gRPC HTTP/1.1 reverse bridge

This is a filter that enables converting an incoming gRPC request into a HTTP/1.1 request to allow a server that does not understand HTTP/2 or gRPC semantics to handle the request.

The filter works by:

  • Checking the content type of the incoming request. If it’s a gRPC request, the filter is enabled.

  • The content type is modified to a configurable value. This can be a noop by configuring application/grpc.

  • The gRPC frame header is optionally stripped from the request body. The content length header will be adjusted if so.

  • On receiving a response, the content type of the response is validated and the status code is mapped to a grpc-status which is inserted into the response trailers.

  • The response body is optionally prefixed by the gRPC frame header, again adjusting the content length header if necessary.

Due to being mapped to HTTP/1.1, this filter will only work with unary gRPC calls.

gRPC frame header management

By setting the withhold_grpc_frame option, the filter will assume that the upstream does not understand any gRPC semantics and will convert the request body into a simple binary encoding of the request body and perform the reverse conversion on the response body. This ends up simplifying the server side handling of these requests, as they no longer need to be concerned with parsing and generating gRPC formatted data.

This works by stripping the gRPC frame header from the request body, while injecting a gRPC frame header in the response.

If this feature is not used, the upstream must be ready to receive HTTP/1.1 requests prefixed with the gRPC frame header and respond with gRPC formatted responses.

How to disable HTTP/1.1 reverse bridge filter per route

  1. admin:
  2.   access_log_path: /dev/stdout
  3.   address:
  4.     socket_address:
  5.       address: 0.0.0.0
  6.       port_value: 9901
  7. static_resources:
  8.   listeners:
  9.   - name: listener_0
  10.     address:
  11.       socket_address:
  12.         address: 0.0.0.0
  13.         port_value: 80
  14.     filter_chains:
  15.     - filters:
  16.       - name: envoy.filters.network.http_connection_manager
  17.         typed_config:
  18.           "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
  19.           access_log:
  20.           - name: envoy.access_loggers.file
  21.             typed_config:
  22.               "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
  23.               path: /dev/stdout
  24.           stat_prefix: ingress_http
  25.           route_config:
  26.             name: local_route
  27.             virtual_hosts:
  28.             - name: local_service
  29.               domains: ["*"]
  30.               routes:
  31.               - match:
  32.                   prefix: "/route-with-filter-disabled"
  33.                 route:
  34.                   host_rewrite: localhost
  35.                   cluster: grpc
  36.                   timeout: 5.00s
  37.                 # per_filter_config disables the filter for this route
  38.                 typed_per_filter_config:
  39.                   envoy.filters.http.grpc_http1_reverse_bridge:
  40.                     "@type": type.googleapis.com/envoy.extensions.filters.http.grpc_http1_reverse_bridge.v3.FilterConfigPerRoute
  41.                     disabled: true
  42.               - match:
  43.                   prefix: "/route-with-filter-enabled"
  44.                 route:
  45.                   host_rewrite: localhost
  46.                   cluster: other
  47.                   timeout: 5.00s
  48.           http_filters:
  49.           - name: envoy.filters.http.grpc_http1_reverse_bridge
  50.             typed_config:
  51.               "@type": type.googleapis.com/envoy.extensions.filters.http.grpc_http1_reverse_bridge.v3.FilterConfig
  52.               content_type: application/grpc+proto
  53.               withhold_grpc_frames: true
  54.           - name: envoy.filters.http.router
  55.             typed_config: {}
  56.   clusters:
  57.   - name: other
  58.     connect_timeout: 5.00s
  59.     type: LOGICAL_DNS
  60.     dns_lookup_family: V4_ONLY
  61.     lb_policy: ROUND_ROBIN
  62.     load_assignment:
  63.       cluster_name: some_service
  64.       endpoints:
  65.         - lb_endpoints:
  66.           - endpoint:
  67.               address:
  68.                 socket_address:
  69.                   address: localhost
  70.                   port_value: 4630
  71.   - name: grpc
  72.     connect_timeout: 5.00s
  73.     type: strict_dns
  74.     lb_policy: round_robin
  75.     http2_protocol_options: {}
  76.     load_assignment:
  77.       cluster_name: grpc
  78.       endpoints:
  79.         - lb_endpoints:
  80.             - endpoint:
  81.                 address:
  82.                   socket_address:
  83.                     address: localhost
  84.                     port_value: 10005