From c5d1f380d2dad340a8e7e68eabc3a1811d4025dd Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Wed, 6 Dec 2023 13:10:51 -0800 Subject: [PATCH] revert the disabling of http2 for the Supervisor OIDC endpoints Due to the unintended consequence of potentially breaking Ingresses which were configured to use http2 on their backends. --- internal/supervisor/server/server.go | 4 ---- 1 file changed, 4 deletions(-) diff --git a/internal/supervisor/server/server.go b/internal/supervisor/server/server.go index 3d604cc04..c3f519b16 100644 --- a/internal/supervisor/server/server.go +++ b/internal/supervisor/server/server.go @@ -531,10 +531,6 @@ func runSupervisor(ctx context.Context, podInfo *downward.PodInfo, cfg *supervis } c := ptls.Default(nil) - // Remove "h2" from the list for now, until we have a better idea of how to mitigate - // potential http2 rapid reset vulnerabilities. This disables serving requests using http2. - c.NextProtos = []string{"http/1.1"} - c.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) { cert := dynamicTLSCertProvider.GetTLSCert(strings.ToLower(info.ServerName)) foundServerNameCert := cert != nil