ingress-nginx Feature: Annotation to disable HTTP2 per host

This feature has been requested and attempted a few times, but keeps losing steam.

Support per-ingress http2 setting through annotation #2189
Add http2-host-blacklist config flag #2482
Annotation support for http2 #2402

I would like to revive it because it should now be relatively easy to implement and there are precedents for it.

Specifically, I would like to have the annotation nginx.ingress.kubernetes.io/use-http2: "false" disable HTTP2 for that host. We already have nginx.ingress.kubernetes.io/server-snippet which can only be used once per host and which affects all paths for the host, but because of the way HTTP2 support is configured (as part of the listen directive), the server snippet annotation cannot be used to disable HTTP2 support for the server. We also have the nginx.ingress.kubernetes.io/use-regex which affects all paths for the host, regardless of which Ingress the paths are defined on.

I think #2189 was not allowed because the fact that it applies to the entire host was seen as unacceptable, but this kind of thing, when necessary for architectural reasons, is acceptable now when properly documented. #2482 was a different way to accomplish the same goal and was proposed as a way around a bug in nginx and lost steam when the bug was fixed.

Note that I am not asking for an annotation that would allow HTTP2 support on port 80 or any non-TLS port, which I think is what got #2402 shut down. What I am asking for is an annotation that turns off the now default HTTP2 support for TLS ports on a per-host/server basis.

Proposed documentation:

Enables or disables HTTP/2 support in secure connections for this host. (Overrides the ConfigMap setting use-http2 for this host.) Setting this on any Ingress for the host affects all paths of the host, regardless of what Ingress they are defined on. May only be set once per host.

Use case: We have a large cluster with many hosts and we want to have HTTP2 support for nearly all of them, but some break when HTTP2 support is turned on and we want to disable it only for those hosts. It is acceptable that this be a per-host setting like the server snippet.

/kind feature

Aug 06 '20 21:08 Nuru

@Nuru thank you for writing this request with some context and analysis of the previous attempts. My only concern is how we can avoid issues/complains with "allow HTTP2 support on port 80 or any non-TLS port".

Aug 06 '20 22:08 aledbf

@aledbf wrote

My only concern is how we can avoid issues/complaints with "allow HTTP2 support on port 80 or any non-TLS port".

A few ways:

The same way this has been avoided with the use-http2 ConfigMap setting: by documenting that it toggles support "in secure connections".
By documenting why HTTP/2 is not supported on non-TLS connections and/or linking to some relevant issues
- https://github.com/kubernetes/ingress-nginx/issues/4630#issuecomment-537691335
- #3897
- #3938
- #2465
By including comments in the code

I suppose we cannot really avoid complaints, but we have a solid answer for them: non-TLS protocol does not support auto-negotiation of protocol. In other words, it just does not work.

Aug 06 '20 23:08 Nuru

Issues go stale after 90d of inactivity. Mark the issue as fresh with /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta. /lifecycle stale

Nov 04 '20 23:11 fejta-bot

Does that seem sufficient to address the prior concerns @aledbf ?

Nov 10 '20 16:11 braxtone

/remove-lifecycle stale

Nov 11 '20 19:11 Nuru

Issues go stale after 90d of inactivity. Mark the issue as fresh with /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale

Feb 09 '21 20:02 fejta-bot

Stale issues rot after 30d of inactivity. Mark the issue as fresh with /remove-lifecycle rotten. Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community. /lifecycle rotten

Mar 11 '21 21:03 fejta-bot

/remove-lifecycle rotten

@aledbf What can I do to move this forward?

Mar 20 '21 21:03 Nuru

Issues go stale after 90d of inactivity. Mark the issue as fresh with /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale

Jun 18 '21 22:06 fejta-bot

Stale issues rot after 30d of inactivity. Mark the issue as fresh with /remove-lifecycle rotten. Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community. /lifecycle rotten

Jul 18 '21 23:07 fejta-bot

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Reopen this issue or PR with /reopen
Mark this issue or PR as fresh with /remove-lifecycle rotten
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Aug 17 '21 23:08 k8s-triage-robot

@k8s-triage-robot: Closing this issue.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied

After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied

After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Reopen this issue or PR with /reopen

Mark this issue or PR as fresh with /remove-lifecycle rotten

Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Aug 17 '21 23:08 k8s-ci-robot

I need this too. Can we have this reopened please?

Aug 28 '21 06:08 fnkr

We also need this ability.

Sep 23 '21 13:09 johngirvin

We need this too, can someone please pick it up ?

Mar 17 '22 09:03 arpit20adlakha

let me reopen it

/reopen

Mar 17 '22 10:03 tao12345666333

@tao12345666333: Reopened this issue.

In response to this:

let me reopen it

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Mar 17 '22 10:03 k8s-ci-robot

/triage accepted /priority important-soon

@fnkr @johngirvin @arpit20adlakha if you want to see this feature, we are happy for any contributions :)

/help

Apr 12 '22 08:04 iamNoah1

@iamNoah1: This request has been marked as needing help from a contributor.

Guidelines

Please ensure that the issue body includes answers to the following questions:

Why are we solving this issue?
To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points?
Does this issue have zero to low barrier of entry?
How can the assignee reach out to you for help?

For more details on the requirements of such an issue, please see here and ensure that they are met.

If this request no longer meets these requirements, the label can be removed by commenting with the /remove-help command.

In response to this:

/triage accepted /priority important-soon

@fnkr @johngirvin @arpit20adlakha if you want to see this feature, we are happy for any contributions :)

/help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Apr 12 '22 08:04 k8s-ci-robot

/lifecycle frozen

May 10 '22 16:05 rikatz

@nicknovitski how far from this proposal is your existing work on this?

Aug 17 '22 21:08 malthe

This issue is labeled with priority/important-soon but has not been updated in over 90 days, and should be re-triaged. Important-soon issues must be staffed and worked on either currently, or very soon, ideally in time for the next release.

You can:

Confirm that this issue is still relevant with /triage accepted (org members only)
Deprioritize it with /priority important-longterm or /priority backlog
Close this issue with /close

For more details on the triage process, see https://www.kubernetes.dev/docs/guide/issue-triage/

/remove-triage accepted

Feb 08 '23 00:02 k8s-triage-robot

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Feb 08 '23 00:02 k8s-ci-robot

This feature will be very useful and I have number of users looking for this on IBM Cloud deployments. Can we triage this ?

Jul 12 '24 04:07 rahulsb

Can not be achieved this using gateway API?

ingress API has been GA for a long time, growing the scope of this project with annotations fragments the ecosystem and reduces the capacity to standardize it

Jul 12 '24 12:07 aojea

@rahulsb are you willing to implement, maintain, triage bugs, etc for this feature? If so, please feel free to open a PR for it

Aug 23 '24 23:08 rikatz

We are not actively adding new features as we migrate our focus to ingate.

We have discussed at the gateway-api community meeting and our latest ingress-nginx Kubcon Maintainer talk.

The repo to follow along is at: https://github.com/kubernetes-sigs/ingate

/close

Dec 19 '24 16:12 strongjz

@strongjz: Closing this issue.

In response to this:

We are not actively adding new features as we migrate our focus to ingate.

We have discussed at the gateway-api community meeting and our latest ingress-nginx Kubcon Maintainer talk.

The repo to follow along is at: https://github.com/kubernetes-sigs/ingate

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Dec 19 '24 16:12 k8s-ci-robot