HTTP2 C2C Networking Over TLS

Products

• VMware Tanzu Application Service for VMs

Issue/Introduction

TLS traffic to application container port 61443 is terminated by Envoy proxy and forwarded to the application on port 8080 inside of the container. Envoy does not know if the application supports HTTP/2 so it will not offer HTTP/2 when it goes through the ALPN handshake.

Environment

Product Version: 2.13

Resolution

To use HTTP/2 C2C Networking over TLS on Port 61443:

If you know the server supports HTTP/2 then the client can make use of prior knowledge to connect straight to the server with HTTP/2 using the --http2-prior-knowledge  flag.

Example using Curl:
 

curl  --http2-prior-knowledge -v https://<app-name>.apps.internal:61443

Please see further details on Securing Container-to-Container Traffic.