Support HTTP2 probes over cleartext (h2c) about kubernetes HOT 11 OPEN

Playing devil's advocate, I wonder if it is worth the effort to implement an h2cGet considering that one can just register a HTTP1.1 route /healthz just for probing. Saying this because we are looking at supporting all options that httpGet supports today (minus scheme) and also a whole new implementation for h2c.

That's exactly what I'm going to do and I don't think this is a good test. Such a probe will only test if we can emit HTTP/1.1 responses specifically designed to return healthchecks. It's not gonna test a generic endpoint so that we know the microservice returns HTTP responses relevant to its job.

from kubernetes.

Thank you for reviving this one @grepwood

You've set out all of the motivation here quite eloquently.

As @mauri870 has observed, it shouldn't be very complex to support this at all.

Playing devil's advocate, I wonder if it is worth the effort to implement an h2cGet considering that one can just register a HTTP1.1 route /healthz just for probing

@mauri870 with the framework I use (Kestrel/ASP.NET) you cannot just do HTTP/1.1 and unencrypted HTTP/2 at the same time on the same port because it needs ALPN to be either to do protocol negotiation, which relies on TLS.

I have to do something like this today:

builder.WebHost.ConfigureKestrel(options =>
{
    // port 8282 for HTTP/2 (unencrypted)
    options.Listen(IPAddress.Any, 8282, listenOptions =>
    {
        listenOptions.Protocols = HttpProtocols.Http2;
    });
    // port 80 for k8s probe which is too stupid to understand clear HTTP/2 - #97330
    options.Listen(IPAddress.Any, 80, listenOptions =>
    {
        listenOptions.Protocols = HttpProtocols.Http1;
    });
});

See also grpc/grpc-dotnet#979 (comment)

from kubernetes.

That's exactly what I'm going to do and I don't think this is a good test. Such a probe will only test if we can emit HTTP/1.1 responses specifically designed to return healthchecks. It's not gonna test a generic endpoint so that we know the microservice returns HTTP responses relevant to its job.

I did exactly this, and it works. It's slightly more messy than if we supported HTTP/1.1 and h2c on the same socket, but it works.

from kubernetes.

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

from kubernetes.

/sig node

from kubernetes.

From the information of both issues, I see this as a totally valid use case.
It is common to have HTTP servers that run in cleartext mode and do SSL termination on some upper load balancer layer.

What changes are you actually proposing @grepwood?

Shall we add counterparts to the httpGet and grpc type probes for http2, perhaps even separated in http2Get and h2cGet?

from kubernetes.

@mauri870 yes please. All the solutions you've listed are good from my point of view, so I think it's up to developers to decide which one would give them least amount of issues now and later.

from kubernetes.

I was looking a bit into the current implementation, looks like setting httpGet with scheme set to HTTPS already works with HTTP2 over tls. So the proposal is for a h2c type probe.

Playing devil's advocate, I wonder if it is worth the effort to implement an h2cGet considering that one can just register a HTTP1.1 route /healthz just for probing. Saying this because we are looking at supporting all options that httpGet supports today (minus scheme) and also a whole new implementation for h2c.

from kubernetes.

Some more details I found. To make a http client an h2c client we just have to change the transport:

https://github.com/thrawn01/h2c-golang-example/blob/931670014b5a6d7b7fa5fa8482dc1d98ab71eadc/cmd/client/main.go#L51-L59

That seems to plug nicely with our http prober:

Now it does not seem so complex to support h2c, but I might have overlooked something.

from kubernetes.

/retitle Support HTTP2 probes over cleartext (h2c)

from kubernetes.

/assign

from kubernetes.