From 38a29bc6905d6ef16a2086b1e1ab13a83a3b614a Mon Sep 17 00:00:00 2001
From: David Hadley <davehadley@users.noreply.github.com>
Date: Wed, 26 Aug 2026 14:54:22 +0100
Subject: [PATCH 1/3] fix(envoy): increase envoy memory limits to prevent OOM
 crash sometimes observed under real loads

---
 charts/workflows/values.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/workflows/values.yaml b/charts/workflows/values.yaml
index 86c014488..c24ff09f6 100644
--- a/charts/workflows/values.yaml
+++ b/charts/workflows/values.yaml
@@ -299,8 +299,8 @@ authenticatedWorkflows:
     resources:
       requests:
         cpu: 100m
-        memory: 32Mi
+        memory: 128Mi
       limits:
         # limit range doesn't allow a smaller value
         cpu: 1000m
-        memory: 64Mi
+        memory: 256Mi

From a03b00300d4b50a62faec3f4057f4817912c5d2e Mon Sep 17 00:00:00 2001
From: David Hadley <davehadley@users.noreply.github.com>
Date: Wed, 26 Aug 2026 15:24:11 +0100
Subject: [PATCH 2/3] fix(envoy): wait for envoy ready before initializing
 workflow containers

---
 .../inject-envoy-sidecar-clusterpolicy.yaml   | 21 ++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/charts/workflows/templates/inject-envoy-sidecar-clusterpolicy.yaml b/charts/workflows/templates/inject-envoy-sidecar-clusterpolicy.yaml
index 11b271216..fc84b8128 100644
--- a/charts/workflows/templates/inject-envoy-sidecar-clusterpolicy.yaml
+++ b/charts/workflows/templates/inject-envoy-sidecar-clusterpolicy.yaml
@@ -99,6 +99,13 @@ spec:
                   # GraphQL server
                   - |
                     cat > /etc/envoy/envoy.yaml << 'ENVOYEOF'
+                    admin:
+                      address:
+                        socket_address:
+                          address: 0.0.0.0
+                          port_value: 9901
+                      allow_paths:
+                      - exact: /ready
                     static_resources:
                       listeners:
                       - name: envoy-local-graph-proxy
@@ -320,12 +327,20 @@ spec:
                   - "--log-level"
                   - "{{ .Values.authenticatedWorkflows.envoy.logLevel | default "warn" }}"
                 startupProbe:
-                  tcpSocket:
-                    port: 6000
+                  httpGet:
+                    port: 9901
+                    path: /ready
                   initialDelaySeconds: 1
                   periodSeconds: 1
-                  failureThreshold: 30
+                  failureThreshold: 60
                   timeoutSeconds: 1
+                readinessProbe:
+                  httpGet:
+                    port: 9901
+                    path: /ready
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
                 volumeMounts:
                   - name: workflows-envoy-config
                     mountPath: /etc/envoy

From 7bb27897eb5622620bd0c69c49faa059754982a2 Mon Sep 17 00:00:00 2001
From: David Hadley <davehadley@users.noreply.github.com>
Date: Thu, 27 Aug 2026 08:33:21 +0100
Subject: [PATCH 3/3] chore(charts): increment workflows chart version number

---
 charts/workflows/Chart.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/workflows/Chart.yaml b/charts/workflows/Chart.yaml
index 85f1d667a..a5d6624c0 100644
--- a/charts/workflows/Chart.yaml
+++ b/charts/workflows/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: workflows
 description: Data Analysis workflow orchestration
 type: application
-version: 0.13.67
+version: 0.13.68
 dependencies:
   - name: argo-workflows
     repository: https://argoproj.github.io/argo-helm