{"id":49374,"date":"2025-05-19T02:13:31","date_gmt":"2025-05-19T02:13:31","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=49374"},"modified":"2025-05-19T02:13:31","modified_gmt":"2025-05-19T02:13:31","slug":"grpc-aws-alb-downgrades-http-2-%e2%86%92-http-1-1","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/grpc-aws-alb-downgrades-http-2-%e2%86%92-http-1-1\/","title":{"rendered":"GRPC: AWS ALB \u201cdowngrades HTTP\/2 \u2192 HTTP\/1.1"},"content":{"rendered":"\n

Excellent question. When we say AWS ALB \u201cdowngrades HTTP\/2 \u2192 HTTP\/1.1\u201d<\/strong>, it means that although the client connects to ALB over HTTP\/2<\/strong>, ALB then connects to your backend (e.g., EKS service or pod) using HTTP\/1.1<\/strong>.<\/p>\n\n\n\n

This causes loss of several core gRPC features<\/strong>, because gRPC requires HTTP\/2 end-to-end<\/strong> to function properly.<\/p>\n\n\n\n

\n\n\n\n

\ud83d\udcc9 What\u2019s Lost During the Downgrade (HTTP\/2 \u2192 HTTP\/1.1)<\/h2>\n\n\n\n
gRPC Feature<\/th>Lost or Broken?<\/th>Why It Matters<\/th><\/tr><\/thead>
Streaming (client\/server\/bidi)<\/strong><\/td>\u274c Lost<\/td>HTTP\/1.1 can\u2019t multiplex or maintain bidirectional streams<\/td><\/tr>
HTTP\/2 Trailers<\/strong><\/td>\u274c Lost<\/td>gRPC uses trailers for grpc-status<\/code>, grpc-message<\/code> \u2192 clients can\u2019t detect errors correctly<\/td><\/tr>
Multiplexing<\/strong><\/td>\u274c Lost<\/td>HTTP\/2 can handle multiple streams over one connection, HTTP\/1.1 cannot<\/td><\/tr>
Header Compression (HPACK)<\/strong><\/td>\u274c Lost<\/td>Increases payload size and latency<\/td><\/tr>
Flow Control per Stream<\/strong><\/td>\u274c Lost<\/td>HTTP\/1.1 has global flow control \u2192 less efficient<\/td><\/tr>
Binary Framing<\/strong><\/td>\u26a0\ufe0f May break<\/td>gRPC uses strict framing over HTTP\/2 \u2192 framing can get corrupted<\/td><\/tr>
gRPC Metadata Headers<\/strong><\/td>\u26a0\ufe0f Incomplete<\/td>Custom headers like grpc-timeout<\/code> may be stripped or altered<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

\u2705 What Gets Passed (But Not Fully gRPC-Compatible)<\/h2>\n\n\n\n
Element<\/th>Passed by ALB?<\/th>Note<\/th><\/tr><\/thead>
HTTP POST<\/strong><\/td>\u2705 Yes<\/td>gRPC uses POST method<\/td><\/tr>
Content-Type<\/strong><\/td>\u2705 Yes<\/td>application\/grpc<\/code> usually retained<\/td><\/tr>
Basic Protobuf Payload<\/strong><\/td>\u26a0\ufe0f Partially<\/td>Still sent, but streaming\/chunking could corrupt it<\/td><\/tr>
TLS Termination<\/strong><\/td>\u2705 Yes<\/td>ALB can terminate TLS and forward plaintext internally<\/td><\/tr>
Status Code (e.g., 200, 500)<\/strong><\/td>\u2705 Basic<\/td>But not the gRPC-specific status like grpc-status<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

\ud83e\udde0 What Happens in Practice?<\/h2>\n\n\n\n

A native gRPC client (e.g., Go, Python, Node) expects:<\/p>\n\n\n\n

    \n
  • Streaming support<\/li>\n\n\n\n
  • grpc-status<\/code> and grpc-message<\/code> in HTTP\/2 trailers<\/li>\n\n\n\n
  • Correct gRPC error handling<\/li>\n<\/ul>\n\n\n\n

    But with ALB in the path:<\/p>\n\n\n\n

      \n
    • Streaming breaks<\/strong> \u2014 long-lived calls are prematurely closed<\/li>\n\n\n\n
    • Status trailers are lost<\/strong> \u2014 client receives only 200 OK<\/code> even on failure<\/li>\n\n\n\n
    • Interceptors and retry logic in gRPC client fail silently<\/strong><\/li>\n<\/ul>\n\n\n\n
      \n\n\n\n

      \ud83d\udd0e Example of Broken gRPC Call via ALB<\/h2>\n\n\n\n

      Expected gRPC Response (over HTTP\/2):<\/h3>\n\n\n
      :status: 200\ncontent-type: application\/grpc\ngrpc-status: 5\ngrpc-message: Not Found\n<\/code><\/span><\/pre>\n\n\n
      ALB Response (after downgrade):<\/h3>\n\n\n
      HTTP\/1.1 200 OK\ncontent-type: application\/grpc\n(no grpc-status trailer!)\n<\/code><\/span><\/pre>\n\n\n
      \n
      Result: gRPC client sees it as success (OK<\/code>), even though the call failed on the server.<\/p>\n<\/blockquote>\n\n\n\n
      \n\n\n\n
      \u2705 Summary Table<\/h2>\n\n\n\n
      Feature<\/th>HTTP\/2 Required<\/th>Passed via ALB (HTTP\/1.1)<\/th>Outcome<\/th><\/tr><\/thead>
      Unary gRPC Calls<\/td>\u274c Optional<\/td>\u2705 Yes<\/td>May work<\/td><\/tr>
      gRPC Streaming (all types)<\/td>\u2705 Yes<\/td>\u274c No<\/td>Broken<\/td><\/tr>
      gRPC Trailers (grpc-status<\/code>)<\/td>\u2705 Yes<\/td>\u274c No<\/td>Broken<\/td><\/tr>
      Metadata headers<\/td>\u26a0\ufe0f Often required<\/td>\u26a0\ufe0f Incomplete<\/td>Unpredictable<\/td><\/tr>
      Observability (otel\/metrics)<\/td>\u2705 Yes<\/td>\u274c Incomplete<\/td>Partial \/ broken<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      \n\n\n\n
      \ud83d\udd27 How to Prevent This<\/h2>\n\n\n\n
      Use NLB + Envoy Gateway<\/strong> or a gRPC-aware ingress like:<\/p>\n\n\n\n
        \n
      • Envoy Gateway with HTTP\/2<\/li>\n\n\n\n
      • Istio IngressGateway<\/li>\n\n\n\n
      • Gateway API with GRPCRoute<\/code><\/li>\n<\/ul>\n\n\n\n
        \n\n\n\n
        <\/p>\n","protected":false},"excerpt":{"rendered":"
        Excellent question. When we say AWS ALB \u201cdowngrades HTTP\/2 \u2192 HTTP\/1.1\u201d, it means that although the client connects to ALB over HTTP\/2, ALB then connects to your backend (e.g., EKS… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-49374","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=49374"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49374\/revisions"}],"predecessor-version":[{"id":49375,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49374\/revisions\/49375"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=49374"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=49374"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=49374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}