Support Application-Layer Protocol negotiation via nextProtos flag in tlsconfig

[davidkydd]

Allows fallback based on protocol availability and support for custom protocols securely over TLS.

ptal:
@roidelapluie
@gotjosh
@ArthurSens

[roidelapluie]

I don't think we want that. What is your use case?

[roidelapluie]

I don't think we want that. What is your use case?

[davidkydd]

we want to use ALPN protocols to identify certain scraping traffic routing through the APIServer, for a similar use case as konnectivity supports it: https://github.com/kubernetes-sigs/apiserver-network-proxy/blob/e4d5a2d64d0b5b7a28d73be99c34ae924190f2fa/cmd/agent/app/options/options.go#L117C2-L117C252

Its a generic capability so would likely have other uses - for example there is an open issue unrelated to our scenario here: prometheus/blackbox_exporter#870

[phealy]

To clarify David's post a bit - envoy can route traffic differently based on ALPN header and it's a good way to identify traffic or route connections without needing extra IPs or TLS decryption.

[phealy]

This has a lot of the same potential cases as being able to set server_name in the tls_config, though that can also be used for cert validation.

[roidelapluie]

How is it different than setting enable_http2: false?

[phealy]

How is it different than setting enable_http2: false?

Setting http2 to false will change the ALPN header from something like "h2c,h2,http1.1" to just "http1.1". This PR instead lets us add extra things in there - for example, we could set it to "metrics,h2c,h2,http1.1", then use an envoy filter looking for the word "metrics" in the ALPN value to route the traffic on a VIP to the metrics destination instead of the default destination. Since that value is in cleartext in TLSClientHello, it's another nice way to route encrypted traffic without having to decrypt/reencrypt.

[phealy]

@roidelapluie Here's a graphic that might make the idea clearer. The basic use case is traffic routing when you're not terminating TLS, based on something other than SNI. We have firewall restrictions that make adding extra public IPs or hostnames (which would be needed for SNI) difficult, so this is a way to route traffic without needing any of that.