Support HTTP/2 to upstreams

[ciarams87]

As a DevOps engineer, I want NGF to support proxy_http_version 2 so that I can maintain HTTP/2 connections from clients all the way through to upstream services.

As an application developer, I want my gRPC and HTTP/2-native backends to communicate over HTTP/2 so that I can benefit from multiplexing and header compression end-to-end.

Note: the current http2 -> backend implementation in NGINX does not yet support multiplexing

Implementation:

• Extend the proxy settings policy API to support configuring the proxy http version to 2.
• Note that we currently have proxy_http_version 1.1; hardcoded in our servers template which will need to be modified
• The Gateway API expects that if a Service has appProtocol: kubernetes.io/h2c set, that we forward http2 traffic. Currently, if a Service with this protocol is attached to an HTTPRoute, we mark that backend as invalid. We need to think/design carefully how to set proxy_http_version in this case, because that directive is specified per-location, not per-upstream. Technically a location could proxy pass to multiple upstreams (depending on split_clients or inference_endpoint variables), and each upstream might have different protocols.

Acceptance criteria:

• The ProxySettingsPolicy is extended to allow setting the proxy_http_version to 2
• Unless overwritten by a policy, we need to ensure that if a backend Service is marked with appProtocol: kubernetes.io/h2c, nginx should forward http2 traffic to that service
• The functional tests are extended to test this functionality
• The documentation is extended to cover this functionality

Reference:

• See https://blog.nginx.org/blog/nginx-open-source-1-29-3-and-1-29-4
  and https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_http_version
• https://gateway-api.sigs.k8s.io/guides/backend-protocol/

[sjberman]

There's a Backend H2C conformance test that may suffice for this. This test expects that the appProtocol on the Service is used to determine which protocol to send to.

[sjberman]

Blocked on the release of NGINX Plus R37, due to the base OSS version in R36 not supporting this.