Discovered by @MusikAnimal and reported on irc.
Examples:
'dspull' is not special; it was just the first tool I saw running on the job grid to test with. The behavior is the same for any webservice running on the job grid.
urlproxy.lua is allowing too many things to fall through to prefix based lookups. When the route_backend_and_exit_if_ok(subdomain, "/") case fails, the next check should be to see if ngx.var.http_host is exactly tools.wmflabs.org. If it is not, then an ngx.exit(ngx.OK) return should be done to pass handling on to the Kubernetes ingress layer.