apache / apache/apisix

bug: HTTP2 protocol not working when ApisixUpstream scheme is set to https

Open
#13,002 6 comments 1 reaction 0 assignees View on GitHub
feature-request
Dominant language
Lua
Stars
17.1k
Forks
2.9k
Avg merge
3d 16h
Merged PRs (30d)
63

Description

### Issue Description

HTTP2 protocol is not working when `ApisixUpstream` spec `scheme` is set to `https`. The upstream connection does not utilize HTTP2 even though the backend service supports it.

### Current Behavior

- ApisixUpstream is configured with `scheme: https`
- HTTP2 protocol is not being used for upstream connections
- Traffic defaults to HTTP/1.1 instead of HTTP2
- No HTTP2 negotiation occurs despite backend service supporting HTTP2

### Expected Behavior

When `scheme: https` is configured in ApisixUpstream, APISIX should automatically negotiate and use HTTP2 protocol for upstream connections if the backend service supports it via ALPN (Application-Layer Protocol Negotiation).

### Error Logs

- No specific errors

### Steps to Reproduce

1. Create an ApisixUpstream resource with `scheme: https`
2. Configure a backend service that supports HTTP2 over TLS
3. Send requests through APISIX to the upstream
4. Observe protocol being used (HTTP/1.1 instead of HTTP2)

### Configuration Example

```yaml
apiVersion: apisix.apache.org/v2
kind: ApisixUpstream
metadata:
name: example-apisixupstream
spec:
scheme: https
discovery:
type: kubernetes
serviceName: namespace/service-name:http
retries: 0
timeout:
connect: 150s
send: 150s
read: 150s
```

### Environment

- APISIX version (run `apisix version`): 3.13.0
- Operating system (run `uname -a`): Linux apisix-data-plane-567765b759-6np8s 6.8.0-87-generic #88~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Oct 14 14:03:14 UTC 2 x86_64 GNU/Linux
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`): nginx version: openresty/1.27.1.2 built with OpenSSL 3.4.1 11 Feb 2025
- etcd version, if relevant (run `curl [http://127.0.0.1:9090/v1/server_info`):](http://127.0.0.1:9090/v1/server_info%60):) 3.6.0
- APISIX Dashboard version, if relevant: 3.0.1
- Plugin runner version, for issues related to plugin runners:
- LuaRocks version, for installation issues (run `luarocks --version`): 3.12.0

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the supplied ApisixUpstream configuration with scheme: https and a backend that supports HTTP/2 over TLS. Trace how this setting reaches the upstream TLS and ALPN configuration, then verify that supported backends negotiate HTTP/2 while other HTTPS upstreams continue to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes, lua, nginx
Domain
api, backend, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.