Cilium Feature Proposal

cilium-envoy is currently missing ALPN config section in the DownstreamTlsContext which results in envoy not exposing ALPN altogether.

The reason why we even need ALPN config is because as per gRPC protocol, clients must use HTTP2 and they must negotiate ALPN. While the requirement for HTTP2 is understandable, it's not clear to me why doesn't gRPC allow http2-prior-knowledge (HTTP/2 over a plain TCP connection). grpc/grpc-java#5167 grpc/grpc-java#7201 grpc/grpc-java#5543 This is reproducible throughout most of the platforms: I tried Java, Go, Python, PHP, and all of them fail sending gRPC tls client requests without ALPN.

Supporting ALPN is a very trivial patch to cilium-operator:

Index: operator/pkg/model/translation/envoy_listener.go
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/operator/pkg/model/translation/envoy_listener.go b/operator/pkg/model/translation/envoy_listener.go
--- a/operator/pkg/model/translation/envoy_listener.go	(revision 93d4f151799025dfe50b290e2c8f249773f13f9c)
+++ b/operator/pkg/model/translation/envoy_listener.go	(date 1706955589616)
@@ -277,6 +277,7 @@
 	downStreamContext := envoy_extensions_transport_sockets_tls_v3.DownstreamTlsContext{
 		CommonTlsContext: &envoy_extensions_transport_sockets_tls_v3.CommonTlsContext{
 			TlsCertificateSdsSecretConfigs: tlsSdsConfig,
+			AlpnProtocols:                  []string{"h2,http/1.1"},
 		},
 	}

It will unbreak gRPC support, but will break backends that do not serve dual HTTP1.1/HTTP2-H2C.

Since envoy is set up with useDownstreamProtocolConfig for connecting to upstream backends (i.e pods), it works fine for regular browser requests because without ALPN, browser will choose HTTP1.1 and receive the expected response.

However, if ALPN protocols setting is present (we will need h2,http/1.1), then browser will prefer HTTP2 over HTTP1.1, so requests to backends only serving HTTP1.1 will effectively fail with '502 protocol error'.

To address that, I have a suggestion to solve #30452 first.