feat: disable HTTP/2 ALPN handshake for connections on routes configured with AI-proxy. #13735
+608
−33
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
build/bazel
cherry-pick kong-ee
oowl
force-pushed
the
disable-h2-alpn-ai-proxy
branch
from
28fdb00
to
0c402b6
Compare
oowl
force-pushed
the
disable-h2-alpn-ai-proxy
branch
from
f86330c
to
c71fdc8
Compare
oowl
force-pushed
the
disable-h2-alpn-ai-proxy
branch
from
c71fdc8
to
ab71f75
Compare
oowl
changed the title
oowl
changed the title
oowl
force-pushed
the
disable-h2-alpn-ai-proxy
branch
2 times, most recently
from
9d538a0
to
9e4bf73
Compare
fffonion
reviewed
Oct 21, 2024
fffonion
reviewed
Oct 21, 2024
fffonion
reviewed
Oct 21, 2024
oowl
force-pushed
the
disable-h2-alpn-re
branch
from
4e0e15f
to
b666932
Compare
…ing the route configured with ai-proxy
oowl
force-pushed
the
disable-h2-alpn-ai-proxy
branch
from
9e4bf73
to
2340e90
Compare
fffonion
reviewed
Oct 22, 2024
fffonion
approved these changes
Oct 22, 2024
windmgc
requested changes
Oct 23, 2024
Comment on lines
+514
to
+515
| local snis_set, err = kong.cache:get(sni_cache_key, TTL_FOREVER, | ||
| sni_filter.build_ssl_route_filter_set, plugin_name) |
There was a problem hiding this comment.
I wonder if this could cause similar performance impact, just the same as the mTLS plugin's case. Suggest we introduce this PR after https://github.com/Kong/kong-ee/pull/10510/files
There was a problem hiding this comment.
Let's merge the current PR first,it seems that's different functionality in here. When the ee PR merged, I will cherry-pick it to CE ( actually can not directly cherry-pick due to ee and ce db related core code difference)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This change will disable HTTP/2 ALPN handshake for connections on routes configured with AI-proxy.
The following are the specific changes
kong/tls/plugins/certificate.luaandkong/tls/plugins/sni_filter.luafrom ee to ce repotls.disable_http2_alpn()function needed patch for disabling HTTP/2 ALPN when tls handshake. #13709 and feat: introducetls.disable_http2_alpn()function lua-kong-nginx-module#93, we introduce thedisable_http2_alpnaction in the ai-proxy plugin to solve theai-proxyplugin did not work in HTTP2 case. After the current PR is merged, HTTP/2 ALPN handshakes will be disabled for requests on routes configured with AI-proxy, and all these connections will fall back to the http1.1 protocol.Checklist
changelog/unreleased/kongorskip-changeloglabel added on PR if changelog is unnecessary. README.mdIssue reference
AG-119