Add KEP-5999 for HTTP/2 cleartext (h2c) container probes#6000
Add KEP-5999 for HTTP/2 cleartext (h2c) container probes#6000amritansh1502 wants to merge 1 commit intokubernetes:masterfrom
Conversation
amritansh1502
commented
Apr 7, 2026
amritansh1502
commented
- One-line PR description: Add support for HTTP/2 cleartext (h2c) on container httpGet probes.
- Issue link:HTTP/2 cleartext (h2c) for container probes #5999
- Other comments:
k8s-ci-robot
added
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: amritansh1502 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Welcome @amritansh1502! |
k8s-ci-robot
added
the
needs-ok-to-test
|
Hi @amritansh1502. Thanks for your PR. I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
kind/kep
| participating-sigs: [] | ||
| status: provisional | ||
| creation-date: 2026-04-07 | ||
| reviewers: [] |
There was a problem hiding this comment.
added you for sig node , waiting for sig network reviewers to reply.
| status: provisional | ||
| creation-date: 2026-04-07 | ||
| reviewers: [] | ||
| approvers: [] |
There was a problem hiding this comment.
it will be either mrunal or dawn for alpha stage: https://github.com/kubernetes/community/blob/main/sig-node/CONTRIBUTING.md#scaling-up-kep-approvers
|
|
||
| # Provisional gate name — rename to match implementation after SIG/API agreement. | ||
| feature-gates: | ||
|
|
There was a problem hiding this comment.
add a feature gate that will be used
There was a problem hiding this comment.
thanks, added feature gate
| HTTP/2” setup. The KEP defines an opt-in API and kubelet behavior and resolves | ||
| up front whether to extend httpGet or add a new probe type, including the | ||
| option to apply gRPC-style constraints (numeric port only, no host override) to | ||
| avoid known pitfalls with httpGet today. |
There was a problem hiding this comment.
this section is not needed in summary. It is for alternative options or to the implementation details section.
There was a problem hiding this comment.
this comment is specifically for this sentence:
and resolves
up front whether to extend httpGet or add a new probe type, including the
option to apply gRPC-style constraints (numeric port only, no host override) to
avoid known pitfalls with httpGet today.
There was a problem hiding this comment.
modifed the summary according to your review
| [kubernetes/kubernetes]: https://git.k8s.io/kubernetes | ||
| [kubernetes/website]: https://git.k8s.io/website | ||
|
|
||
| ## Summary |
There was a problem hiding this comment.
add some notes in summary on adoption of h2c and maturity of specs
| exposed through Ingress and does not return sensitive data. Where that is too | ||
| heavy, teams sometimes use tcpSocket, which does not assert a valid HTTP | ||
| response. A declarative, opt-in h2c probe removes that tax and aligns probes | ||
| with how the app actually speaks HTTP on the wire. The API shape (extend httpGet |
There was a problem hiding this comment.
same comment. Motivation should cover the popularity and stability of a protocol, not the fact that API shape needs to be designed early. Part of API design will be based on adoption and other protocols we may want to support
There was a problem hiding this comment.
modified the motivation section also
| option to apply gRPC-style constraints (numeric port only, no host override) to | ||
| avoid known pitfalls with httpGet today. | ||
|
|
||
| ## Motivation |
There was a problem hiding this comment.
in case of gRPC, one of the selling factors was that gRPC dependency is already in kubelet and will never disappear.
This KEP will introduce a new dependency. If we see any other components adopting h2c or any other motivations why kubelet should have this dependency, it will help with this KEP motivation.
(basically in motivation we need to answer the question on why h2c is so special that it needs to be built-in instead of just relying on exec probes)
| relying on a second HTTP/1.1-only listener or a tcpSocket probe for that case. | ||
|
|
||
|
|
||
| 1. **Option A: Extend httpGet** with an explicit way to request h2c while |
There was a problem hiding this comment.
list pros and cons for both options as well as the shape of API in both cases
There was a problem hiding this comment.
i have added api shape in both cases and also pros and cons for both cases.
amritansh1502
force-pushed
the
kep-h2c-probes
branch
from
87c6690 to
78785ef
Compare
k8s-ci-robot
added
size/XXL
amritansh1502
force-pushed
the
kep-h2c-probes
branch
from
78785ef to
7dc9b9b
Compare
3 participants
