Consul-helm: How ingress into service mesh from web server that is out of service mesh?

[Shige99011]

Hi, I'm now trying to access from web UI to APIs in a service mesh. Is there any way to do it?
My application's configuration is:

Do I need to inject sidecar into the pod of web server as well?(in this case, web server is also in service mesh, though) I tried it but it doesn't work. The error response for the request from web UI says "426 upgrade required"(does it work with HTTP/2.0?).

The web server's setting is here:

server {
    listen 80;

    root /usr/share/nginx/html;
    index index.html;

    server_name _;

    #This is to specify the upstream destination that is specified in the manifest file for the web server pod. 
    # The annotation in the manifest is:
    #  'consul.hashicorp.com/connect-inject': 'true'
    #  'consul.hashicorp.com/connect-service-upstreams': 'api-service:9001'
    location /gateway/ {
        proxy_pass http://127.0.0.1:9001/; 

    }

    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
}

The code to call the API from web UI is:

    fetch('gateway/hello-service/hello', {

        method: 'GET',
        headers: {
            'Content-Type': 'text/plain'
        }
      })
      .then(response => {
        response.text()
        .then(text => {
            alert(text)
          })
      })
      .catch(error => {
          alert(error);
      });

Or, should I use ingress gateway between web server and api-service?

btw, my environment is below:

OS: ubuntu 18.04 on hyper-v
microk8s: v1.20.5
kubernetes: v1.20.5
consul: v1.9.4
Consul helm chart: v0.31.1
(Consul helm chart was installed by command "microk8s helm3 install -f config.yaml consul hashicorp/consul --version "0.31.1"")
There is only one kubernetes node.

Thanks for your any help.

[blake]

Nginx defaults to using HTTP/1.0 when proxying to backend services, however Envoy does not enable support for HTTP/1.0 by default (see Envoy's accept_http_10 config) which is the reason you are seeing Envoy respond with "426 upgrade required."

You would see the same error from Envoy regardless of whether the requested was routed through a sidecar proxy, or ingress gateway since Consul does not enable HTTP/1.0 support in Envoy for either proxy type.

You can resolve this in the web server config by configuring nginx to utilize HTTP/1.1 when proxying to backend services via the proxy_http_version directive. For example:

location /gateway/ {
    proxy_pass http://127.0.0.1:9001/; 
    proxy_http_version 1.1;
    proxy_set_header Connection "";
}

[Shige99011]

Thanks @blake for your help.
It has worked for both cases sidecar and Ingress gateway with the proxy_http_version!!

Thanks a lot.