Connect-go with Istio

[ymmt2005]

Hello,

We use connect-go almost successfully to multiplex gRPC/gRPC-Web/Connect protocols.
One remaining problem is that when we use connect-go enabled service with Istio,
it cannot work with appProtocol: grpc in their Service.

apiVersion: v1
kind: Service
metadata:
  name: foo
  namespace: bar
spec:
  selector:
    app: foo
  ports:
  - name: grpc-h2c
    port: 8080
    targetPort: connect
    protocol: TCP
    appProtocol: grpc

The client is on the same Kubernetes cluster and connecting the service with gRPC.

        client := foo.NewFooClient(httpClient, "http://foo.bar.svc:8080",
                connect.WithGRPC(),
        )

We only got protoc error no Grpc-Status trailer: unexpected EOF errors.
If we change the above appProtocol: tcp, it works.

Does anyone have any information?

[ymmt2005]

We found the cause.
It was because we didn't create the httpClient as instructed.

As in the doc, we should've created it as:

func newInsecureClient() *http.Client {
  return &http.Client{
    Transport: &http2.Transport{
      AllowHTTP: true,
      DialTLS: func(network, addr string, _ *tls.Config) (net.Conn, error) {
        // If you're also using this client for non-h2c traffic, you may want
        // to delegate to tls.Dial if the network isn't TCP or the addr isn't
        // in an allowlist.
        return net.Dial(network, addr)
      },
      // Don't forget timeouts!
    },
  }
}

https://connectrpc.com/docs/go/deployment#h2c

[akshayjshah]

Glad you found the problem! HTTP/2 without TLS is a little awkward with the current net/http APIs. You may find https://github.com/bufbuild/httplb helpful :)

[ymmt2005]

Thank you.

There's still a question, though.
Although we didn't create the HTTP client correctly, it worked when we didn't use Istio.
I don't understand why.

[akshayjshah]

The connect-go server will also allow gRPC over HTTP/1.1 for request-response RPCs, so it doesn't need HTTP/2. I bet that some portion of Istio simply refuses to handle HTTP/1.1 traffic that uses the gRPC Content-Types.

[ymmt2005]

didn't know that. Thank you!