CODEWITHSUNDEEP
kuberneteshttp2grpc-javatls1.3telepresence
sharathchandra.ck
sharathchandra.ck

Reputation: 165

HTTP/2 client preface string missing or corrupt for gRPC client in Kubernetes making call to local service using Telepresence

I am trying to prepare an environment for Integration testing of the Springboot application running inside Kubernetes cluster. I am using Telepresence which intercepts the traffic(gRPC APIs) in Kubernetes cluster to route it to locally running application in my IDE(IntelliJ). Springboot application in Kubernetes is listening to gRPC calls on port 9090, and exposes via a ClusterIP service. I am trying to intercept gRPC traffic to this application running in Kubernetes, and route it to locally running application which listens on port 9095, using the below Telepresence intercept command

telepresence intercept service-name --namespace=ns --port 9095:9090 --env-file C:\Users\SC1063\telepresence\env_files\intercept-config.env

My local application on receiving the gRPC call is throwing the following exception

io.grpc.netty.shaded.io.netty.handler.codec.http2.Http2Exception: HTTP/2 client preface string missing or corrupt. Hex dump for received bytes: 1603010200010001fc0303ffd1d5efdfb5771b509014337a

From the question Spring boot + GRPC Http2Exception I understand, call from client application running in Kubernetes is trying to secure the communication using TLS. Whereas, the non-intercepted gRPC calls within kubernetes is working without any problem. Application environment uses Istio for service mesh.

Error observed in the client logs

 upstream connect error or disconnect/reset before headers. retried and the latest reset reason: connection failure, transport failure reason: TLS error: 268435703:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER]

Upvotes: 1

Views: 4016

Answers (1)

sharathchandra.ck
sharathchandra.ck

Reputation: 165

Root cause for the issue is, client is applying TLS before sending the request to server, whereas server is expecting PLAINTEXT. Istio service mesh secures external outbound traffic (traffic flowing outside K8s cluster) with TLS unless DISABLED. Create Istio destinationrule CRD which is utilized by envoy proxy to DISABLE TLS while routing the traffic

spec:
  trafficPolicy:
  tls:
    mode: DISABLE

Upvotes: 0

Related Questions