add support for h2c in h2 ping health checks

.changelog/10690.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+health-checks: add support for h2c in http2 ping health checks
+```

agent/agent.go

@@ -2706,9 +2706,11 @@ func (a *Agent) addCheck(check *structs.HealthCheck, chkType *structs.CheckType,
 				)
 				chkType.Interval = checks.MinInterval
 			}
-
+			var tlsClientConfig *tls.Config
-			tlsClientConfig := a.tlsConfigurator.OutgoingTLSConfigForCheck(chkType.TLSSkipVerify, chkType.TLSServerName)
+			if !chkType.H2PINGDisableTLS {
-			tlsClientConfig.NextProtos = []string{http2.NextProtoTLS}
+				tlsClientConfig = a.tlsConfigurator.OutgoingTLSConfigForCheck(chkType.TLSSkipVerify, chkType.TLSServerName)
+				tlsClientConfig.NextProtos = []string{http2.NextProtoTLS}
+			}
 
 			h2ping := &checks.CheckH2PING{
 				CheckID:         cid,

agent/agent_test.go

@@ -855,6 +855,32 @@ func TestAgent_AddServiceWithH2PINGCheck(t *testing.T) {
 	requireCheckExists(t, a, "test-h2ping-check")
 }
 
+func TestAgent_AddServiceWithH2CPINGCheck(t *testing.T) {
+	t.Parallel()
+	a := NewTestAgent(t, "")
+	defer a.Shutdown()
+	check := []*structs.CheckType{
+		{
+			CheckID:          "test-h2cping-check",
+			Name:             "test-h2cping-check",
+			H2PING:           "localhost:12345",
+			TLSSkipVerify:    true,
+			Interval:         10 * time.Second,
+			H2PINGDisableTLS: true,
+		},
+	}
+
+	nodeService := &structs.NodeService{
+		ID:      "test-h2cping-check-service",
+		Service: "test-h2cping-check-service",
+	}
+	err := a.addServiceFromSource(nodeService, check, false, "", ConfigSourceLocal)
+	if err != nil {
+		t.Fatalf("Error registering service: %v", err)
+	}
+	requireCheckExists(t, a, "test-h2cping-check")
+}
+
 func TestAgent_AddServiceNoExec(t *testing.T) {
 	if testing.Short() {
 		t.Skip("too slow for testing.Short")

agent/checks/check.go

@@ -535,11 +535,25 @@ func shutdownHTTP2ClientConn(clientConn *http2.ClientConn, timeout time.Duration
 }
 
 func (c *CheckH2PING) check() {
-	t := &http2.Transport{
+	t := &http2.Transport{}
-		TLSClientConfig: c.TLSClientConfig,
+	var dialFunc func(ctx context.Context, network, address string, tlscfg *tls.Config) (net.Conn, error)
+	if c.TLSClientConfig != nil {
+		t.TLSClientConfig = c.TLSClientConfig
+		dialFunc = func(ctx context.Context, network, address string, tlscfg *tls.Config) (net.Conn, error) {
+			dialer := &tls.Dialer{Config: tlscfg}
+			return dialer.DialContext(ctx, network, address)
+		}
+	} else {
+		t.AllowHTTP = true
+		dialFunc = func(ctx context.Context, network, address string, tlscfg *tls.Config) (net.Conn, error) {
+			dialer := &net.Dialer{}
+			return dialer.DialContext(ctx, network, address)
+		}
 	}
 	target := c.H2PING
-	conn, err := tls.Dial("tcp", target, c.TLSClientConfig)
+	ctx, cancel := context.WithTimeout(context.Background(), c.Timeout)
+	defer cancel()
+	conn, err := dialFunc(ctx, "tcp", target, c.TLSClientConfig)
 	if err != nil {
 		message := fmt.Sprintf("Failed to dial to %s: %s", target, err)
 		c.StatusHandler.updateCheck(c.CheckID, api.HealthCritical, message)
@@ -553,8 +567,6 @@ func (c *CheckH2PING) check() {
 		return
 	}
 	defer shutdownHTTP2ClientConn(clientConn, c.Timeout, c.CheckID.String(), c.Logger)
-	ctx, cancel := context.WithTimeout(context.Background(), c.Timeout)
-	defer cancel()
 	err = clientConn.Ping(ctx)
 	if err == nil {
 		c.StatusHandler.updateCheck(c.CheckID, api.HealthPassing, "HTTP2 ping was successful")

agent/checks/check_test.go

@@ -21,6 +21,7 @@ import (
 	"github.com/hashicorp/go-uuid"
 	"github.com/stretchr/testify/require"
 	http2 "golang.org/x/net/http2"
+	"golang.org/x/net/http2/h2c"
 )
 
 func uniqueID() string {
@@ -1256,6 +1257,64 @@ func TestCheckH2PINGInvalidListener(t *testing.T) {
 	})
 }
 
+func TestCheckH2CPING(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		desc        string
+		passing     bool
+		timeout     time.Duration
+		connTimeout time.Duration
+	}{
+		{desc: "passing", passing: true, timeout: 1 * time.Second, connTimeout: 1 * time.Second},
+		{desc: "failing because of time out", passing: false, timeout: 1 * time.Nanosecond, connTimeout: 1 * time.Second},
+		{desc: "failing because of closed connection", passing: false, timeout: 1 * time.Nanosecond, connTimeout: 1 * time.Millisecond},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.desc, func(t *testing.T) {
+			handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { return })
+			h2chandler := h2c.NewHandler(handler, &http2.Server{})
+			server := httptest.NewUnstartedServer(h2chandler)
+			server.Config.ReadTimeout = tt.connTimeout
+			server.Start()
+			defer server.Close()
+			serverAddress := server.Listener.Addr()
+			target := serverAddress.String()
+
+			notif := mock.NewNotify()
+			logger := testutil.Logger(t)
+			statusHandler := NewStatusHandler(notif, logger, 0, 0)
+			cid := structs.NewCheckID("foo", nil)
+			check := &CheckH2PING{
+				CheckID:         cid,
+				H2PING:          target,
+				Interval:        5 * time.Second,
+				Timeout:         tt.timeout,
+				Logger:          logger,
+				TLSClientConfig: nil,
+				StatusHandler:   statusHandler,
+			}
+
+			check.Start()
+			defer check.Stop()
+			if tt.passing {
+				retry.Run(t, func(r *retry.R) {
+					if got, want := notif.State(cid), api.HealthPassing; got != want {
+						r.Fatalf("got state %q want %q", got, want)
+					}
+				})
+			} else {
+				retry.Run(t, func(r *retry.R) {
+					if got, want := notif.State(cid), api.HealthCritical; got != want {
+						r.Fatalf("got state %q want %q", got, want)
+					}
+				})
+			}
+		})
+	}
+}
+
 func TestCheck_Docker(t *testing.T) {
 	if testing.Short() {
 		t.Skip("too slow for testing.Short")

agent/config/builder.go

@@ -1571,6 +1571,7 @@ func (b *builder) checkVal(v *CheckDefinition) *structs.CheckDefinition {
 		FailuresBeforeCritical:         intVal(v.FailuresBeforeCritical),
 		FailuresBeforeWarning:          intValWithDefault(v.FailuresBeforeWarning, intVal(v.FailuresBeforeCritical)),
 		H2PING:                         stringVal(v.H2PING),
+		H2PINGDisableTLS:               boolVal(v.H2PINGDisableTLS),
 		DeregisterCriticalServiceAfter: b.durationVal(fmt.Sprintf("check[%s].deregister_critical_service_after", id), v.DeregisterCriticalServiceAfter),
 		OutputMaxSize:                  intValWithDefault(v.OutputMaxSize, checks.DefaultBufSize),
 		EnterpriseMeta:                 v.EnterpriseMeta.ToStructs(),

agent/config/config.go

@@ -419,6 +419,7 @@ type CheckDefinition struct {
 	Timeout                        *string             `mapstructure:"timeout"`
 	TTL                            *string             `mapstructure:"ttl"`
 	H2PING                         *string             `mapstructure:"h2ping"`
+	H2PINGDisableTLS               *bool               `mapstructure:"h2ping_disable_tls"`
 	SuccessBeforePassing           *int                `mapstructure:"success_before_passing"`
 	FailuresBeforeWarning          *int                `mapstructure:"failures_before_warning"`
 	FailuresBeforeCritical         *int                `mapstructure:"failures_before_critical"`

agent/config/runtime_test.go

@@ -5307,6 +5307,7 @@ func TestLoad_FullConfig(t *testing.T) {
 				Body:                           "wSjTy7dg",
 				TCP:                            "RJQND605",
 				H2PING:                         "9N1cSb5B",
+                                H2PINGDisableTLS:               true,
 				Interval:                       22164 * time.Second,
 				OutputMaxSize:                  checks.DefaultBufSize,
 				DockerContainerID:              "ipgdFtjd",
@@ -5334,6 +5335,7 @@ func TestLoad_FullConfig(t *testing.T) {
 				OutputMaxSize:                  checks.DefaultBufSize,
 				TCP:                            "4jG5casb",
 				H2PING:                         "HCHU7gEb",
+                                H2PINGDisableTLS:               true,
 				Interval:                       28767 * time.Second,
 				DockerContainerID:              "THW6u7rL",
 				Shell:                          "C1Zt3Zwh",
@@ -5360,6 +5362,7 @@ func TestLoad_FullConfig(t *testing.T) {
 				OutputMaxSize:                  checks.DefaultBufSize,
 				TCP:                            "JY6fTTcw",
 				H2PING:                         "rQ8eyCSF",
+                                H2PINGDisableTLS:               true,
 				Interval:                       18714 * time.Second,
 				DockerContainerID:              "qF66POS9",
 				Shell:                          "sOnDy228",
@@ -5565,6 +5568,7 @@ func TestLoad_FullConfig(t *testing.T) {
 						OutputMaxSize:                  checks.DefaultBufSize,
 						TCP:                            "ICbxkpSF",
 						H2PING:                         "7s7BbMyb",
+                                                H2PINGDisableTLS:               true,
 						Interval:                       24392 * time.Second,
 						DockerContainerID:              "ZKXr68Yb",
 						Shell:                          "CEfzx0Fo",
@@ -5616,6 +5620,7 @@ func TestLoad_FullConfig(t *testing.T) {
 						OutputMaxSize:                  checks.DefaultBufSize,
 						TCP:                            "MN3oA9D2",
 						H2PING:                         "OV6Q2XEg",
+                                                H2PINGDisableTLS:               true,
 						Interval:                       32718 * time.Second,
 						DockerContainerID:              "cU15LMet",
 						Shell:                          "nEz9qz2l",
@@ -5759,6 +5764,7 @@ func TestLoad_FullConfig(t *testing.T) {
 						OutputMaxSize:                  checks.DefaultBufSize,
 						TCP:                            "bNnNfx2A",
 						H2PING:                         "qC1pidiW",
+                                                H2PINGDisableTLS:               true,
 						Interval:                       22224 * time.Second,
 						DockerContainerID:              "ipgdFtjd",
 						Shell:                          "omVZq7Sz",
@@ -5783,6 +5789,7 @@ func TestLoad_FullConfig(t *testing.T) {
 						OutputMaxSize:                  checks.DefaultBufSize,
 						TCP:                            "FfvCwlqH",
 						H2PING:                         "spI3muI3",
+                                                H2PINGDisableTLS:               true,
 						Interval:                       12356 * time.Second,
 						DockerContainerID:              "HBndBU6R",
 						Shell:                          "hVI33JjA",
@@ -5807,6 +5814,7 @@ func TestLoad_FullConfig(t *testing.T) {
 						OutputMaxSize:                  checks.DefaultBufSize,
 						TCP:                            "fjiLFqVd",
 						H2PING:                         "5NbNWhan",
+                                                H2PINGDisableTLS:               true,
 						Interval:                       23926 * time.Second,
 						DockerContainerID:              "dO5TtRHk",
 						Shell:                          "e6q2ttES",

agent/config/testdata/TestRuntimeConfig_Sanitize.golden

@@ -99,6 +99,7 @@
             "GRPC": "",
             "GRPCUseTLS": false,
             "H2PING": "",
+            "H2PINGDisableTLS": false,
             "HTTP": "",
             "Header": {},
             "ID": "",
@@ -303,6 +304,7 @@
                 "GRPC": "",
                 "GRPCUseTLS": false,
                 "H2PING": "",
+                "H2PINGDisableTLS": false,
                 "HTTP": "",
                 "Header": {},
                 "Interval": "0s",

agent/config/testdata/full-config.hcl

@@ -110,6 +110,7 @@ check = {
     body = "5PBQd2OT"
     tcp = "JY6fTTcw"
     h2ping = "rQ8eyCSF"
+    h2ping_disable_tls = true
     interval = "18714s"
     output_max_size = 4096
     docker_container_id = "qF66POS9"
@@ -137,6 +138,7 @@ checks = [
         body = "wSjTy7dg"
         tcp = "RJQND605"
         h2ping = "9N1cSb5B"
+        h2ping_disable_tls = true
         interval = "22164s"
         output_max_size = 4096
         docker_container_id = "ipgdFtjd"
@@ -163,6 +165,7 @@ checks = [
         body = "0jkKgGUC"
         tcp = "4jG5casb"
         h2ping = "HCHU7gEb"
+        h2ping_disable_tls = true
         interval = "28767s"
         output_max_size = 4096
         docker_container_id = "THW6u7rL"
@@ -380,6 +383,7 @@ service = {
         body = "wVVL2V6f"
         tcp = "fjiLFqVd"
         h2ping = "5NbNWhan"
+        h2ping_disable_tls = true
         interval = "23926s"
         docker_container_id = "dO5TtRHk"
         shell = "e6q2ttES"
@@ -404,6 +408,7 @@ service = {
             body = "OwGjTFQi"
             tcp = "bNnNfx2A"
             h2ping = "qC1pidiW"
+            h2ping_disable_tls = true
             interval = "22224s"
             output_max_size = 4096
             docker_container_id = "ipgdFtjd"
@@ -428,6 +433,7 @@ service = {
             body = "lUVLGYU7"
             tcp = "FfvCwlqH"
             h2ping = "spI3muI3"
+            h2ping_disable_tls = true
             interval = "12356s"
             output_max_size = 4096
             docker_container_id = "HBndBU6R"
@@ -466,6 +472,7 @@ services = [
             body = "WeikigLh"
             tcp = "ICbxkpSF"
             h2ping = "7s7BbMyb"
+            h2ping_disable_tls = true
             interval = "24392s"
             output_max_size = 4096
             docker_container_id = "ZKXr68Yb"
@@ -507,6 +514,7 @@ services = [
                 body = "7CRjCJyz"
                 tcp = "MN3oA9D2"
                 h2ping = "OV6Q2XEg"
+                h2ping_disable_tls = true
                 interval = "32718s"
                 output_max_size = 4096
                 docker_container_id = "cU15LMet"

agent/config/testdata/full-config.json

@@ -112,6 +112,7 @@
     "output_max_size": 4096,
     "tcp": "JY6fTTcw",
     "h2ping": "rQ8eyCSF",
+    "h2ping_disable_tls": true,
     "interval": "18714s",
     "docker_container_id": "qF66POS9",
     "shell": "sOnDy228",
@@ -138,6 +139,7 @@
       "body": "wSjTy7dg",
       "tcp": "RJQND605",
       "h2ping": "9N1cSb5B",
+      "h2ping_disable_tls": true,
       "interval": "22164s",
       "output_max_size": 4096,
       "docker_container_id": "ipgdFtjd",
@@ -164,6 +166,7 @@
       "body": "0jkKgGUC",
       "tcp": "4jG5casb",
       "h2ping": "HCHU7gEb",
+      "h2ping_disable_tls": true,
       "interval": "28767s",
       "output_max_size": 4096,
       "docker_container_id": "THW6u7rL",
@@ -376,6 +379,7 @@
       "body": "wVVL2V6f",
       "tcp": "fjiLFqVd",
       "h2ping": "5NbNWhan",
+      "h2ping_disable_tls": true,
       "interval": "23926s",
       "output_max_size": 4096,
       "docker_container_id": "dO5TtRHk",
@@ -401,6 +405,7 @@
         "body": "OwGjTFQi",
         "tcp": "bNnNfx2A",
         "h2ping": "qC1pidiW",
+        "h2ping_disable_tls": true,
         "interval": "22224s",
         "output_max_size": 4096,
         "docker_container_id": "ipgdFtjd",
@@ -425,6 +430,7 @@
         "body": "lUVLGYU7",
         "tcp": "FfvCwlqH",
         "h2ping": "spI3muI3",
+        "h2ping_disable_tls": true,
         "interval": "12356s",
         "output_max_size": 4096,
         "docker_container_id": "HBndBU6R",
@@ -463,6 +469,7 @@
         "body": "WeikigLh",
         "tcp": "ICbxkpSF",
         "h2ping": "7s7BbMyb",
+        "h2ping_disable_tls": true,
         "interval": "24392s",
         "output_max_size": 4096,
         "docker_container_id": "ZKXr68Yb",
@@ -504,6 +511,7 @@
           "body": "7CRjCJyz",
           "tcp": "MN3oA9D2",
           "h2ping": "OV6Q2XEg",
+          "h2ping_disable_tls": true,
           "interval": "32718s",
           "output_max_size": 4096,
           "docker_container_id": "cU15LMet",

agent/http_decode_test.go

@@ -285,6 +285,7 @@ var translateCheckTypeTCs = [][]translateKeyTestCase{
 	translateDockerTCs,
 	translateGRPCUseTLSTCs,
 	translateTLSServerNameTCs,
+	translateH2PINGDisableTLS,
 	translateTLSSkipVerifyTCs,
 	translateServiceIDTCs,
 }
@@ -677,6 +678,62 @@ var translateGRPCUseTLSTCs = []translateKeyTestCase{
 	},
 }
 
+func h2pingDisableTLSEqFn(out interface{}, want interface{}) error {
+	var got interface{}
+	switch v := out.(type) {
+	case structs.CheckDefinition:
+		got = v.H2PINGDisableTLS
+	case *structs.CheckDefinition:
+		got = v.H2PINGDisableTLS
+	case structs.CheckType:
+		got = v.H2PINGDisableTLS
+	case *structs.CheckType:
+		got = v.H2PINGDisableTLS
+	case structs.HealthCheckDefinition:
+		got = v.H2PINGDisableTLS
+	case *structs.HealthCheckDefinition:
+		got = v.H2PINGDisableTLS
+	default:
+		panic(fmt.Sprintf("unexpected type %T", out))
+	}
+	if got != want {
+		return fmt.Errorf("expected H2PINGDisableTLS to be %v, got %v", want, got)
+	}
+	return nil
+}
+
+var h2pingDisableTLSFields = []string{`"H2PINGDisableTLS": %s`, `"h2ping_disable_tls": %s`}
+var translateH2PINGDisableTLS = []translateKeyTestCase{
+	{
+		desc:       "H2PINGDisableTLS: both set",
+		in:         []interface{}{"true", "false"},
+		want:       true,
+		jsonFmtStr: "{" + strings.Join(h2pingDisableTLSFields, ",") + "}",
+		equalityFn: h2pingDisableTLSEqFn,
+	},
+	{
+		desc:       "H2PINGDisableTLS:: first set",
+		in:         []interface{}{`true`},
+		want:       true,
+		jsonFmtStr: "{" + h2pingDisableTLSFields[0] + "}",
+		equalityFn: h2pingDisableTLSEqFn,
+	},
+	{
+		desc:       "H2PINGDisableTLS: second set",
+		in:         []interface{}{`true`},
+		want:       true,
+		jsonFmtStr: "{" + h2pingDisableTLSFields[1] + "}",
+		equalityFn: h2pingDisableTLSEqFn,
+	},
+	{
+		desc:       "H2PINGDisableTLS: neither set",
+		in:         []interface{}{},
+		want:       false, // zero value
+		jsonFmtStr: "{}",
+		equalityFn: h2pingDisableTLSEqFn,
+	},
+}
+
 // ServiceID: string
 func serviceIDEqFn(out interface{}, want interface{}) error {
 	var got interface{}
@@ -935,6 +992,8 @@ func TestDecodeACLRoleWrite(t *testing.T) {
 // Shell	string
 // GRPC	string
 // GRPCUseTLS	bool
+// H2PING	string
+// H2PINGDisableTLS	bool
 // TLSServerName	string
 // TLSSkipVerify	bool
 // AliasNode	string

agent/structs/check_definition.go

@@ -25,6 +25,7 @@ type CheckDefinition struct {
 	ScriptArgs                     []string
 	HTTP                           string
 	H2PING                         string
+	H2PINGDisableTLS               bool
 	Header                         map[string][]string
 	Method                         string
 	Body                           string
@@ -69,6 +70,7 @@ func (t *CheckDefinition) UnmarshalJSON(data []byte) (err error) {
 		TLSSkipVerifySnake                  bool        `json:"tls_skip_verify"`
 		GRPCUseTLSSnake                     bool        `json:"grpc_use_tls"`
 		ServiceIDSnake                      string      `json:"service_id"`
+		H2PINGDisableTLSSnake               bool        `json:"h2ping_disable_tls"`
 
 		*Alias
 	}{
@@ -100,6 +102,9 @@ func (t *CheckDefinition) UnmarshalJSON(data []byte) (err error) {
 	if aux.GRPCUseTLSSnake {
 		t.GRPCUseTLS = aux.GRPCUseTLSSnake
 	}
+	if aux.H2PINGDisableTLSSnake {
+		t.H2PINGDisableTLS = aux.H2PINGDisableTLSSnake
+	}
 	if t.ServiceID == "" {
 		t.ServiceID = aux.ServiceIDSnake
 	}
@@ -182,6 +187,7 @@ func (c *CheckDefinition) CheckType() *CheckType {
 		AliasService:                   c.AliasService,
 		HTTP:                           c.HTTP,
 		H2PING:                         c.H2PING,
+		H2PINGDisableTLS:               c.H2PINGDisableTLS,
 		GRPC:                           c.GRPC,
 		GRPCUseTLS:                     c.GRPCUseTLS,
 		Header:                         c.Header,

agent/structs/check_type.go

@@ -33,6 +33,7 @@ type CheckType struct {
 	ScriptArgs             []string
 	HTTP                   string
 	H2PING                 string
+	H2PINGDisableTLS       bool
 	Header                 map[string][]string
 	Method                 string
 	Body                   string
@@ -81,6 +82,7 @@ func (t *CheckType) UnmarshalJSON(data []byte) (err error) {
 		TLSServerNameSnake                  string      `json:"tls_server_name"`
 		TLSSkipVerifySnake                  bool        `json:"tls_skip_verify"`
 		GRPCUseTLSSnake                     bool        `json:"grpc_use_tls"`
+		H2PINGDisableTLSSnake               bool        `json:"h2ping_disable_tls"`
 
 		// These are going to be ignored but since we are disallowing unknown fields
 		// during parsing we have to be explicit about parsing but not using these.
@@ -115,6 +117,9 @@ func (t *CheckType) UnmarshalJSON(data []byte) (err error) {
 	if aux.GRPCUseTLSSnake {
 		t.GRPCUseTLS = aux.GRPCUseTLSSnake
 	}
+	if aux.H2PINGDisableTLSSnake {
+		t.H2PINGDisableTLS = aux.H2PINGDisableTLSSnake
+	}
 
 	if aux.Interval != nil {
 		switch v := aux.Interval.(type) {

agent/structs/structs.go

@@ -1544,6 +1544,7 @@ type HealthCheckDefinition struct {
 	Body                           string              `json:",omitempty"`
 	TCP                            string              `json:",omitempty"`
 	H2PING                         string              `json:",omitempty"`
+	H2PINGDisableTLS               bool                `json:",omitempty"`
 	Interval                       time.Duration       `json:",omitempty"`
 	OutputMaxSize                  uint                `json:",omitempty"`
 	Timeout                        time.Duration       `json:",omitempty"`
@@ -1691,6 +1692,7 @@ func (c *HealthCheck) CheckType() *CheckType {
 		Body:                           c.Definition.Body,
 		TCP:                            c.Definition.TCP,
 		H2PING:                         c.Definition.H2PING,
+		H2PINGDisableTLS:               c.Definition.H2PINGDisableTLS,
 		Interval:                       c.Definition.Interval,
 		DockerContainerID:              c.Definition.DockerContainerID,
 		Shell:                          c.Definition.Shell,

api/agent.go

@@ -327,6 +327,8 @@ type AgentServiceCheck struct {
 	TLSSkipVerify          bool                `json:",omitempty"`
 	GRPC                   string              `json:",omitempty"`
 	GRPCUseTLS             bool                `json:",omitempty"`
+	H2PING                 string              `json:",omitempty"`
+	H2PINGDisableTLS       bool                `json:",omitempty"`
 	AliasNode              string              `json:",omitempty"`
 	AliasService           string              `json:",omitempty"`
 	SuccessBeforePassing   int                 `json:",omitempty"`

proto/pbservice/healthcheck.gen.go

@@ -13,6 +13,7 @@ func CheckTypeToStructs(s CheckType) structs.CheckType {
 	t.ScriptArgs = s.ScriptArgs
 	t.HTTP = s.HTTP
 	t.H2PING = s.H2PING
+	t.H2PINGDisableTLS = s.H2PINGDisableTLS
 	t.Header = MapHeadersToStructs(s.Header)
 	t.Method = s.Method
 	t.Body = s.Body
@@ -46,6 +47,7 @@ func NewCheckTypeFromStructs(t structs.CheckType) CheckType {
 	s.ScriptArgs = t.ScriptArgs
 	s.HTTP = t.HTTP
 	s.H2PING = t.H2PING
+	s.H2PINGDisableTLS = t.H2PINGDisableTLS
 	s.Header = NewMapHeadersFromStructs(t.Header)
 	s.Method = t.Method
 	s.Body = t.Body
@@ -120,6 +122,7 @@ func HealthCheckDefinitionToStructs(s HealthCheckDefinition) structs.HealthCheck
 	t.Body = s.Body
 	t.TCP = s.TCP
 	t.H2PING = s.H2PING
+	t.H2PINGDisableTLS = s.H2PINGDisableTLS
 	t.Interval = s.Interval
 	t.OutputMaxSize = uint(s.OutputMaxSize)
 	t.Timeout = s.Timeout
@@ -144,6 +147,7 @@ func NewHealthCheckDefinitionFromStructs(t structs.HealthCheckDefinition) Health
 	s.Body = t.Body
 	s.TCP = t.TCP
 	s.H2PING = t.H2PING
+	s.H2PINGDisableTLS = t.H2PINGDisableTLS
 	s.Interval = t.Interval
 	s.OutputMaxSize = uint32(t.OutputMaxSize)
 	s.Timeout = t.Timeout

proto/pbservice/healthcheck.pb.go

@@ -27,7 +27,7 @@ var _ = time.Kitchen
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
+const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 
 // HealthCheck represents a single check on a given node
 //
@@ -153,6 +153,7 @@ type HealthCheckDefinition struct {
 	DockerContainerID              string        `protobuf:"bytes,11,opt,name=DockerContainerID,proto3" json:"DockerContainerID,omitempty"`
 	Shell                          string        `protobuf:"bytes,12,opt,name=Shell,proto3" json:"Shell,omitempty"`
 	H2PING                         string        `protobuf:"bytes,20,opt,name=H2PING,proto3" json:"H2PING,omitempty"`
+	H2PINGDisableTLS               bool          `protobuf:"varint,21,opt,name=H2PINGDisableTLS,proto3" json:"H2PINGDisableTLS,omitempty"`
 	GRPC                           string        `protobuf:"bytes,13,opt,name=GRPC,proto3" json:"GRPC,omitempty"`
 	GRPCUseTLS                     bool          `protobuf:"varint,14,opt,name=GRPCUseTLS,proto3" json:"GRPCUseTLS,omitempty"`
 	AliasNode                      string        `protobuf:"bytes,15,opt,name=AliasNode,proto3" json:"AliasNode,omitempty"`
@@ -223,6 +224,7 @@ type CheckType struct {
 	DockerContainerID string                 `protobuf:"bytes,12,opt,name=DockerContainerID,proto3" json:"DockerContainerID,omitempty"`
 	Shell             string                 `protobuf:"bytes,13,opt,name=Shell,proto3" json:"Shell,omitempty"`
 	H2PING            string                 `protobuf:"bytes,28,opt,name=H2PING,proto3" json:"H2PING,omitempty"`
+	H2PINGDisableTLS  bool                   `protobuf:"varint,30,opt,name=H2PINGDisableTLS,proto3" json:"H2PINGDisableTLS,omitempty"`
 	GRPC              string                 `protobuf:"bytes,14,opt,name=GRPC,proto3" json:"GRPC,omitempty"`
 	GRPCUseTLS        bool                   `protobuf:"varint,15,opt,name=GRPCUseTLS,proto3" json:"GRPCUseTLS,omitempty"`
 	TLSServerName     string                 `protobuf:"bytes,27,opt,name=TLSServerName,proto3" json:"TLSServerName,omitempty"`
@@ -291,75 +293,76 @@ func init() {
 func init() { proto.RegisterFile("proto/pbservice/healthcheck.proto", fileDescriptor_8a6f7448747c9fbe) }
 
 var fileDescriptor_8a6f7448747c9fbe = []byte{
-	// 1076 bytes of a gzipped FileDescriptorProto
+	// 1100 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x56, 0x5d, 0x4f, 0xe3, 0x46,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x57, 0xdd, 0x4e, 0xe3, 0x46,
-	0x14, 0x8d, 0x09, 0x24, 0xf1, 0x04, 0x58, 0x98, 0x05, 0x3a, 0xcb, 0x6e, 0x4d, 0x4a, 0xf7, 0x81,
+	0x14, 0x8e, 0x09, 0x49, 0xc8, 0x04, 0x58, 0x98, 0x05, 0x3a, 0xcb, 0x6e, 0x4d, 0x4a, 0xf7, 0x82,
-	0xaa, 0x34, 0x91, 0xe8, 0x87, 0xda, 0x4a, 0x6d, 0x45, 0x08, 0x0b, 0xa9, 0x80, 0xa6, 0x4e, 0xba,
+	0xb6, 0x34, 0x91, 0xe8, 0x8f, 0xda, 0x4a, 0x6d, 0x45, 0x08, 0x0b, 0xa9, 0x80, 0xa6, 0x4e, 0xba,
-	0x95, 0xfa, 0x66, 0x9c, 0x49, 0x62, 0xe1, 0x78, 0xac, 0xf1, 0x18, 0x91, 0xfe, 0x8a, 0x7d, 0xdc,
+	0x95, 0x7a, 0x67, 0x9c, 0x49, 0x32, 0xc2, 0xf1, 0x44, 0xe3, 0x31, 0x22, 0x7d, 0x87, 0x4a, 0xbd,
-	0x9f, 0xc4, 0x23, 0x8f, 0x95, 0x2a, 0xd1, 0x2e, 0xfc, 0x8b, 0x3e, 0x55, 0x73, 0xc7, 0x0e, 0xf6,
+	0xdc, 0x87, 0xe9, 0x03, 0x70, 0xc9, 0x65, 0xa5, 0x4a, 0xb4, 0x85, 0xb7, 0xe8, 0x55, 0x35, 0x67,
-	0xc6, 0x5b, 0xd2, 0xd5, 0xee, 0x13, 0x73, 0xef, 0xb9, 0x77, 0xc6, 0x33, 0xf7, 0x9c, 0x13, 0xd0,
+	0xec, 0x60, 0x6f, 0xbc, 0x0d, 0x5d, 0x6d, 0xaf, 0x72, 0x7e, 0x67, 0x3c, 0xe7, 0x9c, 0xef, 0x3b,
-	0x47, 0x3e, 0x67, 0x82, 0xd5, 0xfc, 0xd3, 0x80, 0xf2, 0x73, 0xc7, 0xa6, 0xb5, 0x01, 0xb5, 0x5c,
+	0x0a, 0x7a, 0x67, 0x28, 0xb8, 0xe4, 0xd5, 0xe1, 0xa9, 0x4f, 0xc5, 0x39, 0x73, 0x68, 0xb5, 0x4f,
-	0x31, 0xb0, 0x07, 0xd4, 0x3e, 0xab, 0x02, 0x86, 0xf5, 0x31, 0xb8, 0x6e, 0xf4, 0x19, 0xeb, 0xbb,
+	0x6d, 0x57, 0xf6, 0x9d, 0x3e, 0x75, 0xce, 0x2a, 0xe0, 0xc3, 0xc5, 0xb1, 0x73, 0xdd, 0xec, 0x71,
-	0xb4, 0x06, 0xc0, 0x69, 0xd8, 0xab, 0x75, 0x43, 0x6e, 0x09, 0x87, 0x79, 0xaa, 0x74, 0xfd, 0x71,
+	0xde, 0x73, 0x69, 0x15, 0x1c, 0xa7, 0x41, 0xb7, 0xda, 0x09, 0x84, 0x2d, 0x19, 0xf7, 0x74, 0xe8,
-	0xbc, 0x9b, 0xcd, 0x86, 0x43, 0xe6, 0xd5, 0xd4, 0x9f, 0x08, 0x5c, 0xe9, 0xb3, 0x3e, 0x53, 0x05,
+	0xfa, 0xe3, 0xe8, 0x34, 0x87, 0x0f, 0x06, 0xdc, 0xab, 0xea, 0x9f, 0xd0, 0xb9, 0xd2, 0xe3, 0x3d,
-	0x72, 0xa5, 0xb2, 0x9b, 0x7f, 0xce, 0xa2, 0xf2, 0x21, 0x9c, 0xb9, 0x27, 0xcf, 0xc4, 0x18, 0xcd,
+	0xae, 0x03, 0x94, 0xa4, 0xad, 0x9b, 0xbf, 0xcf, 0xa2, 0xd2, 0x21, 0xdc, 0xb9, 0xa7, 0xee, 0xc4,
-	0x9e, 0xb0, 0x2e, 0x25, 0x5a, 0x45, 0xdb, 0xd2, 0x4d, 0x58, 0xe3, 0x03, 0x54, 0x04, 0xb0, 0xd9,
+	0x18, 0xcd, 0x9e, 0xf0, 0x0e, 0x25, 0x46, 0xd9, 0xd8, 0x2a, 0x5a, 0x20, 0xe3, 0x03, 0x54, 0x00,
-	0x20, 0x33, 0x32, 0x5d, 0xff, 0xec, 0x9f, 0xeb, 0x8d, 0x4f, 0xfa, 0x8e, 0x18, 0x84, 0xa7, 0x55,
+	0x67, 0xa3, 0x4e, 0x66, 0x94, 0xb9, 0xf6, 0xe1, 0xdf, 0xd7, 0x1b, 0xef, 0xf5, 0x98, 0xec, 0x07,
-	0x9b, 0x0d, 0x6b, 0x03, 0x2b, 0x18, 0x38, 0x36, 0xe3, 0x7e, 0xcd, 0x66, 0x5e, 0x10, 0xba, 0x35,
+	0xa7, 0x15, 0x87, 0x0f, 0xaa, 0x7d, 0xdb, 0xef, 0x33, 0x87, 0x8b, 0x61, 0xd5, 0xe1, 0x9e, 0x1f,
-	0x31, 0xf2, 0x69, 0x50, 0x8d, 0x9a, 0xcc, 0xb8, 0x1b, 0x36, 0xb7, 0x86, 0x94, 0xe4, 0xa3, 0xcd,
+	0xb8, 0x55, 0x39, 0x1a, 0x52, 0xbf, 0x12, 0x26, 0x59, 0x51, 0x36, 0x1c, 0x6e, 0x0f, 0x28, 0xc9,
-	0xad, 0x21, 0xc5, 0x6b, 0xa8, 0xd0, 0x16, 0x96, 0x08, 0x03, 0x32, 0x0b, 0xd9, 0x28, 0xc2, 0x2b,
+	0x86, 0x87, 0xdb, 0x03, 0x8a, 0xd7, 0x50, 0xbe, 0x25, 0x6d, 0x19, 0xf8, 0x64, 0x16, 0xac, 0xa1,
-	0x68, 0xee, 0x84, 0x09, 0x1a, 0x90, 0x39, 0x48, 0xab, 0x40, 0x56, 0xff, 0x14, 0x0a, 0x3f, 0x14,
+	0x86, 0x57, 0x50, 0xee, 0x84, 0x4b, 0xea, 0x93, 0x1c, 0x98, 0xb5, 0xa2, 0xa2, 0xbf, 0x0d, 0xe4,
-	0xa4, 0xa0, 0xaa, 0x55, 0x84, 0x9f, 0x20, 0xbd, 0xad, 0x1e, 0xa9, 0xd9, 0x20, 0x45, 0x80, 0xee,
+	0x30, 0x90, 0x24, 0xaf, 0xa3, 0xb5, 0x86, 0x9f, 0xa0, 0x62, 0x4b, 0x17, 0xa9, 0x51, 0x27, 0x05,
-	0x12, 0xb8, 0x82, 0xca, 0x51, 0x00, 0xc7, 0x97, 0x00, 0x4f, 0xa6, 0x12, 0x15, 0x1d, 0xab, 0x1f,
+	0x70, 0xdd, 0x19, 0x70, 0x19, 0x95, 0x42, 0x05, 0xae, 0x9f, 0x03, 0x7f, 0xdc, 0x14, 0x8b, 0x68,
-	0x10, 0xbd, 0x92, 0x4f, 0x54, 0xc8, 0x94, 0xfc, 0xf6, 0xce, 0xc8, 0xa7, 0x64, 0x5e, 0x7d, 0xbb,
+	0xdb, 0x3d, 0x9f, 0x14, 0xcb, 0xd9, 0x58, 0x84, 0x32, 0xa9, 0x6f, 0x6f, 0x8f, 0x86, 0x94, 0xcc,
-	0x5c, 0xe3, 0x67, 0x08, 0x35, 0x68, 0xcf, 0xf1, 0x1c, 0x39, 0x03, 0x82, 0x2a, 0xda, 0x56, 0x79,
+	0xeb, 0x6f, 0x57, 0x32, 0x7e, 0x86, 0x50, 0x9d, 0x76, 0x99, 0xc7, 0x54, 0x0f, 0x08, 0x2a, 0x1b,
-	0xa7, 0x52, 0x1d, 0xcf, 0xab, 0x9a, 0x78, 0xd8, 0xbb, 0xba, 0xfa, 0xec, 0xe5, 0xf5, 0x46, 0xce,
+	0x5b, 0xa5, 0x9d, 0x72, 0x65, 0xdc, 0xaf, 0x4a, 0xac, 0xb0, 0x77, 0x71, 0xb5, 0xd9, 0xcb, 0xeb,
-	0x4c, 0x74, 0xe2, 0x6f, 0x90, 0x6e, 0x5a, 0x3d, 0xd1, 0xf4, 0xba, 0xf4, 0x82, 0x94, 0x61, 0x9b,
+	0x8d, 0x8c, 0x15, 0xcb, 0xc4, 0x9f, 0xa3, 0xa2, 0x65, 0x77, 0x65, 0xc3, 0xeb, 0xd0, 0x0b, 0x52,
-	0xe5, 0x6a, 0x34, 0xbc, 0x31, 0x50, 0x2f, 0xc9, 0xbe, 0xab, 0xeb, 0x0d, 0xcd, 0xbc, 0xab, 0xc6,
+	0x82, 0x63, 0x96, 0x2b, 0x61, 0xf3, 0xc6, 0x8e, 0xda, 0x9c, 0xca, 0xbb, 0xba, 0xde, 0x30, 0xac,
-	0x0d, 0xb4, 0xb8, 0xef, 0x09, 0xca, 0x7d, 0xee, 0x04, 0xf4, 0x98, 0x0a, 0x8b, 0x2c, 0x40, 0xff,
+	0xbb, 0x68, 0x5c, 0x47, 0x8b, 0xfb, 0x9e, 0xa4, 0x62, 0x28, 0x98, 0x4f, 0x8f, 0xa9, 0xb4, 0xc9,
-	0x5a, 0xdc, 0x9f, 0x46, 0xa3, 0xc3, 0x5f, 0xeb, 0x91, 0xd7, 0xdf, 0xbf, 0xf0, 0x59, 0x40, 0xbb,
+	0x02, 0xe4, 0xaf, 0x45, 0xf9, 0x49, 0x6f, 0x78, 0xf9, 0x4b, 0x39, 0xea, 0xf9, 0xfb, 0x17, 0x43,
-	0x2d, 0xc6, 0x05, 0x59, 0xac, 0x68, 0x5b, 0x73, 0x66, 0x32, 0x85, 0xd7, 0x51, 0xa9, 0x29, 0x7b,
+	0xee, 0xd3, 0x4e, 0x93, 0x0b, 0x49, 0x16, 0xcb, 0xc6, 0x56, 0xce, 0x8a, 0x9b, 0xf0, 0x3a, 0x9a,
-	0xce, 0x2d, 0x97, 0x3c, 0x80, 0x27, 0x18, 0xc7, 0x98, 0xa0, 0x62, 0xc7, 0x19, 0x52, 0x16, 0x0a,
+	0x6b, 0xa8, 0x9c, 0x73, 0xdb, 0x25, 0x0f, 0xa0, 0x04, 0x63, 0x1d, 0x13, 0x54, 0x68, 0xb3, 0x01,
-	0xb2, 0x04, 0x50, 0x1c, 0x6e, 0x7e, 0x0c, 0xe4, 0xea, 0x52, 0xfe, 0xdc, 0x72, 0x43, 0x2a, 0x67,
+	0xe5, 0x81, 0x24, 0x4b, 0xe0, 0x8a, 0xd4, 0xcd, 0x77, 0x61, 0xb8, 0x3a, 0x54, 0x3c, 0xb7, 0xdd,
-	0x0a, 0x0b, 0xa2, 0xc1, 0xfb, 0xaa, 0x60, 0xf3, 0x45, 0x11, 0xad, 0x66, 0xbe, 0x94, 0x7c, 0xf3,
+	0x80, 0xaa, 0x9e, 0x82, 0x40, 0x0c, 0xa8, 0xaf, 0x56, 0x36, 0x7f, 0x2d, 0xa0, 0xd5, 0xd4, 0x4a,
-	0xc3, 0x4e, 0xa7, 0x15, 0x93, 0x51, 0xae, 0xf1, 0x53, 0xb4, 0xd0, 0x39, 0x6a, 0xcb, 0xc9, 0x50,
+	0xa9, 0x9a, 0x1f, 0xb6, 0xdb, 0xcd, 0x68, 0x18, 0x95, 0x8c, 0x9f, 0xa2, 0x85, 0xf6, 0x51, 0x4b,
-	0x0e, 0xd3, 0x7c, 0x08, 0x60, 0x3a, 0x19, 0x57, 0x9d, 0x39, 0xfe, 0x73, 0xca, 0x9d, 0xde, 0x08,
+	0x75, 0x86, 0x0a, 0xe8, 0xe6, 0x43, 0x70, 0x26, 0x8d, 0x51, 0xd4, 0x19, 0x1b, 0x3e, 0xa7, 0x82,
-	0x88, 0x5b, 0x32, 0xd3, 0x49, 0xfc, 0x23, 0x2a, 0xa8, 0xcf, 0x23, 0xf9, 0x4a, 0x7e, 0xab, 0xbc,
+	0x75, 0x47, 0x30, 0xb8, 0x73, 0x56, 0xd2, 0x88, 0xbf, 0x41, 0x79, 0xfd, 0x79, 0x24, 0x5b, 0xce,
-	0xb3, 0x7d, 0xdf, 0xec, 0xaa, 0xaa, 0x7c, 0xdf, 0x13, 0x7c, 0x14, 0x3d, 0x65, 0xb4, 0x83, 0x64,
+	0x6e, 0x95, 0x76, 0xb6, 0xa7, 0xf5, 0xae, 0xa2, 0xc3, 0xf7, 0x3d, 0x29, 0x46, 0x61, 0x29, 0xc3,
-	0xe6, 0x31, 0x15, 0x03, 0xd6, 0x8d, 0x79, 0xac, 0x22, 0x79, 0x87, 0x3a, 0xeb, 0x8e, 0x08, 0x56,
+	0x13, 0xd4, 0x64, 0x1e, 0x53, 0xd9, 0xe7, 0x9d, 0x68, 0x8e, 0xb5, 0xa6, 0xde, 0x50, 0xe3, 0x9d,
-	0x77, 0x90, 0x6b, 0xbc, 0x84, 0xf2, 0x9d, 0xbd, 0x56, 0xc4, 0x6c, 0xb9, 0xc4, 0x3f, 0x24, 0x9e,
+	0x11, 0xc1, 0xfa, 0x0d, 0x4a, 0xc6, 0x4b, 0x28, 0xdb, 0xde, 0x6b, 0x86, 0x93, 0xad, 0x44, 0xfc,
-	0xb7, 0x00, 0x03, 0x7c, 0x54, 0x55, 0x62, 0xaf, 0xc6, 0x62, 0xaf, 0x36, 0x22, 0xb1, 0x2b, 0x22,
+	0x75, 0xac, 0xbc, 0x79, 0x68, 0xe0, 0xa3, 0x8a, 0x06, 0x7b, 0x25, 0x02, 0x7b, 0xa5, 0x1e, 0x82,
-	0xbc, 0xfc, 0x6b, 0x43, 0x4b, 0xcc, 0xe0, 0x29, 0x5a, 0x50, 0x52, 0x38, 0xb6, 0x2e, 0xda, 0xce,
+	0x5d, 0x0f, 0xc2, 0x8b, 0x3f, 0x36, 0x8c, 0x58, 0x0f, 0x9e, 0xa2, 0x05, 0x0d, 0x85, 0x63, 0xfb,
-	0xef, 0x94, 0xe8, 0x15, 0x6d, 0x6b, 0xc1, 0x4c, 0x27, 0xf1, 0x77, 0x77, 0x93, 0x2a, 0x4e, 0x7f,
+	0xa2, 0xc5, 0x7e, 0xa2, 0xa4, 0x58, 0x36, 0xb6, 0x16, 0xac, 0xa4, 0x11, 0x7f, 0x79, 0xd7, 0xa9,
-	0x4a, 0xdc, 0x83, 0xcf, 0x90, 0xd1, 0xa0, 0x9c, 0xf6, 0x9d, 0x40, 0x50, 0xbe, 0xc7, 0x1d, 0xe1,
+	0xc2, 0xfd, 0x6f, 0x89, 0x72, 0xf0, 0x19, 0x32, 0xeb, 0x54, 0xd0, 0x1e, 0xf3, 0x25, 0x15, 0x7b,
-	0xd8, 0x96, 0x1b, 0x89, 0x64, 0xb7, 0x27, 0x28, 0x07, 0x69, 0x4d, 0xb9, 0xeb, 0x3d, 0x5b, 0x61,
+	0x82, 0x49, 0xe6, 0xd8, 0x6e, 0x08, 0x92, 0xdd, 0xae, 0xa4, 0x02, 0xa0, 0x75, 0xcf, 0x53, 0xa7,
-	0x03, 0xa1, 0xb6, 0xcd, 0x1d, 0x5f, 0xec, 0xf2, 0x7e, 0x40, 0x10, 0x30, 0x26, 0x91, 0xc1, 0xdb,
+	0x1c, 0x85, 0x4d, 0x84, 0x5a, 0x8e, 0x60, 0x43, 0xb9, 0x2b, 0x7a, 0x3e, 0x41, 0x30, 0x31, 0x31,
-	0x68, 0xb9, 0xc1, 0xec, 0x33, 0xca, 0xf7, 0x98, 0x27, 0x2c, 0xc7, 0xa3, 0xbc, 0xd9, 0x00, 0xf1,
+	0x0b, 0xde, 0x46, 0xcb, 0x75, 0xee, 0x9c, 0x51, 0xb1, 0xc7, 0x3d, 0x69, 0x33, 0x8f, 0x8a, 0x46,
-	0xe8, 0xe6, 0x24, 0x20, 0xa9, 0xd7, 0x1e, 0x50, 0xd7, 0x8d, 0xf4, 0xab, 0x02, 0x39, 0xb4, 0xc3,
+	0x1d, 0xc0, 0x53, 0xb4, 0x26, 0x1d, 0x6a, 0xf4, 0x5a, 0x7d, 0xea, 0xba, 0x21, 0x7e, 0xb5, 0xa2,
-	0x9d, 0x56, 0xf3, 0xe4, 0x80, 0xac, 0xa8, 0xa1, 0xa9, 0x48, 0x0e, 0xed, 0xc0, 0x6c, 0xed, 0x81,
+	0x9a, 0x76, 0xb8, 0xd3, 0x6c, 0x9c, 0x1c, 0x90, 0x15, 0xdd, 0x34, 0xad, 0xe1, 0xf7, 0xd1, 0x92,
-	0x96, 0x74, 0x13, 0xd6, 0xf2, 0x7b, 0xe4, 0xdf, 0x5f, 0x02, 0xda, 0x39, 0x6a, 0x83, 0x44, 0x4a,
+	0x96, 0xea, 0xcc, 0xb7, 0x4f, 0x5d, 0xda, 0x3e, 0x6a, 0x91, 0x55, 0x98, 0xa0, 0x09, 0xbb, 0x6a,
-	0x66, 0x22, 0x23, 0x2d, 0x68, 0xd7, 0x75, 0xac, 0x00, 0xec, 0x53, 0x49, 0xe4, 0x2e, 0x81, 0x37,
+	0xf0, 0x81, 0xd5, 0xdc, 0x03, 0xdc, 0x15, 0x2d, 0x90, 0xd5, 0xb7, 0xab, 0xdf, 0xef, 0x7d, 0xc8,
-	0xd1, 0x3c, 0x04, 0xd1, 0x15, 0x23, 0xa1, 0xa4, 0x72, 0xf8, 0x4b, 0x94, 0xef, 0x74, 0x8e, 0xc8,
+	0x5c, 0x84, 0xcc, 0x98, 0x45, 0xd1, 0xd5, 0xae, 0xcb, 0x6c, 0x1f, 0xa8, 0x56, 0xc3, 0xe9, 0xce,
-	0xf2, 0xf4, 0x6f, 0x28, 0xeb, 0xd7, 0x7f, 0x8e, 0x45, 0x06, 0xb4, 0x94, 0xe4, 0x3a, 0xa3, 0xa3,
+	0x80, 0x37, 0xd1, 0x3c, 0x28, 0x61, 0x39, 0x42, 0x50, 0x25, 0x6c, 0xf8, 0x13, 0x94, 0x6d, 0xb7,
-	0x48, 0x33, 0x72, 0x89, 0xb7, 0xd1, 0xdc, 0x39, 0xc8, 0x6e, 0x26, 0xb2, 0x86, 0x14, 0xcb, 0x63,
+	0x8f, 0xc8, 0xf2, 0xfd, 0xeb, 0xad, 0xe2, 0xd7, 0xbf, 0x8b, 0x00, 0x09, 0x23, 0xac, 0x06, 0xf1,
-	0x75, 0x9a, 0xaa, 0xe8, 0xdb, 0x99, 0xaf, 0xb5, 0xcd, 0x57, 0x3a, 0xd2, 0x81, 0xfa, 0x60, 0x73,
+	0x8c, 0x8e, 0x42, 0x7c, 0x29, 0x11, 0x6f, 0xa3, 0xdc, 0x39, 0x40, 0x74, 0x26, 0xa4, 0x91, 0x04,
-	0x09, 0xff, 0xd7, 0xde, 0x89, 0xff, 0xcf, 0x64, 0xfa, 0x7f, 0x3e, 0xdb, 0xff, 0x67, 0x93, 0xfe,
+	0x22, 0x22, 0x24, 0x5b, 0x3a, 0xe8, 0x8b, 0x99, 0xcf, 0x8c, 0xcd, 0x9f, 0x11, 0x2a, 0x02, 0x4c,
-	0x9f, 0x26, 0xc5, 0xdc, 0x04, 0x29, 0x62, 0xc7, 0x28, 0x24, 0x1c, 0xe3, 0xfb, 0xb1, 0xca, 0x57,
+	0x80, 0x12, 0x63, 0xbb, 0xc2, 0x78, 0x23, 0xbb, 0x62, 0x26, 0x75, 0x57, 0x64, 0xd3, 0x77, 0xc5,
-	0x40, 0xe5, 0x49, 0x87, 0x1e, 0x5f, 0x72, 0x2a, 0x65, 0x17, 0x33, 0x95, 0xbd, 0x3e, 0xa9, 0xec,
+	0x6c, 0x7c, 0x57, 0x24, 0x07, 0x28, 0x37, 0x31, 0x40, 0x11, 0xbb, 0xe4, 0x63, 0xec, 0xf2, 0xd5,
-	0x52, 0xb6, 0xb2, 0xf5, 0xb7, 0x51, 0x76, 0x8a, 0x57, 0xe8, 0x3e, 0x5e, 0x95, 0x33, 0x78, 0x95,
+	0x98, 0x11, 0x56, 0x80, 0x11, 0xe2, 0x6c, 0x3e, 0x7e, 0xe4, 0xbd, 0x58, 0xa0, 0x90, 0xca, 0x02,
-	0xa9, 0x94, 0xf9, 0x7b, 0x95, 0xb2, 0x90, 0xad, 0x94, 0x27, 0x99, 0x4a, 0x59, 0x7c, 0xa3, 0x52,
+	0xeb, 0x93, 0x2c, 0x30, 0x97, 0xce, 0x02, 0xc5, 0xd7, 0x61, 0x81, 0xc4, 0x5c, 0xa1, 0x69, 0x73,
-	0x1e, 0x4c, 0x28, 0x65, 0xc2, 0xc2, 0x1f, 0x4f, 0x65, 0xe1, 0x4b, 0x59, 0x16, 0x9e, 0x70, 0xb4,
+	0x55, 0x4a, 0x99, 0xab, 0x54, 0x54, 0xcd, 0x4f, 0x45, 0xd5, 0x42, 0x3a, 0xaa, 0x9e, 0x4c, 0x45,
-	0xe5, 0xb7, 0x70, 0xb4, 0x48, 0x72, 0xf8, 0xff, 0x49, 0x0e, 0xef, 0xa0, 0x95, 0x76, 0x68, 0xdb,
+	0x95, 0x39, 0x05, 0x55, 0x8b, 0xaf, 0x44, 0xd5, 0x83, 0x09, 0x54, 0x4d, 0xac, 0x86, 0xc7, 0xf7,
-	0x34, 0x08, 0xea, 0xb4, 0xc7, 0x38, 0x6d, 0x59, 0x41, 0xe0, 0x78, 0x7d, 0xb2, 0x0a, 0x3f, 0x9c,
+	0x5a, 0x0d, 0x4b, 0x69, 0xab, 0x21, 0xc6, 0x94, 0xcb, 0xaf, 0xc1, 0x94, 0x21, 0x3c, 0xf1, 0x7f,
-	0x99, 0x18, 0xfe, 0x02, 0xad, 0x3e, 0xb3, 0x1c, 0x37, 0xe4, 0x34, 0x02, 0x7e, 0xb5, 0xb8, 0x27,
+	0x83, 0x27, 0xde, 0x41, 0x2b, 0xad, 0xc0, 0x71, 0xa8, 0xef, 0xd7, 0x68, 0x97, 0x0b, 0xda, 0xb4,
-	0x9b, 0x3e, 0x84, 0xa6, 0x6c, 0x10, 0x7f, 0x85, 0xd6, 0xd2, 0x40, 0xec, 0x95, 0x64, 0x0d, 0xda,
+	0x7d, 0x9f, 0x79, 0x3d, 0xe0, 0x9e, 0x9c, 0x95, 0xea, 0xc3, 0x1f, 0xa3, 0xd5, 0x67, 0x36, 0x73,
-	0xde, 0x80, 0x4a, 0xd6, 0xb4, 0x38, 0xbb, 0x18, 0x81, 0x1a, 0x3e, 0x50, 0xac, 0x19, 0x27, 0xc6,
+	0x03, 0x41, 0x43, 0xc7, 0x0f, 0xb6, 0xf0, 0x54, 0xd2, 0xdb, 0x90, 0x94, 0xee, 0xc4, 0x9f, 0xa2,
-	0x28, 0x8c, 0x8e, 0x24, 0x50, 0x98, 0xdf, 0xfd, 0x36, 0xff, 0xf0, 0xdd, 0xd9, 0xfc, 0xc4, 0x0f,
+	0xb5, 0xa4, 0x23, 0xe2, 0x60, 0xb2, 0x06, 0x69, 0xaf, 0xf0, 0xaa, 0x09, 0x6b, 0x0a, 0x7e, 0x31,
-	0xd7, 0x23, 0xb8, 0x57, 0x3a, 0xf9, 0x1e, 0x3c, 0xae, 0x7e, 0x7c, 0xf9, 0xca, 0xc8, 0x5d, 0xde,
+	0x02, 0xe4, 0xbc, 0xa5, 0x27, 0x6c, 0x6c, 0x18, 0x7b, 0xa1, 0x75, 0x24, 0xe6, 0x85, 0xfe, 0x4d,
-	0x18, 0xda, 0xd5, 0x8d, 0xa1, 0xfd, 0x7d, 0x63, 0x68, 0x2f, 0x6e, 0x8d, 0xdc, 0xcb, 0x5b, 0x23,
+	0x5f, 0x1f, 0x0f, 0xdf, 0xdc, 0xfa, 0x98, 0x58, 0x88, 0x8f, 0xe0, 0x5d, 0x49, 0xe3, 0xff, 0xc0,
-	0x77, 0x75, 0x6b, 0xe4, 0xfe, 0xb8, 0x35, 0x72, 0xbf, 0x7d, 0xfa, 0x5f, 0x16, 0xf7, 0xda, 0x3f,
+	0x87, 0xb5, 0xe3, 0xcb, 0xbf, 0xcc, 0xcc, 0xe5, 0x8d, 0x69, 0x5c, 0xdd, 0x98, 0xc6, 0x9f, 0x37,
-	0xee, 0xa7, 0x05, 0x48, 0x7c, 0xfe, 0x6f, 0x00, 0x00, 0x00, 0xff, 0xff, 0x8b, 0x36, 0xc6, 0x76,
+	0xa6, 0xf1, 0xcb, 0xad, 0x99, 0x79, 0x71, 0x6b, 0x66, 0xae, 0x6e, 0xcd, 0xcc, 0x6f, 0xb7, 0x66,
-	0xd2, 0x0b, 0x00, 0x00,
+	0xe6, 0xc7, 0x0f, 0xfe, 0x8d, 0x0e, 0x5f, 0xfa, 0x43, 0x70, 0x9a, 0x07, 0xc3, 0x47, 0xff, 0x04,
+	0x00, 0x00, 0xff, 0xff, 0xb7, 0x54, 0xd1, 0x6f, 0x2a, 0x0c, 0x00, 0x00,
 }
 
 func (m *HealthCheck) Marshal() (dAtA []byte, err error) {
@@ -560,6 +563,18 @@ func (m *HealthCheckDefinition) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.H2PINGDisableTLS {
+		i--
+		if m.H2PINGDisableTLS {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xa8
+	}
 	if len(m.H2PING) > 0 {
 		i -= len(m.H2PING)
 		copy(dAtA[i:], m.H2PING)
@@ -760,6 +775,18 @@ func (m *CheckType) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if m.H2PINGDisableTLS {
+		i--
+		if m.H2PINGDisableTLS {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0xf0
+	}
 	if m.FailuresBeforeWarning != 0 {
 		i = encodeVarintHealthcheck(dAtA, i, uint64(m.FailuresBeforeWarning))
 		i--
@@ -1191,6 +1218,9 @@ func (m *HealthCheckDefinition) Size() (n int) {
 	if l > 0 {
 		n += 2 + l + sovHealthcheck(uint64(l))
 	}
+	if m.H2PINGDisableTLS {
+		n += 3
+	}
 	return n
 }
 
@@ -1309,6 +1339,9 @@ func (m *CheckType) Size() (n int) {
 	if m.FailuresBeforeWarning != 0 {
 		n += 2 + sovHealthcheck(uint64(m.FailuresBeforeWarning))
 	}
+	if m.H2PINGDisableTLS {
+		n += 3
+	}
 	return n
 }
 
@@ -1855,7 +1888,10 @@ func (m *HealthCheck) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if skippy < 0 {
+				return ErrInvalidLengthHealthcheck
+			}
+			if (iNdEx + skippy) < 0 {
 				return ErrInvalidLengthHealthcheck
 			}
 			if (iNdEx + skippy) > l {
@@ -1937,7 +1973,10 @@ func (m *HeaderValue) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if skippy < 0 {
+				return ErrInvalidLengthHealthcheck
+			}
+			if (iNdEx + skippy) < 0 {
 				return ErrInvalidLengthHealthcheck
 			}
 			if (iNdEx + skippy) > l {
@@ -2151,7 +2190,7 @@ func (m *HealthCheckDefinition) Unmarshal(dAtA []byte) error {
 					if err != nil {
 						return err
 					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
+					if skippy < 0 {
 						return ErrInvalidLengthHealthcheck
 					}
 					if (iNdEx + skippy) > postIndex {
@@ -2685,13 +2724,36 @@ func (m *HealthCheckDefinition) Unmarshal(dAtA []byte) error {
 			}
 			m.H2PING = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 21:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field H2PINGDisableTLS", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowHealthcheck
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.H2PINGDisableTLS = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipHealthcheck(dAtA[iNdEx:])
 			if err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if skippy < 0 {
+				return ErrInvalidLengthHealthcheck
+			}
+			if (iNdEx + skippy) < 0 {
 				return ErrInvalidLengthHealthcheck
 			}
 			if (iNdEx + skippy) > l {
@@ -3441,7 +3503,7 @@ func (m *CheckType) Unmarshal(dAtA []byte) error {
 					if err != nil {
 						return err
 					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
+					if skippy < 0 {
 						return ErrInvalidLengthHealthcheck
 					}
 					if (iNdEx + skippy) > postIndex {
@@ -3688,13 +3750,36 @@ func (m *CheckType) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
+		case 30:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field H2PINGDisableTLS", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowHealthcheck
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.H2PINGDisableTLS = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := skipHealthcheck(dAtA[iNdEx:])
 			if err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if skippy < 0 {
+				return ErrInvalidLengthHealthcheck
+			}
+			if (iNdEx + skippy) < 0 {
 				return ErrInvalidLengthHealthcheck
 			}
 			if (iNdEx + skippy) > l {
@@ -3712,7 +3797,6 @@ func (m *CheckType) Unmarshal(dAtA []byte) error {
 func skipHealthcheck(dAtA []byte) (n int, err error) {
 	l := len(dAtA)
 	iNdEx := 0
-	depth := 0
 	for iNdEx < l {
 		var wire uint64
 		for shift := uint(0); ; shift += 7 {
@@ -3744,8 +3828,10 @@ func skipHealthcheck(dAtA []byte) (n int, err error) {
 					break
 				}
 			}
+			return iNdEx, nil
 		case 1:
 			iNdEx += 8
+			return iNdEx, nil
 		case 2:
 			var length int
 			for shift := uint(0); ; shift += 7 {
@@ -3766,30 +3852,55 @@ func skipHealthcheck(dAtA []byte) (n int, err error) {
 				return 0, ErrInvalidLengthHealthcheck
 			}
 			iNdEx += length
-		case 3:
+			if iNdEx < 0 {
-			depth++
+				return 0, ErrInvalidLengthHealthcheck
-		case 4:
-			if depth == 0 {
-				return 0, ErrUnexpectedEndOfGroupHealthcheck
 			}
-			depth--
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowHealthcheck
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipHealthcheck(dAtA[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+				if iNdEx < 0 {
+					return 0, ErrInvalidLengthHealthcheck
+				}
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
 		case 5:
 			iNdEx += 4
+			return iNdEx, nil
 		default:
 			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
 		}
-		if iNdEx < 0 {
-			return 0, ErrInvalidLengthHealthcheck
-		}
-		if depth == 0 {
-			return iNdEx, nil
-		}
 	}
-	return 0, io.ErrUnexpectedEOF
+	panic("unreachable")
 }
 
 var (
-	ErrInvalidLengthHealthcheck        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrInvalidLengthHealthcheck = fmt.Errorf("proto: negative length found during unmarshaling")
-	ErrIntOverflowHealthcheck          = fmt.Errorf("proto: integer overflow")
+	ErrIntOverflowHealthcheck   = fmt.Errorf("proto: integer overflow")
-	ErrUnexpectedEndOfGroupHealthcheck = fmt.Errorf("proto: unexpected end of group")
 )

proto/pbservice/healthcheck.proto

@@ -83,6 +83,7 @@ message HealthCheckDefinition {
     string DockerContainerID = 11;
     string Shell = 12;
     string H2PING = 20;
+    bool H2PINGDisableTLS = 21;
     string GRPC = 13;
     bool GRPCUseTLS = 14;
     string AliasNode = 15;
@@ -124,6 +125,7 @@ message CheckType {
     string DockerContainerID = 12;
     string Shell = 13;
     string H2PING = 28;
+    bool H2PINGDisableTLS = 30;
     string GRPC = 14;
     bool GRPCUseTLS = 15;
     string TLSServerName = 27;

proto/pbservice/service.pb.go

@@ -24,7 +24,7 @@ var _ = math.Inf
 // is compatible with the proto package it is being compiled against.
 // A compilation error at this line likely means your copy of the
 // proto package needs to be updated.
-const _ = proto.ProtoPackageIsVersion3 // please upgrade the proto package
+const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 
 // ConnectProxyConfig describes the configuration needed for any proxy managed
 // or unmanaged. It describes a single logical service's listener and optionally
@@ -2131,7 +2131,10 @@ func (m *ConnectProxyConfig) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if skippy < 0 {
+				return ErrInvalidLengthService
+			}
+			if (iNdEx + skippy) < 0 {
 				return ErrInvalidLengthService
 			}
 			if (iNdEx + skippy) > l {
@@ -2545,7 +2548,10 @@ func (m *Upstream) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if skippy < 0 {
+				return ErrInvalidLengthService
+			}
+			if (iNdEx + skippy) < 0 {
 				return ErrInvalidLengthService
 			}
 			if (iNdEx + skippy) > l {
@@ -2651,7 +2657,10 @@ func (m *ServiceConnect) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if skippy < 0 {
+				return ErrInvalidLengthService
+			}
+			if (iNdEx + skippy) < 0 {
 				return ErrInvalidLengthService
 			}
 			if (iNdEx + skippy) > l {
@@ -2755,7 +2764,10 @@ func (m *ExposeConfig) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if skippy < 0 {
+				return ErrInvalidLengthService
+			}
+			if (iNdEx + skippy) < 0 {
 				return ErrInvalidLengthService
 			}
 			if (iNdEx + skippy) > l {
@@ -2927,7 +2939,10 @@ func (m *ExposePath) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if skippy < 0 {
+				return ErrInvalidLengthService
+			}
+			if (iNdEx + skippy) < 0 {
 				return ErrInvalidLengthService
 			}
 			if (iNdEx + skippy) > l {
@@ -3009,7 +3024,10 @@ func (m *MeshGatewayConfig) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if skippy < 0 {
+				return ErrInvalidLengthService
+			}
+			if (iNdEx + skippy) < 0 {
 				return ErrInvalidLengthService
 			}
 			if (iNdEx + skippy) > l {
@@ -3098,7 +3116,10 @@ func (m *TransparentProxyConfig) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if skippy < 0 {
+				return ErrInvalidLengthService
+			}
+			if (iNdEx + skippy) < 0 {
 				return ErrInvalidLengthService
 			}
 			if (iNdEx + skippy) > l {
@@ -3418,7 +3439,7 @@ func (m *ServiceDefinition) Unmarshal(dAtA []byte) error {
 					if err != nil {
 						return err
 					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
+					if skippy < 0 {
 						return ErrInvalidLengthService
 					}
 					if (iNdEx + skippy) > postIndex {
@@ -3793,7 +3814,7 @@ func (m *ServiceDefinition) Unmarshal(dAtA []byte) error {
 					if err != nil {
 						return err
 					}
-					if (skippy < 0) || (iNdEx+skippy) < 0 {
+					if skippy < 0 {
 						return ErrInvalidLengthService
 					}
 					if (iNdEx + skippy) > postIndex {
@@ -3875,7 +3896,10 @@ func (m *ServiceDefinition) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if skippy < 0 {
+				return ErrInvalidLengthService
+			}
+			if (iNdEx + skippy) < 0 {
 				return ErrInvalidLengthService
 			}
 			if (iNdEx + skippy) > l {
@@ -3976,7 +4000,10 @@ func (m *ServiceAddress) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if skippy < 0 {
+				return ErrInvalidLengthService
+			}
+			if (iNdEx + skippy) < 0 {
 				return ErrInvalidLengthService
 			}
 			if (iNdEx + skippy) > l {
@@ -4064,7 +4091,10 @@ func (m *Weights) Unmarshal(dAtA []byte) error {
 			if err != nil {
 				return err
 			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
+			if skippy < 0 {
+				return ErrInvalidLengthService
+			}
+			if (iNdEx + skippy) < 0 {
 				return ErrInvalidLengthService
 			}
 			if (iNdEx + skippy) > l {
@@ -4082,7 +4112,6 @@ func (m *Weights) Unmarshal(dAtA []byte) error {
 func skipService(dAtA []byte) (n int, err error) {
 	l := len(dAtA)
 	iNdEx := 0
-	depth := 0
 	for iNdEx < l {
 		var wire uint64
 		for shift := uint(0); ; shift += 7 {
@@ -4114,8 +4143,10 @@ func skipService(dAtA []byte) (n int, err error) {
 					break
 				}
 			}
+			return iNdEx, nil
 		case 1:
 			iNdEx += 8
+			return iNdEx, nil
 		case 2:
 			var length int
 			for shift := uint(0); ; shift += 7 {
@@ -4136,30 +4167,55 @@ func skipService(dAtA []byte) (n int, err error) {
 				return 0, ErrInvalidLengthService
 			}
 			iNdEx += length
-		case 3:
+			if iNdEx < 0 {
-			depth++
+				return 0, ErrInvalidLengthService
-		case 4:
-			if depth == 0 {
-				return 0, ErrUnexpectedEndOfGroupService
 			}
-			depth--
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowService
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipService(dAtA[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+				if iNdEx < 0 {
+					return 0, ErrInvalidLengthService
+				}
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
 		case 5:
 			iNdEx += 4
+			return iNdEx, nil
 		default:
 			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
 		}
-		if iNdEx < 0 {
-			return 0, ErrInvalidLengthService
-		}
-		if depth == 0 {
-			return iNdEx, nil
-		}
 	}
-	return 0, io.ErrUnexpectedEOF
+	panic("unreachable")
 }
 
 var (
-	ErrInvalidLengthService        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrInvalidLengthService = fmt.Errorf("proto: negative length found during unmarshaling")
-	ErrIntOverflowService          = fmt.Errorf("proto: integer overflow")
+	ErrIntOverflowService   = fmt.Errorf("proto: integer overflow")
-	ErrUnexpectedEndOfGroupService = fmt.Errorf("proto: unexpected end of group")
 )

website/content/api-docs/agent/check.mdx

@@ -183,10 +183,11 @@ The table below shows this endpoint's support for
   If TLS is enabled, then by default, a valid TLS certificate is expected. Certificate
   verification can be turned off by setting `TLSSkipVerify` to `true`.
 
-- `H2PING` `(string "")` - Specifies an address that uses http2 with TLS to run a ping check on.
+- `H2PING` `(string "")` - Specifies an address that uses http2 to run a ping check on.
   At the specified `Interval`, a connection is made to the address, and a ping is sent.
   If the ping is successful, the check will be classified as `passing`, otherwise it will be marked as `critical`.
-  A valid SSL certificate is required by default, but verification can be removed with `TLSSkipVerify`.
+  TLS is used by default. To disable TLS and use h2c, set `H2PINGDisableTLS` to `true`.
+  If TLS is enabled, a valid SSL certificate is required by default, but verification can be removed with `TLSSkipVerify`.
 
 - `HTTP` `(string: "")` - Specifies an `HTTP` check to perform a `GET` request
   against the value of `HTTP` (expected to be a URL) every `Interval`. If the

website/content/docs/discovery/checks.mdx

@@ -120,10 +120,11 @@ There are several different kinds of checks:
   `tls_skip_verify` field to `true` in the check definition.
   To check on a specific service instead of the whole gRPC server, add the service identifier after the `gRPC` check's endpoint in the following format `/:service_identifier`.
 
-- `H2ping + Interval` - These checks test an endpoint that uses http2 with TLS
+- `H2ping + Interval` - These checks test an endpoint that uses http2
-  by connecting to the endpoint and sending a ping frame. If the ping is successful
+  by connecting to the endpoint and sending a ping frame. TLS is assumed to be configured by default.
+  To disable TLS and use h2c, set `h2ping_disable_tls` to `true`. If the ping is successful
   within a specified timeout, then the check is updated as passing.
-  The timeout defaults to 10 seconds, but is configurable using the `timeout` field. A valid
+  The timeout defaults to 10 seconds, but is configurable using the `timeout` field. If TLS is enabled a valid
   certificate is required, unless `tls_skip_verify` is set to `true`.
   The check will be run on the interval specified by the `interval` field.
 
@@ -251,6 +252,7 @@ A h2ping check:
     "name": "h2ping",
     "h2ping": "localhost:22222",
     "interval": "10s",
+    "h2ping_disable_tls": false,
   }
 }
 ```