NETOBSERV-1369: Disable http/2

bundle/manifests/netobserv-operator.clusterserviceversion.yaml

@@ -930,9 +930,10 @@ spec:
                 - --upstream=http://127.0.0.1:8080/
                 - --logtostderr=true
                 - --v=10
+                - --http2-disable
                 - --tls-cert-file=/etc/tls/private/tls.crt
                 - --tls-private-key-file=/etc/tls/private/tls.key
-                image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
+                image: gcr.io/kubebuilder/kube-rbac-proxy:v0.15.0
                 name: kube-rbac-proxy
                 ports:
                 - containerPort: 8443

config/default/manager_auth_proxy_patch.yaml

@@ -18,12 +18,13 @@ spec:
         - "--flowlogs-pipeline-image=$(RELATED_IMAGE_FLOWLOGS_PIPELINE)"
         - "--console-plugin-image=$(RELATED_IMAGE_CONSOLE_PLUGIN)"
       - name: kube-rbac-proxy
-        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
+        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.15.0
         args:
           - "--secure-listen-address=0.0.0.0:8443"
           - "--upstream=http://127.0.0.1:8080/"
           - "--logtostderr=true"
           - "--v=10"
+          - "--http2-disable"
         ports:
           - containerPort: 8443
             protocol: TCP

config/manager/manager.yaml

@@ -64,12 +64,13 @@ spec:
             cpu: 100m
             memory: 100Mi
       - name: kube-rbac-proxy
-        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
+        image: gcr.io/kubebuilder/kube-rbac-proxy:v0.15.0
         args:
           - "--secure-listen-address=0.0.0.0:8443"
           - "--upstream=http://127.0.0.1:8080/"
           - "--logtostderr=true"
           - "--v=10"
+          - "--http2-disable"
         ports:
           - containerPort: 8443
             protocol: TCP

controllers/consoleplugin/consoleplugin_objects.go

@@ -271,6 +271,7 @@ func (b *builder) podTemplate(cmDigest string) *corev1.PodTemplateSpec {
 				Resources:       *b.desired.ConsolePlugin.Resources.DeepCopy(),
 				VolumeMounts:    b.volumes.AppendMounts(volumeMounts),
 				Args:            args,
+				Env:             []corev1.EnvVar{constants.EnvNoHTTP2},
 			}},
 			Volumes:            b.volumes.AppendVolumes(volumes),
 			ServiceAccountName: constants.PluginName,

controllers/constants/constants.go

@@ -1,7 +1,10 @@
 // Package constants defines some values that are shared across multiple packages
 package constants
 
-import "k8s.io/apimachinery/pkg/types"
+import (
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
 
 const (
 	DefaultOperatorNamespace = "netobserv"
@@ -40,3 +43,7 @@ const (
 var LokiIndexFields = []string{"SrcK8S_Namespace", "SrcK8S_OwnerName", "SrcK8S_Type", "DstK8S_Namespace", "DstK8S_OwnerName", "DstK8S_Type", "FlowDirection", "Duplicate"}
 var LokiConnectionIndexFields = []string{"_RecordType"}
 var FlowCollectorName = types.NamespacedName{Name: "cluster"}
+var EnvNoHTTP2 = corev1.EnvVar{
+	Name:  "GODEBUG",
+	Value: "http2server=0",
+}

controllers/flowcollector_controller_test.go

@@ -335,7 +335,7 @@ func flowCollectorControllerSpecs() {
 					Protocol:      "UDP",
 				}))
 				Expect(cnt.Env).To(Equal([]v1.EnvVar{
-					{Name: "GOGC", Value: "400"}, {Name: "GOMAXPROCS", Value: "33"},
+					{Name: "GOGC", Value: "400"}, {Name: "GOMAXPROCS", Value: "33"}, {Name: "GODEBUG", Value: "http2server=0"},
 				}))
 			})
 

controllers/flowlogspipeline/flp_common_objects.go

@@ -178,6 +178,7 @@ func (b *builder) podTemplate(hasHostPort, hostNetwork bool, annotations map[str
 	for _, pair := range helper.KeySorted(b.desired.Processor.Debug.Env) {
 		envs = append(envs, corev1.EnvVar{Name: pair[0], Value: pair[1]})
 	}
+	envs = append(envs, constants.EnvNoHTTP2)
 
 	container := corev1.Container{
 		Name:            constants.FLPName,

main.go

@@ -18,6 +18,7 @@ package main
 
 import (
 	"context"
+	"crypto/tls"
 	"flag"
 	"fmt"
 	_ "net/http/pprof"
@@ -81,6 +82,7 @@ func main() {
 	var enableLeaderElection bool
 	var probeAddr string
 	var pprofAddr string
+	var enableHTTP2 bool
 	var versionFlag bool
 
 	config := operator.Config{}
@@ -95,6 +97,7 @@ func main() {
 	flag.StringVar(&config.FlowlogsPipelineImage, "flowlogs-pipeline-image", "quay.io/netobserv/flowlogs-pipeline:main", "The image of Flowlogs Pipeline")
 	flag.StringVar(&config.ConsolePluginImage, "console-plugin-image", "quay.io/netobserv/network-observability-console-plugin:main", "The image of the Console Plugin")
 	flag.BoolVar(&config.DownstreamDeployment, "downstream-deployment", false, "Either this deployment is a downstream deployment ot not")
+	flag.BoolVar(&enableHTTP2, "enable-http2", enableHTTP2, "If HTTP/2 should be enabled for the metrics and webhook servers.")
 	flag.BoolVar(&versionFlag, "v", false, "print version")
 	opts := zap.Options{
 		Development: true,
@@ -117,13 +120,22 @@ func main() {
 		os.Exit(1)
 	}
 
+	disableHTTP2 := func(c *tls.Config) {
+		if enableHTTP2 {
+			return
+		}
+		c.NextProtos = []string{"http/1.1"}
+	}
+
 	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
 		Scheme: scheme,
 		Metrics: server.Options{
 			BindAddress: metricsAddr,
+			TLSOpts:     []func(*tls.Config){disableHTTP2},
 		},
 		WebhookServer: webhook.NewServer(webhook.Options{
-			Port: 9443,
+			Port:    9443,
+			TLSOpts: []func(*tls.Config){disableHTTP2},
 		}),
 		PprofBindAddress:       pprofAddr,
 		HealthProbeBindAddress: probeAddr,