Title: fix(operator): Set appProtocol: grpc on registry gRPC Service by tmvfb · Pull Request #6367 · feast-dev/feast · GitHub
Open Graph Title: fix(operator): Set appProtocol: grpc on registry gRPC Service by tmvfb · Pull Request #6367 · feast-dev/feast
X Title: fix(operator): Set appProtocol: grpc on registry gRPC Service by tmvfb · Pull Request #6367 · feast-dev/feast
Description: Summary The registry Service (the use case is local registry + server.grpc enabled, i.e. SQLite) is always created with name: http and no appProtocol. This causes service meshes (notably Istio) to misclassify the registry gRPC traffic as HTTP/1.1, breaking connections in two places simultaneously: Client-side envoy: sees name: http → downgrades to HTTP/1.1. gRPC requires HTTP/2. Server-side envoy: builds its inbound listener for the registry port as HTTP/1.1 → receives gRPC (HTTP/2) frames → sends RST with "protocol error". Both failures stem from the same missing field. The fix is minimal: set appProtocol: grpc on the registry gRPC Service port. Changes Added getServiceAppProtocol helper that returns ptr.To("grpc") for the registry gRPC Service and nil for all other services. Set AppProtocol on the ServicePort in setService via this helper. Added k8s.io/utils/ptr import to services.go (already a transitive dependency, used in tests). Effect With appProtocol: grpc set, Istio and other service meshes correctly identify the port as gRPC and handle HTTP/2 and mTLS normally, no workarounds required. Testing go vet ./internal/... passes. Existing operator unit tests are unaffected (they assert on port number and name, not appProtocol). Manual verification on a cluster with Istio sidecar injection confirmed gRPC connectivity works end-to-end after this change with no additional mesh configuration. Workaround Client-side envoy downgrades to HTTP/1.1. Fixed by creating an alt-Service with appProtocol: grpc. Server-side envoy builds its inbound listener for port 6570 as HTTP/1.1 and rejects incoming HTTP/2 with a protocol error. The only workaround is traffic.sidecar.istio.io/excludeInboundPorts: "6570" on the feast-server pod to bypass it entirely. With the server-side envoy bypassed there is nothing to terminate mTLS, so a DestinationRule with tls: DISABLE is also required to stop the client from attempting it.
Open Graph Description: Summary The registry Service (the use case is local registry + server.grpc enabled, i.e. SQLite) is always created with name: http and no appProtocol. This causes service meshes (notably Istio) to ...
X Description: Summary The registry Service (the use case is local registry + server.grpc enabled, i.e. SQLite) is always created with name: http and no appProtocol. This causes service meshes (notably Istio) to ...
Opengraph URL: https://github.com/feast-dev/feast/pull/6367
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:de39c647-ceea-d8ff-fa86-960c8671dc07 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | AB70:3EE845:1F29B1F:2AB34C1:6A4EC0E8 |
| html-safe-nonce | 82a4bf6de715ba167a340081a62c90ee05fd25abf7ff9927da7ffa1e753045ce |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJBQjcwOjNFRTg0NToxRjI5QjFGOjJBQjM0QzE6NkE0RUMwRTgiLCJ2aXNpdG9yX2lkIjoiODIwMjQ5OTA5NzM4ODU2NDcxMyIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | 83fbf3faa79bac2ea4c4a316a5d306d42daa7bef2c3afe3d8167b774fa3df4a2 |
| hovercard-subject-tag | pull_request:3630052918 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/feast-dev/feast/pull/6367/files |
| twitter:image | https://avatars.githubusercontent.com/u/116455436?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/116455436?s=400&v=4 |
| og:image:alt | Summary The registry Service (the use case is local registry + server.grpc enabled, i.e. SQLite) is always created with name: http and no appProtocol. This causes service meshes (notably Istio) to ... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 41b6ab3ba6d20a71766ac245b5a4a94c6fc672a9cd4da7d44c1b33ab8bf6a21c |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/feast-dev/feast git https://github.com/feast-dev/feast.git |
| octolytics-dimension-user_id | 57027613 |
| octolytics-dimension-user_login | feast-dev |
| octolytics-dimension-repository_id | 161133770 |
| octolytics-dimension-repository_nwo | feast-dev/feast |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 161133770 |
| octolytics-dimension-repository_network_root_nwo | feast-dev/feast |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | e6a744804e8e70f97b4d5a18a94dcc63db22f97a |
| ui-target | canary-2 |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width