Gatekeeper switches the protocol from HTTP2 to HTTP1 when using TLS

[abstractj]

What:

I currently have an issue with Gatekeeper and gRPC requests. It seems that Gatekeeper switches the protocol from HTTP2 to HTTP1 when talking with upstream.

I think this issue has to do with: golang/go#21336 (comment)

Here is the relevant code: https://github.com/golang/go/blob/c522b2bec9e6186a8efb7ddd221295390638a18e/src/net/http/transport.go#L220
{code:java}
if t.TLSClientConfig != nil || t.Dial != nil || t.DialTLS != nil {
// Be conservative and don't automatically enable
// http2 if they've specified a custom TLS config or
// custom dialers. Let them opt-in themselves via
// http2.ConfigureTransport so we don't surprise them
// by modifying their tls.Config. Issue 14275.
return
}
{code}

If a SSL cert is set, the http.Transport implementation will not automatically enable HTTP2.

Here is the discussion from the forum: https://keycloak.discourse.group/t/does-gatekeeper-proxy-grpc-requests/1606

Reference:

• KEYCLOAK-13401 - Gatekeeper switches the protocol from HTTP2 to HTTP1 when using TLS

[Nuru]

I have seen issues of POSTs using TLS and HTTP2 generating Status 500 errors on Gatekeeper. They do appear to be go clients making the POSTs, but I have not yet been able to produce a minimal test case.

[akkie]

I'm the original creator of this issue. Please ping me if further information is required.

[lyndon160]

Does Gatekeeper/louketo support gRPC?

[Nuru]

Hit this problem again. What are the plans for HTTP 2.0 and gRPC support in the proxy?

[Nuru]

So, the cause is:

louketo-proxy/server.go

Line 631 in 9eca196

TLSClientConfig: tlsConfig,

combined with https://github.com/golang/go/blob/2bc8d90fa21e9547aeb0f0ae775107dc8e05dc0a/src/net/http/transport.go#L353-L360 which says not to enable HTTP2 if a TLSCLientConfig is set.

Solution appears to be simple: add

ForceAttemptHTTP2: true

to the Transport configuration