Description:
Envoy Gateway currently sets OverlappingTLSConfig and downgrades ALPN to HTTP/1.1 when HTTPS listeners are considered overlapping based on listener hostname configuration, even when the certificates attached to those listeners are disjoint.
This is overly conservative.
The HTTP/2 connection coalescing concern described in GEP-3567 is fundamentally tied to certificate validity across multiple origins. If two HTTPS listeners do not have overlapping certificate SANs, then the coalescing risk does not appear to exist, even if the listeners are considered overlapping from a hostname-matching perspective.
For example, consider two HTTPS listeners on the same port:
- listener A:
hostname: unset- certificate SANs:
- listener B:
hostname: service.example-b.com- certificate SANs:
In this setup, Envoy Gateway can consider the listeners overlapping because listener A has no hostname.
However, the certificates are disjoint:
- listener A's certificate is not valid for
service.example-b.com
- listener B's certificate is not valid for
*.example-a.com
So the warning may be acceptable, but automatically downgrading ALPN to HTTP/1.1 seems unnecessary because the certificate boundary already prevents the cross-origin reuse that GEP-3567 is concerned with.
Description:
Envoy Gateway currently sets
OverlappingTLSConfigand downgrades ALPN toHTTP/1.1when HTTPS listeners are considered overlapping based on listener hostname configuration, even when the certificates attached to those listeners are disjoint.This is overly conservative.
The HTTP/2 connection coalescing concern described in GEP-3567 is fundamentally tied to certificate validity across multiple origins. If two HTTPS listeners do not have overlapping certificate SANs, then the coalescing risk does not appear to exist, even if the listeners are considered overlapping from a hostname-matching perspective.
For example, consider two HTTPS listeners on the same port:
hostname: unset*.example-a.comhostname:service.example-b.comservice.example-b.comIn this setup, Envoy Gateway can consider the listeners overlapping because listener A has no
hostname.However, the certificates are disjoint:
service.example-b.com*.example-a.comSo the warning may be acceptable, but automatically downgrading ALPN to
HTTP/1.1seems unnecessary because the certificate boundary already prevents the cross-origin reuse that GEP-3567 is concerned with.