feat(interceptor): add HTTP/2 h2c support for cleartext connections by starlightromero · Pull Request #1394 · kedacore/http-add-on

starlightromero · 2025-12-11T23:36:43Z

Description

This PR adds HTTP/2 cleartext (h2c) protocol support to the interceptor proxy server, enabling AWS Application Load Balancers and other clients to communicate using HTTP/2 over plain HTTP.

Changes

Wrapped non-TLS handlers with to support HTTP/2 cleartext connections
Added dependency golang.org/x/net/http2 for h2c support
Comprehensive test coverage in pkg/http/h2c_test.go for both HTTP/1.1 and HTTP/2 h2c
HTTP/1.1 clients continue to work without any changes

Motivation

When using the AWS Load Balancer Controller Gateway API implementation, setting appProtocol: kubernetes.io/h2c on a Kubernetes Service instructs the controller to create ALB target groups with ProtocolVersion: HTTP2. However, the KEDA HTTP Add-on interceptor did not support h2c, causing health checks and traffic to fail.

This change enables:

ALB → Interceptor communication using HTTP/2 for improved performance
Support for appProtocol: kubernetes.io/h2c on Kubernetes Services
Better efficiency with HTTP/2 multiplexing and header compression

How It Works

The implementation wraps non-TLS handlers with h2c.NewHandler, which automatically:

Handles HTTP/2 connections with prior knowledge (what ALBs use)
Falls back to HTTP/1.1 for standard requests
Requires no configuration changes in Kubernetes manifests

TLS connections remain unchanged and continue to use native HTTP/2 over TLS.

Testing

✅ All existing unit tests pass
✅ New test TestHTTP2H2CSupport validates both HTTP/1.1 and HTTP/2 h2c functionality
✅ Tested in live cluster with AWS ALB successfully using HTTP/2 target groups

Checklist

Commits are signed (DCO)
Tests pass locally (make test)
Code follows project style (pre-commit checks)
Backwards compatible with HTTP/1.1
Documentation included in commit message

Fixes #1397

Enable HTTP/2 cleartext (h2c) protocol support for non-TLS connections in the interceptor proxy server. This allows AWS Application Load Balancers and other clients to communicate with the interceptor using HTTP/2 over plain HTTP. When tlsConfig is nil, the handler is wrapped with h2c.NewHandler to support both HTTP/2 prior knowledge and HTTP/1.1 connections. TLS connections remain unchanged and continue to support native HTTP/2 over TLS. This change enables the use of appProtocol: kubernetes.io/h2c on Kubernetes Services, which instructs the AWS Load Balancer Controller to create target groups with ProtocolVersion: HTTP2 for improved performance and efficiency. Changes: - Wrap non-TLS handlers with h2c.NewHandler in pkg/http/server.go - Add golang.org/x/net/http2 dependency for h2c support - Add comprehensive test coverage for both HTTP/1.1 and HTTP/2 h2c - Maintain backwards compatibility with HTTP/1.1 clients Fixes: Enables HTTP/2 h2c support from ALB to interceptor pods Signed-off-by: Starlight Romero <[email protected]>

snyk-io · 2025-12-11T23:36:55Z

⚠️ Snyk checks are incomplete.

Status	Scanner	Critical	High	Medium	Low	Total (0)
⚠️	Open Source Security	0	0	0	0	See details

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

linkvt

Hi @starlightromero ,

thanks for the PR! I left a few comments but also think that we would benefit from a written design in an issue here in the repo - at least in my opinion.

I'm not a maintainer of this project though.

linkvt · 2025-12-12T08:14:39Z

pkg/http/server.go

+	if tlsConfig == nil {
+		h2s := &http2.Server{}
+		hdl = h2c.NewHandler(hdl, h2s)
+	}


golang has HTTP2 support for server and clients in its standard library, they added it quite recently: https://go.dev/doc/go1.24#nethttppkgnethttp

I would prefer using that over the extended standard library as they already plan to deprecate the golang.org/x/net/http2/client subpackage: golang/go#72039

linkvt · 2025-12-12T08:18:07Z

pkg/http/server.go

 		Handler:   hdl,
 		Addr:      addr,
 		TLSConfig: tlsConfig,
 	}


How do we handle:

HTTP1 connections to services responding with h2c

h2c connections to services responding with HTTP1?

linkvt · 2025-12-12T08:21:01Z

pkg/http/h2c_test.go

+				DialTLS: func(network, addr string, cfg *tls.Config) (net.Conn, error) {
+					// Use standard dialer for h2c (cleartext HTTP/2)
+					return net.Dial(network, addr)
+				},


Is this actually needed/used during an non HTTPS request?

linkvt · 2025-12-12T08:35:34Z

pkg/http/h2c_test.go

+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	serverAddr := "127.0.0.1:18888"


I think we should not expect a specific port on a system to be free for us to use during a test. I know that the httptest package can pick a selected port, not sure if we can use it here, but maybe there is another way to get a port thats always free to use.

linkvt · 2025-12-12T08:38:03Z

pkg/http/h2c_test.go

@@ -0,0 +1,90 @@
+package http


IMO we should have e2e tests covering the different scenarios here (client uses http1/h2c, user application supports http1/h2c/both) as unit tests would not cover all cases.

Copilot

Pull request overview

This PR adds HTTP/2 cleartext (h2c) protocol support to the KEDA HTTP Add-on interceptor proxy server, enabling AWS Application Load Balancers and other clients to communicate using HTTP/2 over plain HTTP connections. This addresses the compatibility issue when using appProtocol: kubernetes.io/h2c on Kubernetes Services with AWS Load Balancer Controller.

Changes:

Added h2c support by wrapping non-TLS handlers with golang.org/x/net/http2/h2c package
Introduced comprehensive test coverage for both HTTP/1.1 and HTTP/2 h2c protocols
Updated dependency golang.org/x/net to support h2c functionality

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.

File	Description
pkg/http/server.go	Wraps non-TLS handlers with h2c.NewHandler to enable HTTP/2 cleartext support while preserving HTTP/1.1 compatibility
pkg/http/h2c_test.go	New test file validating both HTTP/1.1 and HTTP/2 h2c protocol handling
go.mod	Updates golang.org/x/net dependency and related transitive dependencies to support h2c
go.sum	Checksums for updated dependencies

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-12T13:39:47Z

pkg/http/h2c_test.go

+		}
+		defer resp.Body.Close()
+
+		body, _ := io.ReadAll(resp.Body)


The test ignores errors from ReadAll. While this is in a test and the error is unlikely, it's better to be consistent with error handling. Consider checking the error or using an explicit underscore to indicate intentional ignoring.

Copilot · 2026-01-12T13:39:47Z

pkg/http/h2c_test.go

+		}
+		defer resp.Body.Close()
+
+		body, _ := io.ReadAll(resp.Body)


The test ignores errors from ReadAll. While this is in a test and the error is unlikely, it's better to be consistent with error handling. Consider checking the error or using an explicit underscore to indicate intentional ignoring.

Copilot · 2026-01-12T13:39:48Z

pkg/http/h2c_test.go

+	// Wait for server to start
+	time.Sleep(500 * time.Millisecond)


Using a hardcoded sleep to wait for server startup is flaky and can cause intermittent test failures. Consider using a retry loop with a timeout to check if the server is accepting connections, or implement a readiness signal from the server goroutine.

linkvt requested changes Dec 12, 2025

View reviewed changes

This was referenced Dec 12, 2025

Design Document: HTTP/2 h2c Support for AWS ALB Integration (PR #1394) #1396

Closed

Design Document: HTTP/2 h2c Support Implementation (PR #1394) #1397

Closed

wozniakjan requested review from Copilot and wozniakjan January 12, 2026 13:34

Copilot started reviewing on behalf of wozniakjan January 12, 2026 13:35 View session

Copilot AI reviewed Jan 12, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(interceptor): add HTTP/2 h2c support for cleartext connections#1394

feat(interceptor): add HTTP/2 h2c support for cleartext connections#1394
starlightromero wants to merge 1 commit intokedacore:mainfrom
starlightromero:feat/http2-h2c-support

starlightromero commented Dec 11, 2025 •

edited

Loading

Uh oh!

snyk-io bot commented Dec 11, 2025

Uh oh!

linkvt left a comment

Uh oh!

linkvt Dec 12, 2025

Uh oh!

linkvt Dec 12, 2025

Uh oh!

linkvt Dec 12, 2025

Uh oh!

linkvt Dec 12, 2025

Uh oh!

linkvt Dec 12, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 12, 2026

Uh oh!

Copilot AI Jan 12, 2026

Uh oh!

Copilot AI Jan 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		// Wait for server to start
		time.Sleep(500 * time.Millisecond)

Conversation

starlightromero commented Dec 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Motivation

How It Works

Testing

Checklist

Uh oh!

snyk-io bot commented Dec 11, 2025

⚠️ Snyk checks are incomplete.

Uh oh!

linkvt left a comment

Choose a reason for hiding this comment

Uh oh!

linkvt Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

linkvt Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

linkvt Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

linkvt Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

linkvt Dec 12, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

starlightromero commented Dec 11, 2025 •

edited

Loading