Alibaba Cloud Service Mesh：在入口網關側HTTPS中禁用HTTP/2

前提條件

• 已添加叢集到ASM執行個體。

• 已通過ASM網關啟用HTTPS安全服務。

步驟一：確認預設配置

執行以下命令，訪問ASM網關，驗證當前的ALPN協議最終使用HTTP/2。

curl -k -H Host:b.aliyun.com --resolve b.aliyun.com:443:${ASM網關IP地址}  https://b.aliyun.com/status/418 -v

預期輸出：

* Added b.aliyun.com:443:8.217.xxx xxx to DNS cache
* Hostname b.aliyun.com was found in DNS cache
*   Trying 8.217.xxx xxx:443...
* Connected to b.aliyun.com (8.217.xxx xxx) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=aliyun.com; O=myexample organization
*  start date: Apr 10 08:23:54 2023 GMT
*  expire date: Apr  9 08:23:54 2024 GMT
*  issuer: O=myexample Inc.; CN=aliyun.com
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/2
* h2 [:method: HEAD]
* h2 [:scheme: https]
* h2 [:authority: b.aliyun.com]
* h2 [:path: /status/418]
* h2 [user-agent: curl/8.1.2]
* h2 [accept: */*]
* Using Stream ID: 1 (easy handle 0x12e80d600)
> HEAD /status/418 HTTP/2
> Host:b.aliyun.com
> User-Agent: curl/8.1.2
> Accept: */*
>
< HTTP/2 418
HTTP/2 418
< server: istio-envoy
server: istio-envoy
< date: Thu, 14 Sep 2023 08:23:25 GMT
date: Thu, 14 Sep 2023 08:23:25 GMT
< access-control-allow-origin: *
access-control-allow-origin: *
< x-more-info: http://tools.ietf.org/html/rfc2324
x-more-info: http://tools.ietf.org/html/rfc2324
< access-control-allow-credentials: true
access-control-allow-credentials: true
< content-length: 135
content-length: 135
< x-envoy-upstream-service-time: 5
x-envoy-upstream-service-time: 5

預期輸出表明用戶端提供的ALPN列表有HTTP/2和HTTP/1.1。預設情況下，網關優先使用HTTP/2。

步驟二：在使用HTTPS協議時，禁用HTTP/2

1. 登入ASM控制台，在左側導覽列，選擇服務網格 > 網格管理。

2. 在網格管理頁面，單擊目標執行個體名稱，然後在左側導覽列，選擇ASM網關 > 入口網關。

3. 在入口網關頁面，找到目標網關，單擊操作列的查看YAML，在編輯對話方塊的spec欄位下，配置podAnnotations，然後單擊確定。

   podAnnotations:
       proxy.istio.io/config: |
         httpsHttp2Disabled: true

   說明

   該配置會導致網關重啟。

步驟三：驗證HTTP/2是否在HTTPS中被禁用

執行以下命令，訪問ASM網關。

curl -k -H Host:b.aliyun.com --resolve b.aliyun.com:443:${ASM網關IP地址}  https://b.aliyun.com/status/418 -v

預期輸出：

* Added b.aliyun.com:443:8.217.xxx.xxx  to DNS cache
* Hostname b.aliyun.com was found in DNS cache
*   Trying 8.217.xxx.xxx:443...
* Connected to b.aliyun.com (8.217.xxx.xxx) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted http/1.1
* Server certificate:
*   subject: CN=aliyun.com; O=myexample organization
*   start date: Apr 10 08:23:54 2023 GMT
*   expire date: Apr  9 08:23:54 2024 GMT
*   issuer: O=myexample Inc.; CN=aliyun.com
*   SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/1.1
> HEAD /status/418 HTTP/1.1
> Host:b.aliyun.com
> User-Agent: curl/8.1.2
> Accept: */*
>
< HTTP/1.1 418 Unknown
HTTP/1.1 418 Unknown
< server: istio-envoy
server: istio-envoy
< date: Thu, 14 Sep 2023 08:20:13 GMT
date: Thu, 14 Sep 2023 08:20:13 GMT
< access-control-allow-origin: *
access-control-allow-origin: *
< x-more-info: http://tools.ietf.org/html/rfc2324
x-more-info: http://tools.ietf.org/html/rfc2324
< access-control-allow-credentials: true
access-control-allow-credentials: true
< content-length: 135
content-length: 135
< x-envoy-upstream-service-time: 1
x-envoy-upstream-service-time: 1

預期輸出表明服務端接受的ALPN協議為HTTP/1.1，HTTP/2禁用成功。