feat(listenerpolicy): expose HTTP/2 allow_connect for WebSocket-over-HTTP/2#14323
Merged
davidjumani merged 2 commits intoJul 13, 2026
Merged
Conversation
…HTTP/2 Add an `allowConnect` field to the listener `http2ProtocolOptions` (ListenerPolicy and HTTPListenerPolicy) that maps to Envoy's HttpConnectionManager `http2_protocol_options.allow_connect`. This is required to handle WebSocket-over-HTTP/2 (RFC 8441 Extended CONNECT) when the listener advertises h2 in its ALPN. Without it, user agents that use Extended CONNECT (e.g. Firefox) fail to establish WebSocket connections because Envoy does not translate Extended CONNECT to an HTTP/1.1 Upgrade against the upstream. Fixes kgateway-dev#14305 Signed-off-by: RAJVEER42 <[email protected]>
gateway-bot
added
do-not-merge/kind-invalid
gateway-bot
added
kind/feature
Contributor
There was a problem hiding this comment.
Pull request overview
Adds support for WebSocket-over-HTTP/2 (RFC 8441 Extended CONNECT) by exposing Envoy HCM http2_protocol_options.allow_connect through kgateway listener policy APIs, and wiring it into the listenerpolicy translation path.
Changes:
- Added
allowConnecttoListenerHTTP2ProtocolOptions(used by ListenerPolicy and HTTPListenerPolicy). - Wired
allowConnectthroughtranslateHttp2ProtocolOptionsto EnvoyHttp2ProtocolOptions.AllowConnect. - Regenerated CRD schemas/deepcopy and updated golden translator test inputs/outputs to cover the new field.
Reviewed changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/kgateway/extensions2/plugins/listenerpolicy/http.go | Maps ListenerHTTP2ProtocolOptions.AllowConnect into Envoy Http2ProtocolOptions.AllowConnect. |
| api/v1alpha1/kgateway/listener_policy_types.go | Adds the new AllowConnect *bool API field with documentation. |
| api/v1alpha1/kgateway/zz_generated.deepcopy.go | Regenerates deepcopy to include AllowConnect. |
| install/helm/kgateway-crds/templates/gateway.kgateway.dev_listenerpolicies.yaml | Regenerates ListenerPolicy CRD schema to include allowConnect. |
| install/helm/kgateway-crds/templates/gateway.kgateway.dev_httplistenerpolicies.yaml | Regenerates HTTPListenerPolicy CRD schema to include allowConnect. |
| pkg/kgateway/translator/gateway/testutils/inputs/listener-policy-http/http2-protocol-options.yaml | Updates golden test input to set allowConnect: true. |
| pkg/kgateway/translator/gateway/testutils/inputs/httplistenerpolicy/http2-protocol-options.yaml | Updates golden test input to set allowConnect: true. |
| pkg/kgateway/translator/gateway/testutils/outputs/listener-policy-http/http2-protocol-options.yaml | Updates golden output to show http2ProtocolOptions.allowConnect: true in generated HCM config. |
| pkg/kgateway/translator/gateway/testutils/outputs/httplistenerpolicy/http2-protocol-options.yaml | Updates golden output to show http2ProtocolOptions.allowConnect: true in generated HCM config. |
Files not reviewed (1)
- api/v1alpha1/kgateway/zz_generated.deepcopy.go: Generated file
davidjumani
approved these changes
Jul 13, 2026
davidjumani
enabled auto-merge
July 13, 2026 16:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Envoy's HCM
http2_protocol_options.allow_connect: trueis required to handle WebSocket-over-HTTP/2 (RFC 8441 Extended CONNECT). Without it, when a listener advertisesh2in ALPN, user agents that use Extended CONNECT (e.g. Firefox) send an Extended CONNECT that Envoy does not translate to an HTTP/1.1Upgradeagainst the upstream, so the upstream returns426 missing Upgrade header. (Chrome happens to work because it falls back to a separate HTTP/1.1 connection for the WebSocket; Firefox does not.)Previously the listener
http2ProtocolOptionsexposed onlyinitialStreamWindowSize,initialConnectionWindowSize, andmaxConcurrentStreams, so there was no way to enableallow_connectthrough any kgateway CRD.This adds an
allowConnectfield to the listenerhttp2ProtocolOptions(used by bothListenerPolicyandHTTPListenerPolicy) and maps it to Envoy'sHttpConnectionManager.http2_protocol_options.allow_connect.Example:
Fixes #14305
Change Type
/kind new_feature
Changelog
Additional Notes
ListenerHTTP2ProtocolOptions(api/v1alpha1/kgateway/listener_policy_types.go); CRDs and deepcopy regenerated viamake generate.pkg/kgateway/extensions2/plugins/listenerpolicy/http.go.ListenerPolicyandHTTPListenerPolicy.Http2ProtocolOptionsis unchanged.