gRPC and content security policy (mixed content)

I'm trying to resolve the issue with frontend (next.js) served over HTTPS and gRPC via HTTP. The issue is in content security policy. Due to CSP and HTTPS
```
new IdentityServicePromiseClient(`http://...` doesn't work with an error:
`Mixed Content: The page at 'https://.../signup' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://.../api.identity.v1.IdentityService/IdentityCreate'. This request has been blocked; the content must be served over HTTPS.
```
On the other side of the connection there is an Istio with the configuration:
```
port:
name: grpc-web-server
protocol: GRPC
number: 50051
```
Istio doesn't support gRPC over TLS, only HTTP (which makes sense).

Any idea how to pass through CSP?