<p>We are on Kubernetes and use Istio Service Mesh. Currently, there is SSL Termination for HTTPS in Gateway. I see in the istio-proxy logs that the HTTP protocol is HTTP 1.1.</p>

<p>I want to upgrade HTTP 1.1 to HTTP2 due to its various advantages. Clients should call our services HTTP2 over SSL/TLS.</p>

<p>I am using this <a href="https://blog-tech.groupeonepoint.com/playing-with-istio-service-mesh-on-kubernetes/" rel="nofollow noreferrer">blog</a> for an internal demo on this topic. </p>

<p>These are the bottlenecks:</p>

<p>1) I want to propose a plan which will causes least amount of changes. I understand I need to update the Gateway from </p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "*"
    tls:
      mode: SIMPLE
      serverCertificate: /etc/certs/server.pem
      privateKey: /etc/certs/privatekey.pem
</code></pre>

<p>to </p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http2
      protocol: HTTP2
    hosts:
    - "*"
    tls:
      mode: SIMPLE
      serverCertificate: /etc/certs/server.pem
      privateKey: /etc/certs/privatekey.pem
</code></pre>

<p>based on the examples I see in the <a href="https://istio.io/docs/reference/config/networking/gateway/#Server" rel="nofollow noreferrer">Istio's Gateway documentation</a>.</p>

<p>I want to know: Will this allow HTTP2 over TLS connections from browsers (which support only this mode)? Can I provide tls details for HTTP2, like I did with HTTPS?</p>

<p>2) What are some of the other Istio configurations to update?</p>

<p>3) Will this change be break Microservices which are using http protocol currently? How can I mitigate this?</p>

<p>4) I was reading about DestinationRule and <a href="https://istio.io/docs/reference/config/networking/destination-rule/#ConnectionPoolSettings-HTTPSettings-H2UpgradePolicy" rel="nofollow noreferrer">upgrade policy</a>. Is this a good fit? </p>

Anoop Hallimala
<p>Based on my knowledge, <a href="https://istio.io/" rel="nofollow noreferrer">istio documentation</a> and istio <a href="https://istio.io/about/feature-stages/" rel="nofollow noreferrer">feature stages</a>(http2 in stable phase)</p>

<blockquote>
  <p>1) Will this allow HTTP2 over TLS connections from browsers (which support only this mode)? Can I provide tls details for HTTP2, like I did with HTTPS?</p>
</blockquote>

<p>Yes, it should allow http2.</p>

<hr>

<blockquote>
  <p>2) What are some of the other Istio configurations to update?</p>
</blockquote>

<p>Places when You have options to apply http2 :</p>

<hr>

<ul>
<li><a href="https://istio.io/docs/reference/config/networking/gateway/#Server" rel="nofollow noreferrer"><strong>Gateway</strong></a></li>
</ul>

<hr>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-ingress
spec:
  selector:
    app: my-ingress-gateway
  servers:
  - port:
      number: 80
      name: **http2**
      protocol: **HTTP2**
    hosts:
    - "*"
</code></pre>

<hr>

<ul>
<li><a href="https://istio.io/docs/ops/configuration/traffic-management/protocol-selection/" rel="nofollow noreferrer"><strong>Service protocol selection</strong></a> </li>
</ul>

<hr>

<p><strong>Manual protocol selection</strong></p>

<blockquote>
  <p>Protocols can be specified manually by naming the Service port name: [-]. The following protocols are supported:</p>
</blockquote>

<ul>
<li>grpc </li>
<li>grpc</li>
<li>web </li>
<li>http </li>
<li><strong>http2</strong> </li>
<li>https </li>
<li>mongo </li>
<li>mysql* </li>
<li>redis* </li>
<li>tcp </li>
<li>tls </li>
<li>udp</li>
</ul>

<blockquote>
  <p>*These protocols are disabled by default to avoid accidentally enabling experimental features. To enable them, configure the corresponding Pilot environment variables.</p>
</blockquote>

<hr>

<pre><code>kind: Service
metadata:
  name: myservice
spec:
  ports:
  - number: 80
    name: http2
</code></pre>

<hr>

<blockquote>
  <p>3) Will this change be break Microservices which are using http protocol currently? How can I mitigate this?</p>
  
  <p>4) I was reading about DestinationRule and upgrade policy. Is this a good fit?</p>
</blockquote>

<p>I think it should be a good fit,You would have to upgrade <a href="https://istio.io/docs/reference/config/networking/destination-rule/#ConnectionPoolSettings-HTTPSettings-H2UpgradePolicy" rel="nofollow noreferrer">h2UpgradePolicy</a> and change services to http2.</p>

<hr>

<p>I hope it will help You.</p>
