add http2 for insecure port

internal/ingress/annotations/annotations.go

@@ -19,6 +19,7 @@ package annotations
 import (
 	"github.com/imdario/mergo"
 	"k8s.io/ingress-nginx/internal/ingress/annotations/canary"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/http2insecureport"
 	"k8s.io/ingress-nginx/internal/ingress/annotations/modsecurity"
 	"k8s.io/ingress-nginx/internal/ingress/annotations/proxyssl"
 	"k8s.io/ingress-nginx/internal/ingress/annotations/sslcipher"
@@ -113,6 +114,7 @@ type Ingress struct {
 	InfluxDB           influxdb.Config
 	ModSecurity        modsecurity.Config
 	Mirror             mirror.Config
+	HTTP2InsecurePort  bool
 }
 
 // Extractor defines the annotation parsers to be used in the extraction of annotations
@@ -162,6 +164,7 @@ func NewAnnotationExtractor(cfg resolver.Resolver) Extractor {
 			"BackendProtocol":      backendprotocol.NewParser(cfg),
 			"ModSecurity":          modsecurity.NewParser(cfg),
 			"Mirror":               mirror.NewParser(cfg),
+			"HTTP2InsecurePort":    http2insecureport.NewParser(cfg),
 		},
 	}
 }

internal/ingress/annotations/http2insecureport/main.go

@@ -0,0 +1,38 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package http2insecureport
+
+import (
+	networking "k8s.io/api/networking/v1beta1"
+
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
+)
+
+type http2InsecurePort struct {
+}
+
+// NewParser creates a new default backend annotation parser
+func NewParser(_ resolver.Resolver) parser.IngressAnnotation {
+	return http2InsecurePort{}
+}
+
+// Parse parses the annotations contained in the ingress to use
+// a custom default backend
+func (h http2InsecurePort) Parse(ing *networking.Ingress) (interface{}, error) {
+	return parser.GetBoolAnnotation("http2-insecure-port", ing)
+}

internal/ingress/controller/controller.go

@@ -1051,8 +1051,9 @@ func (n *NGINXController) createServers(data []*ingress.Ingress,
 				Locations: []*ingress.Location{
 					loc,
 				},
-				SSLPassthrough: anns.SSLPassthrough,
-				SSLCiphers:     anns.SSLCiphers,
+				SSLPassthrough:    anns.SSLPassthrough,
+				SSLCiphers:        anns.SSLCiphers,
+				HTTP2InsecurePort: anns.HTTP2InsecurePort,
 			}
 		}
 	}

internal/ingress/controller/template/template.go

@@ -1122,7 +1122,7 @@ func shouldLoadModSecurityModule(c interface{}, s interface{}) bool {
 	return false
 }
 
-func buildHTTPListener(t interface{}, s interface{}) string {
+func buildHTTPListener(t interface{}, s interface{}, h interface{}) string {
 	var out []string
 
 	tc, ok := t.(config.TemplateConfig)
@@ -1137,14 +1137,20 @@ func buildHTTPListener(t interface{}, s interface{}) string {
 		return ""
 	}
 
+	http2InsecurePort, ok := h.(bool)
+	if !ok {
+		klog.Errorf("expected a 'bool' type but %T was returned", h)
+		return ""
+	}
+
 	addrV4 := []string{""}
 	if len(tc.Cfg.BindAddressIpv4) > 0 {
 		addrV4 = tc.Cfg.BindAddressIpv4
 	}
 
 	co := commonListenOptions(tc, hostname)
 
-	out = append(out, httpListener(addrV4, co, tc)...)
+	out = append(out, httpListener(addrV4, co, tc, http2InsecurePort)...)
 
 	if !tc.IsIPV6Enabled {
 		return strings.Join(out, "\n")
@@ -1155,7 +1161,7 @@ func buildHTTPListener(t interface{}, s interface{}) string {
 		addrV6 = tc.Cfg.BindAddressIpv6
 	}
 
-	out = append(out, httpListener(addrV6, co, tc)...)
+	out = append(out, httpListener(addrV6, co, tc, http2InsecurePort)...)
 
 	return strings.Join(out, "\n")
 }
@@ -1222,7 +1228,7 @@ func commonListenOptions(template config.TemplateConfig, hostname string) string
 	return strings.Join(out, " ")
 }
 
-func httpListener(addresses []string, co string, tc config.TemplateConfig) []string {
+func httpListener(addresses []string, co string, tc config.TemplateConfig, http2InsecurePort bool) []string {
 	out := make([]string, 0)
 	for _, address := range addresses {
 		l := make([]string, 0)
@@ -1235,6 +1241,11 @@ func httpListener(addresses []string, co string, tc config.TemplateConfig) []str
 		}
 
 		l = append(l, co)
+
+		if http2InsecurePort {
+			l = append(l, "http2")
+		}
+
 		l = append(l, ";")
 		out = append(out, strings.Join(l, " "))
 	}

internal/ingress/types.go

@@ -202,6 +202,9 @@ type Server struct {
 	SSLCiphers string `json:"sslCiphers,omitempty"`
 	// AuthTLSError contains the reason why the access to a server should be denied
 	AuthTLSError string `json:"authTLSError,omitempty"`
+	// Whether use HTTP2 for default listening port
+	// +optinal
+	HTTP2InsecurePort bool `json:"http2InsecurePort,omitempty"`
 }
 
 // Location describes an URI inside a server.

rootfs/etc/nginx/template/nginx.tmpl

@@ -518,7 +518,7 @@ http {
     server {
         server_name {{ $redirect.From }};
 
-        {{ buildHTTPListener  $all $redirect.From }}
+        {{ buildHTTPListener  $all $redirect.From false }}
         {{ buildHTTPSListener $all $redirect.From }}
 
         ssl_certificate_by_lua_block {
@@ -824,7 +824,7 @@ stream {
         {{ $all := .First }}
         {{ $server := .Second }}
 
-        {{ buildHTTPListener  $all $server.Hostname }}
+        {{ buildHTTPListener  $all $server.Hostname $server.HTTP2InsecurePort }}
         {{ buildHTTPSListener $all $server.Hostname }}
 
         set $proxy_upstream_name "-";