Does AGC support HTTP/2 Prior knowledge mode?

Question

Does AGC support HTTP/2 Prior knowledge mode?

Kamil Grebenicek 60

Hi,

I aim to configure SSL offloading on AGC (Application Gateway for Containers) and communicate between the AGC and our GRPC backend services in cleartext. Since GRPC requires HTTP/2 for communication, I effectively need h2c (HTTP/2 over cleartext) on the upstream/backend side. Our GRPC services are written in ASP.NET Core and run on Kestrel. According to the Kestrel documentation, to accept h2c I need to set HTTP/2 as the endpoint protocol, and the client must support the Prior knowledge mode.

Gateway API introduced the appProtocol field, which can be set to kubernetes.io/h2c on a K8s service resource. If I understand its purpose correctly, it's supposed to solve the use case.

https://gateway-api.sigs.k8s.io/guides/backend-protocol/

The question is whether AGC currently either respects the appProtocol field or supports HTTP/2 Prior knowledge mode in another way.

Thank you.

Kamil Grebenicek 60 Reputation points

2025-04-09T06:51:32.9766667+00:00

Exactly, I'm asking if AGC can talk to backend gRPC services over plain HTTP/2, but I don't rely on the Kubernetes appProtocol: kubernetes.io/h2c setting. After many trials, I still cannot make it work. I believe the last missing piece of the puzzle is the Prior knowledge mode, as mentioned in the Kestrel documentation and its support by the AGC.
Arko 4,180 Reputation points Moderator

2025-04-09T06:58:01.2066667+00:00

That is correct. ASP.NET Core's Kestrel server can only accept HTTP/2 over cleartext (h2c) if the client uses Prior Knowledge mode, as documented in the Kestrel HttpProtocols.Http2 docs.

As I mentioned earlier, Azure Application Gateway for Containers (AGC) does not support HTTP/2 Prior Knowledge mode (h2c) for backend communication. AGC currently only supports:

HTTP/1.1 to backends

HTTP/2 over TLS to backends (with ALPN)

and TLS termination at the gateway

It does not support HTTP/2 over cleartext (h2c) which means Kestrel endpoints configured with Protocols = HttpProtocols.Http2 and no TLS will reject the connection, since the required Prior Knowledge handshake isn’t initiated.
Kamil Grebenicek 60 Reputation points

2025-04-09T07:16:02.0433333+00:00

Got it. Thank you for the reply, Argo.

One more question. Do you have any idea whether the h2c support is on the AGC roadmap?
Arko 4,180 Reputation points Moderator

2025-04-10T07:09:36.17+00:00

As of now, AGC does not support HTTP/2 cleartext (h2c) for backend communication. While AGC can handle HTTP/2 traffic from clients, it only forwards traffic to backends over HTTP/1.1 or HTTP/2 with TLS (via ALPN). Support for h2c where HTTP/2 is used without TLS is currently not available. As for future support, there is no official documentation or public roadmap indicating that h2c support is planned.
Arko 4,180 Reputation points Moderator

2025-04-10T07:11:11.15+00:00

Hello Kamil Grebenicek, hopefully I was able to clear your queries. Converting my comments to answer for you to accept it for anyone having similar query on this community to refer to the same. Thanks

Answer accepted by question author

0 additional answers

Your answer

Kamil Grebenicek 60 Reputation points

2025-04-09T06:51:32.9766667+00:00

Exactly, I'm asking if AGC can talk to backend gRPC services over plain HTTP/2, but I don't rely on the Kubernetes appProtocol: kubernetes.io/h2c setting. After many trials, I still cannot make it work. I believe the last missing piece of the puzzle is the Prior knowledge mode, as mentioned in the Kestrel documentation and its support by the AGC.
Arko 4,180 Reputation points Moderator

2025-04-09T06:58:01.2066667+00:00

That is correct. ASP.NET Core's Kestrel server can only accept HTTP/2 over cleartext (h2c) if the client uses Prior Knowledge mode, as documented in the Kestrel HttpProtocols.Http2 docs.

As I mentioned earlier, Azure Application Gateway for Containers (AGC) does not support HTTP/2 Prior Knowledge mode (h2c) for backend communication. AGC currently only supports:

HTTP/1.1 to backends

HTTP/2 over TLS to backends (with ALPN)

and TLS termination at the gateway

It does not support HTTP/2 over cleartext (h2c) which means Kestrel endpoints configured with Protocols = HttpProtocols.Http2 and no TLS will reject the connection, since the required Prior Knowledge handshake isn’t initiated.
Kamil Grebenicek 60 Reputation points

2025-04-09T07:16:02.0433333+00:00

Got it. Thank you for the reply, Argo.

One more question. Do you have any idea whether the h2c support is on the AGC roadmap?
Arko 4,180 Reputation points Moderator

2025-04-10T07:09:36.17+00:00

As of now, AGC does not support HTTP/2 cleartext (h2c) for backend communication. While AGC can handle HTTP/2 traffic from clients, it only forwards traffic to backends over HTTP/1.1 or HTTP/2 with TLS (via ALPN). Support for h2c where HTTP/2 is used without TLS is currently not available. As for future support, there is no official documentation or public roadmap indicating that h2c support is planned.
Arko 4,180 Reputation points Moderator

2025-04-10T07:11:11.15+00:00

Hello Kamil Grebenicek, hopefully I was able to clear your queries. Converting my comments to answer for you to accept it for anyone having similar query on this community to refer to the same. Thanks

Answer 1

Hello Kamil Grebenicek, if I am understanding your question correctly you are asking if AGC can talk to backend gRPC services over plain HTTP/2 (h2c), and does it support the Kubernetes appProtocol: kubernetes.io/h2c setting?

if so then as of now, Azure Application Gateway for Containers (AGC) does not officially document support for HTTP/2 Prior Knowledge mode (h2c) for upstream (backend) communication.

While AGC does support gRPC, which operates over HTTP/2, the Microsoft documentation only references gRPC support through the Gateway API and GRPCRoute resources-

"gRPC is only supported using Gateway API for Application Gateway for Containers."

checkout this document- Microsoft Docs: gRPC on AGC

enter image description here

However, the AGC documentation does not currently mention support for HTTP/2 Prior Knowledge mode (h2c) or for Kubernetes appProtocol (let's say appProtocol: kubernetes.io/h2c)

Even though the Kubernetes Gateway API documentation defines the appProtocol (including kubernetes.io/h2c) for indicating HTTP/2, AGC's implementation has not yet advertised conformance or support for this capability.

If your scenario requires cleartext HTTP/2 (h2c) to backend ASP.NET Core (Kestrel) services, you may need to place an intermediary (like an Envoy or NGINX proxy) that can handle TLS from AGC and speak h2c to Kestrel.