Envoy 1.22: Configuring HTTP/3 Fallback Policy for Reliable Connections

Configuring HTTP/3 Fallback in Envoy 1.22

To guarantee that requests are not dropped when a QUIC handshake fails in Envoy 1.22, you must set the fallback_policy to ALWAYS within the http3_protocol_options. This ensures that if the HTTP/3 connection cannot be established, Envoy will automatically attempt to route the request via HTTP/2.

Fallback Policy Options and Behavior

In Envoy 1.22, the fallback_policy typically supports the following behaviors:

• ALWAYS: Forces a fallback to HTTP/2 upon any QUIC handshake or connection failure. This is the recommended setting for reliability, as it prevents request drops at the cost of potentially masking QUIC configuration issues.
• DISABLE: Explicitly prevents fallback. If the QUIC handshake fails, the request will fail immediately, and Envoy will return an upstream error.
• DEFAULT: Follows the internal Envoy default. In version 1.22, this generally does not provide automatic fallback, meaning QUIC failures may result in dropped requests unless otherwise specified.

Implementation and Verification

Ensure your cluster is configured with type: h3 and the enable_http3: true flag. The fallback_policy is nested under the upstream HTTP protocol options.

clusters: 
  - name: h3_upstream
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    upstream_http_protocol_options: 
      http3_protocol_options:
        fallback_policy: ALWAYS
    transport_socket: 
      name: envoy.transport_sockets.tls
      # Ensure QUIC transport socket is configured here

To verify the policy is active without dropping traffic, use these steps:

1. Config Audit: Use the Envoy admin interface /config_dump to confirm the fallback_policy is set to ALWAYS in the running configuration.
2. Failure Simulation: Temporarily block UDP traffic to the upstream server (e.g., via iptables). Send requests and monitor the Envoy access logs.
3. Log Analysis: Confirm that the protocol field in the access logs switches from h3 to h2 while the request status remains successful (e.g., 200 OK).

Handling h3_datagram

The h3_datagram feature is experimental in Envoy 1.22. It should remain disabled by default. Enabling it without confirmed support from downstream services can lead to silent packet drops or connection instabilities. Only enable this field if your specific use case requires QUIC datagrams and you have verified upstream compatibility.

Observability Impact

Using ALWAYS fallback impacts your metrics. You will see an increase in HTTP/2 connection counters and specific fallback-related metrics, while upstream_rq_failure should remain stable despite QUIC handshake errors. If you notice a sudden spike in h2 traffic for a cluster intended for h3, it indicates a systemic QUIC failure (such as MTU issues or firewall blocks) that is being masked by the fallback policy.