From 90a18618de9105f7fccafa96346e62788a37df74 Mon Sep 17 00:00:00 2001
From: Jessica <639053+jess-sol@users.noreply.github.com>
Date: Thu, 22 Oct 2026 16:03:18 -0700
Subject: [PATCH] [INF-8243] Disable service links on agent sandbox pods

Sandbox pods were inheriting a *_SERVICE_HOST/*_PORT env var for every
Service in their namespace, which sandbox code can't use, and shouldn't
see.
---
 charts/retool/Chart.yaml                              | 2 +-
 charts/retool/templates/deployment_agent_sandbox.yaml | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/charts/retool/Chart.yaml b/charts/retool/Chart.yaml
index ad4bd76f..16900a90 100644
--- a/charts/retool/Chart.yaml
+++ b/charts/retool/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: retool
 description: A Helm chart for Kubernetes
 type: application
-version: 6.13.4
+version: 6.13.5
 maintainers:
   - name: Retool Engineering
     email: engineering+helm@retool.com
diff --git a/charts/retool/templates/deployment_agent_sandbox.yaml b/charts/retool/templates/deployment_agent_sandbox.yaml
index 04b461e1..90d3d10a 100644
--- a/charts/retool/templates/deployment_agent_sandbox.yaml
+++ b/charts/retool/templates/deployment_agent_sandbox.yaml
@@ -127,6 +127,7 @@ data:
             "restartPolicy": "Never",
             "subdomain": "{{ include "retool.agentSandbox.name" . }}-pods",
             "automountServiceAccountToken": false,
+            "enableServiceLinks": false,
             {{- if $nodeSelector }}
             "nodeSelector": {{ toJson $nodeSelector }},
             {{- end }}