Missing TLS protocol option for ExtensionServiceSpec

[arthurlm]

I am trying to create an extension service using TLS protocol option as it is explain in doc:

contour/apis/projectcontour/v1alpha1/extensionservice.go

Line 80 in da72199

// Values may be tls, h2, h2c. If omitted, protocol-selection falls back on Service annotations.

However it is not available in spec:

contour/apis/projectcontour/v1alpha1/extensionservice.go

Line 83 in da72199

// +kubebuilder:validation:Enum=h2;h2c

And it does not work using service annotation: projectcontour.io/upstream-protocol.tls: 9443

Is it possible to add missing protocol option ? Or should we remove tls option from doc ?

[stevesloka]

Hey @arthurlm, what are you looking to use the ExtensionService for?

Right now Contour utilizes that for gRPC services for External Authentication as well as RateLimiting, which are all done over h2 or h2c. But the idea was to make it a generic service integration point so I'm curious what you're trying to setup.

[arthurlm]

Hi @stevesloka,
I am trying to do an External Authentication service using gRPC.

However, for now it does not work because my HTTP2 server failed on parsing authority header field.
See this issue: hyperium/h2#525
This is why I was trying to use tls protocol option.

Please note that gRPC and HTTP2 are still quite new to me.
So probably using HTTP1 for gRPC is not possible and this option in the doc is the source of my misunderstanding.