[HTTP Option support] Deprecate httpProtocol: "Disabled" in config-network

[nak3]

As per design doc https://docs.google.com/document/d/1yVOGo-j1hI7oCpuWVIi5iBJwX1wKbOzWaV0QNJxCbaY/edit#

Note that we will not support Disabled at least in the beginning because it may break HTTP01 challenge of auto TLS feature.

It has a plan to make "Disabled" unsupported.

Also, Disable should be possible by stop exposing :80.

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

[dprotaso]

Curious - rather than deprecating it can we figure out a solution/workaround for http-01 challenges?

ie. looking at https://letsencrypt.org/docs/challenge-types/#http-01-challenge could we just allow HTTP for URLs of the form? http://<YOUR_DOMAIN>/.well-known/acme-challenge/<TOKEN>

[dprotaso]

I guess http-01 is still supported with redirects

Our implementation of the HTTP-01 challenge follows redirects, up to 10 redirects deep. It only accepts redirects to “http:” or “https:”, and only to ports 80 or 443. It does not accept redirects to IP addresses.

[nak3]

@ZhiminXiang ^ Do you have any thoughts?

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

[dprotaso]

bump @ZhiminXiang since he's back

cc @carlisia

[ZhiminXiang]

We will still support "Redirect" and "Enabled". So HTTP01 challenge will work for those two scenarios.

For "Disabled", technically we can support it with only allowing http01 challenge URL (at least for Istio).

But from KIngress API's perspective, I am concerned that

1. Allowing HTTP01 challenge URL when HTTP is "Disabled" is implicit and a bit confusing for client to be aware.
2. I am not sure if the all of the downstream KIngress implementations support allowlisting HTTP01 URL or not.
3. I am not sure if this behavior aligns with k8s Gateway API.

Is there any reason why we want to support "Disabled"?

[nak3]

@dprotaso @carlisia @ZhiminXiang Is there any update on this?
(Either support or non-support for Disabled is fine me.)

[almottier]

Any update on this 🙏 ?

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

[dprotaso]

We should sort this out

/lifecycle frozen