服务网格 ASM：在入口网关侧HTTPS中禁用HTTP/2

前提条件

• 已添加集群到ASM实例。

• 已通过ASM网关启用HTTPS安全服务。

步骤一：确认默认配置

执行以下命令，访问ASM网关，验证当前的ALPN协议最终使用HTTP/2。

curl -k -H Host:b.aliyun.com --resolve b.aliyun.com:443:${ASM网关IP地址}  https://b.aliyun.com/status/418 -v

预期输出：

* Added b.aliyun.com:443:8.217.xxx xxx to DNS cache
* Hostname b.aliyun.com was found in DNS cache
*   Trying 8.217.xxx xxx:443...
* Connected to b.aliyun.com (8.217.xxx xxx) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=aliyun.com; O=myexample organization
*  start date: Apr 10 08:23:54 2023 GMT
*  expire date: Apr  9 08:23:54 2024 GMT
*  issuer: O=myexample Inc.; CN=aliyun.com
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/2
* h2 [:method: HEAD]
* h2 [:scheme: https]
* h2 [:authority: b.aliyun.com]
* h2 [:path: /status/418]
* h2 [user-agent: curl/8.1.2]
* h2 [accept: */*]
* Using Stream ID: 1 (easy handle 0x12e80d600)
> HEAD /status/418 HTTP/2
> Host:b.aliyun.com
> User-Agent: curl/8.1.2
> Accept: */*
>
< HTTP/2 418
HTTP/2 418
< server: istio-envoy
server: istio-envoy
< date: Thu, 14 Sep 2023 08:23:25 GMT
date: Thu, 14 Sep 2023 08:23:25 GMT
< access-control-allow-origin: *
access-control-allow-origin: *
< x-more-info: http://tools.ietf.org/html/rfc2324
x-more-info: http://tools.ietf.org/html/rfc2324
< access-control-allow-credentials: true
access-control-allow-credentials: true
< content-length: 135
content-length: 135
< x-envoy-upstream-service-time: 5
x-envoy-upstream-service-time: 5

预期输出表明客户端提供的ALPN列表有HTTP/2和HTTP/1.1。默认情况下，网关优先使用HTTP/2。

步骤二：在使用HTTPS协议时，禁用HTTP/2

1. 登录ASM控制台，在左侧导航栏，选择服务网格 > 网格管理。

2. 在网格管理页面，单击目标实例名称，然后在左侧导航栏，选择ASM网关 > 入口网关。

3. 在入口网关页面，找到目标网关，单击操作列的查看YAML，在编辑对话框的spec字段下，配置podAnnotations，然后单击确定。

   podAnnotations:
       proxy.istio.io/config: |
         httpsHttp2Disabled: true

   说明

   该配置会导致网关重启。

步骤三：验证HTTP/2是否在HTTPS中被禁用

执行以下命令，访问ASM网关。

curl -k -H Host:b.aliyun.com --resolve b.aliyun.com:443:${ASM网关IP地址}  https://b.aliyun.com/status/418 -v

预期输出：

* Added b.aliyun.com:443:8.217.xxx.xxx  to DNS cache
* Hostname b.aliyun.com was found in DNS cache
*   Trying 8.217.xxx.xxx:443...
* Connected to b.aliyun.com (8.217.xxx.xxx) port 443 (#0)
* ALPN: offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted http/1.1
* Server certificate:
*   subject: CN=aliyun.com; O=myexample organization
*   start date: Apr 10 08:23:54 2023 GMT
*   expire date: Apr  9 08:23:54 2024 GMT
*   issuer: O=myexample Inc.; CN=aliyun.com
*   SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/1.1
> HEAD /status/418 HTTP/1.1
> Host:b.aliyun.com
> User-Agent: curl/8.1.2
> Accept: */*
>
< HTTP/1.1 418 Unknown
HTTP/1.1 418 Unknown
< server: istio-envoy
server: istio-envoy
< date: Thu, 14 Sep 2023 08:20:13 GMT
date: Thu, 14 Sep 2023 08:20:13 GMT
< access-control-allow-origin: *
access-control-allow-origin: *
< x-more-info: http://tools.ietf.org/html/rfc2324
x-more-info: http://tools.ietf.org/html/rfc2324
< access-control-allow-credentials: true
access-control-allow-credentials: true
< content-length: 135
content-length: 135
< x-envoy-upstream-service-time: 1
x-envoy-upstream-service-time: 1

预期输出表明服务端接受的ALPN协议为HTTP/1.1，HTTP/2禁用成功。