work without timeout •

main

• #6583 • Replace envoy proxy with Traefik ingress in sandbox 👈 flyteorg/flyte