Istio TLS origination with IIS external service. How to disable HTTP/2?

[jesse]

I have an external service that I have set up with a ServiceEntry. I would like to shift TLS origination to envoy to get better metrics on the outbound connection.

When I do this, connections always fail with a 503 error. I did a bunch of digging and the issue I am encountering is very similar to the one mentioned at the end of this thread:

Trust custom Root CA on Egress Gateway

I have some more details. The services are running on a IIS Webserver (Windows Server 2016). When I set the SSL option “Client Certificate” to accept or required I get: “503 Service Unavailable” and “upstream connect error or disconnect/reset before headers. reset reason: connection Termination” When I set the SSL option “Client Certificate” to ignore it works. In the docs from Microsoft they state: In a few cases, HTTP/2 can’t be used in combination with other features. In these situation…

The workaround mentioned does not apply, as I already have client certificates set to ignore on IIS. Is there a way to tell Istio to not attempt HTTP2?

“In a few cases, HTTP/2 can’t be used in combination with other features. In these situations, Windows will fall back to HTTP/1.1 and continue the transaction. This may involve negotiating HTTP/1.1 during the handshake, or sending an error code to the client instructing it to retry over an HTTP/1.1 connection.”

[jesse]

Looks like the same issue here:

Cannot reach external service with TLS (using or not an egress gateway)

One more step: the example here now works. I had an old destination rule that was overlapping with others I was installing… Unfortunately, things start to do not work anymore when I try to do the TLS origination in the gateway, following the guide here. When I curl from the sleep pod (my client) to my external service I always get a 503 UC as a reply. Also, I’m trying to understand what each component is supposed to do in the tutorial. Can anybody please explain what this destination rule is…

And I just encountered it with an Adobe endpoint on the web too, also SOAP.
So, apparently any SOAP / IIS endpoint hates the envoy TLS origination. Any ideas would be great!

[jesse]

Ah. Found this. https://github.com/istio/istio/pull/29529
So, apparently this is already a known issue. Guess i’ll just stop using TLS origination for now…

[ragingpastry]

We ran into this issue and ended up disabling HTTP/2 in istio with the following config.

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: disable-alpn-h2
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: FILTER_CHAIN
    match:
      listener:
        filterChain:
          sni: "*.mygateway.com"
    patch:
      operation: MERGE
      value:
        transportSocket:
          name: envoy.transport_sockets.tls
          typedConfig:
            '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
            commonTlsContext:
              alpnProtocols:
                - "http/1.1"
              tlsCertificateSdsSecretConfigs:
                - name: kubernetes://wildcard-cert
                  sdsConfig:
                    ads: {}
                    resourceApiVersion: V3