ingress: add h2c_upstream annotation

[wasaga]

Summary

Pomerium core supports plaintext HTTP/2 upstreams via the h2c:// scheme in route to URLs, but Ingress resources had no way to request it: the controller builds to URLs from Service/Endpoints and picks the scheme itself.

• Add an ingress.pomerium.io/h2c_upstream: "true" annotation, modeled on secure_upstream, that emits h2c:// upstream URLs.
• Reject h2c_upstream when combined with secure_upstream (or ssh_upstream / tcp_upstream / udp_upstream), since the schemes are mutually exclusive per route and core would otherwise silently degrade mixed lists to HTTP/1.1.
• Consolidate the scheme-annotation list into a single ordered table shared by scheme selection and validation. Existing precedence among the older annotations is unchanged.

Example

metadata:
  annotations:
    ingress.pomerium.io/h2c_upstream: "true"

Combining it with secure_upstream fails with:

annotations: ingress.pomerium.io/h2c_upstream and ingress.pomerium.io/secure_upstream are mutually exclusive

Test plan

• make test (envtest + pomerium/ctrl) passes
• golangci-lint run ./... clean
• New table cases in TestEndpointsHTTPS for h2c:// endpoint URLs
• New TestH2CUpstreamConflicts covering all four conflicting annotation pairs

Documentation PR: pomerium/documentation#2361

[greptile-apps]

Greptile Summary

This PR adds plaintext HTTP/2 upstream support for Ingress routes.

• Adds the h2c_upstream annotation and emits h2c:// service URLs when enabled.
• Rejects h2c when combined with another upstream scheme annotation.
• Consolidates upstream scheme selection into a shared ordered table while preserving legacy precedence.
• Adds endpoint URL and conflict-validation coverage.

Confidence Score: 5/5

The PR appears safe to merge, with h2c URL generation and mutually exclusive scheme handling implemented consistently.

No actionable failures remain: h2c reaches all Ingress service-resolution modes, validation executes before route construction, and legacy scheme precedence is unchanged.

Important Files Changed

Filename	Overview
model/ingress_config.go	Defines the h2c annotation and exposes it through the existing boolean annotation mechanism.
pomerium/ingress_annotations.go	Classifies h2c as an annotation handled during upstream URL construction.
pomerium/ingress_to_route.go	Validates mutually exclusive schemes and selects h2c through a precedence-preserving shared table.
pomerium/routes_test.go	Covers h2c endpoint URL generation and every newly prohibited scheme combination.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Ingress annotations] --> B[validateUpstreamAnnotations]
    B -->|h2c plus another scheme| C[Return validation error]
    B -->|valid combination| D[Build route]
    D --> E[getUpstreamScheme]
    E --> F[Resolve service hosts]
    F --> G[Emit scheme://host URLs]
    G --> H[pb.Route.To]

Loading

_{Reviews (1): Last reviewed commit: "ingress: add h2c_upstream annotation" | Re-trigger Greptile}