Support ServiceImport AppProtocol parsing

internal/gatewayapi/route.go

@@ -1407,11 +1407,9 @@ func (t *Translator) processServiceImportDestinationSetting(
 		}
 	}
 
-	// TODO(#5485): Should these protocols be supported for ServiceImport?
-	//
-	// if servicePort.AppProtocol != nil {
-	// 	protocol = serviceAppProtocolToIRAppProtocol(*servicePort.AppProtocol)
-	// }
+	if servicePort.AppProtocol != nil {
+		protocol = serviceAppProtocolToIRAppProtocol(*servicePort.AppProtocol, protocol, false)
+	}
 
 	// Route to endpoints by default
 	if !t.IsEnvoyServiceRouting(envoyProxy) {
@@ -1458,7 +1456,7 @@ func (t *Translator) processServiceDestinationSetting(
 
 	// support HTTPRouteBackendProtocolH2C/GRPC
 	if servicePort.AppProtocol != nil {
-		protocol = serviceAppProtocolToIRAppProtocol(*servicePort.AppProtocol, protocol)
+		protocol = serviceAppProtocolToIRAppProtocol(*servicePort.AppProtocol, protocol, true)
 	}
 
 	// Route to endpoints by default
@@ -1848,11 +1846,15 @@ func (t *Translator) processBackendDestinationSetting(name string, backendRef gw
 	return ds
 }
 
-func serviceAppProtocolToIRAppProtocol(ap string, defaultProtocol ir.AppProtocol) ir.AppProtocol {
-	switch ap {
-	case "kubernetes.io/h2c":
+// serviceAppProtocolToIRAppProtocol translates the appProtocol string into an ir.AppProtocol.
+//
+// When grpcCompatibility is enabled, `grpc` will be parsed as a valid option for HTTP2.
+// See https://github.com/envoyproxy/gateway/issues/5485#issuecomment-2731322578.
+func serviceAppProtocolToIRAppProtocol(ap string, defaultProtocol ir.AppProtocol, grpcCompatibility bool) ir.AppProtocol {
+	switch {
+	case ap == "kubernetes.io/h2c":
 		return ir.HTTP2
-	case "grpc":
+	case ap == "grpc" && grpcCompatibility:
 		return ir.GRPC
 	default:
 		return defaultProtocol

internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.in.yaml

@@ -35,6 +35,11 @@ httpRoutes:
               name: service-import-1
               namespace: default
               port: 8080
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-1
+              namespace: default
+              port: 9000
 
 referenceGrants:
   - apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -64,6 +69,11 @@ serviceImports:
         - port: 8080
           name: http
           protocol: TCP
+          appProtocol: kubernetes.io/h2c  # This takes effect.
+        - port: 9000
+          name: grpc
+          protocol: TCP
+          appProtocol: grpc  # This is NOOP.
 
 endpointSlices:
   - apiVersion: discovery.k8s.io/v1
@@ -78,6 +88,9 @@ endpointSlices:
       - name: http
         protocol: TCP
         port: 8080
+      - name: grpc
+        protocol: TCP
+        port: 9000
     endpoints:
       - addresses:
           - "10.244.0.11"
@@ -95,6 +108,10 @@ backendTLSPolicies:
           kind: ServiceImport
           name: service-import-1
           sectionName: http
+        - group: multicluster.x-k8s.io
+          kind: ServiceImport
+          name: service-import-1
+          sectionName: grpc
       validation:
         wellKnownCACertificates: System
         hostname: example.com

internal/gatewayapi/testdata/backendtlspolicy-serviceimport-target.out.yaml

@@ -11,6 +11,10 @@ backendTLSPolicies:
       kind: ServiceImport
       name: service-import-1
       sectionName: http
+    - group: multicluster.x-k8s.io
+      kind: ServiceImport
+      name: service-import-1
+      sectionName: grpc
     validation:
       hostname: example.com
       wellKnownCACertificates: System
@@ -87,6 +91,11 @@ httpRoutes:
         name: service-import-1
         namespace: default
         port: 8080
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-1
+        namespace: default
+        port: 9000
       matches:
       - path:
           type: Exact
@@ -150,6 +159,15 @@ xdsIR:
           name: httproute/envoy-gateway/httproute-btls/rule/0
           settings:
           - name: httproute/envoy-gateway/httproute-btls/rule/0/backend/0
+            protocol: HTTP2
+            tls:
+              alpnProtocols: null
+              caCertificate:
+                name: policy-btls/default-ca
+              sni: example.com
+              useSystemTrustStore: true
+            weight: 1
+          - name: httproute/envoy-gateway/httproute-btls/rule/0/backend/1
             protocol: HTTP
             tls:
               alpnProtocols: null

release-notes/current.yaml

@@ -23,6 +23,7 @@ new features: |
   Added support for HTTP Methods and Headers based authorization in SecurityPolicy
   Added support for zone aware routing
   Added support for BackendTLSPolicy to target ServiceImport
+  Added support for kubernetes.io/h2c application protocol in ServiceImport
   Added support for per-host circuit breaker thresholds
   Added support for egctl Websocket in addation to SPDY
   Added a configuration option in the Helm chart to set the TrafficDistribution field in the Envoy Gateway Service