title: How to route from Istio Gateway HTTPS to HTTP2 Service?
body: <p>I'm trying to receive a request through HTTPS (with TLS termination) and forwarding to a http2 api. Previously my api worked as HTTP 1.1 and now I upgraded his code to work with HTTP2 (plain text).</p>
  <p>When I do a curl from another pod inside the cluster, everything works fine with HTTP2.0 But coming from the Gateway it doesn't. I get HTTP/2.0 503 everytime (upstream connect error or disconnect/reset before headers. reset reason: remote reset).</p>
  <pre><code>apiVersion: networking.istio.io/v1beta1
  kind: Gateway
  metadata:
  name: my-gateway
  namespace: default
  spec:
    selector:
      istio: ingressgateway
    servers:
    - hosts:
      - myhost.localhost
      port:
        name: http
        number: 80
        protocol: HTTP
      tls:
        httpsRedirect: true
    - hosts:
      - myhost.localhost
      port:
        name: https
        number: 443
        protocol: HTTPS
      tls:
        credentialName: myhost-tls
        mode: SIMPLE
  ---
  apiVersion: networking.istio.io/v1beta1
  kind: VirtualService
  metadata:
    name: my-api-gateway
    namespace: default
  spec:
    gateways:
    - my-gateway
    hosts:
    - '*'
    http:
    - match:
      - uri:
          prefix: /dev/my/
      rewrite:
        uri: /
      route:
      - destination:
          host: my-api
          port:
            number: 80
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: my-api
    namespace: default
  spec:
    ports:
    - name: http2
      port: 80
      protocol: TCP
      targetPort: 80
    selector:
      app: my-api
    type: ClusterIP
  </code></pre>
  <p>This is my log from istio-ingressgateway:</p>
  <pre><code>[2022-05-23T19:38:58.026Z] &quot;GET /dev/my/version HTTP/2&quot; 503 URX via_upstream - &quot;-&quot; 0 85 73 73 &quot;10.244.5.0&quot; &quot;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Edg/101.0.1210.47&quot; &quot;3c497583-62cc-4b35-b64d-7410ad24e8bb&quot; &quot;myhost.localhost&quot; &quot;10.244.5.35:80&quot; outbound|80||my-api.default.svc.cluster.local 10.244.3.160:37342 10.244.3.160:8443 10.244.5.0:14107 myhost.localhost -
  </code></pre>
  <p>And this is from envoy-proxy in my-api pod sidecar:</p>
  <pre><code>[2022-05-23T19:43:57.195Z] &quot;GET /dev/my/version HTTP/2&quot; 503 UR upstream_reset_before_response_started{remote_reset} - &quot;-&quot; 0 85 1 - &quot;10.244.3.1&quot; &quot;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Edg/101.0.1210.47&quot; &quot;9d8d54b7-0683-42b4-bcd3-2725aa31c09e&quot; &quot;myhost.localhost&quot; &quot;10.244.5.35:80&quot; inbound|80|| 127.0.0.6:50447 10.244.5.35:80 10.244.3.1:0 outbound_.80_._.my-api.default.svc.cluster.local default
  </code></pre>
  <p>Currently using istio 1.13.4</p>