kube-apiserver: disable http2

There are several kubernetes bugs [0,1,2] involving connection problems
that seem related to the Go net/http2 library, where the stream state
and connection state can get out of sync. This can manifest as a kubelet
issue, where the node status gets stuck in a NotReady state, but can
also happen elsewhere.

In newer versions of the Go libraries some issues are fixed [3,4], but
the fixes are not present in k8s 1.18.

This change disables http2 in kube-apiserver and webhook-apiserver. This
should be sufficient to avoid the majority of the issues, as disabling
on one side of the connection is enough, and apiserver is generally
either the client or the server.

0: https://github.com/kubernetes/kubernetes/issues/87615
1: https://github.com/kubernetes/kubernetes/issues/80313
2: https://github.com/kubernetes/client-go/issues/374
3: https://github.com/golang/go/issues/40423
4: https://github.com/golang/go/issues/40201

Change-Id: Id693a7201acffccbc4b3db8f4e4b96290fd50288

charts/apiserver-webhook/templates/deployment.yaml

@@ -141,6 +141,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
+{{ include "helm-toolkit.utils.to_k8s_env_vars" .Values.pod.env.apiserver | indent 12 }}
           command:
             {{- range .Values.command_prefix }}
             - {{ . }}

charts/apiserver-webhook/values.yaml

@@ -238,6 +238,9 @@ pod:
       failureThreshold: 3
       initialDelaySeconds: 15
       periodSeconds: 20
+  env:
+    apiserver:
+      GODEBUG: http2server=0,http2client=0
   lifecycle:
     upgrades:
       daemonsets:

charts/apiserver/templates/etc/_kubernetes-apiserver.yaml.tpl

@@ -89,6 +89,7 @@ spec:
           value: {{ .Values.network.kubernetes_apiserver.port | quote }}
         - name: ETCD_ENDPOINTS
           value: {{ .Values.apiserver.etcd.endpoints | quote }}
+{{ include "helm-toolkit.utils.to_k8s_env_vars" .Values.pod.env.apiserver | indent 8 }}
 
       command:
         {{- range .Values.const.command_prefix }}

charts/apiserver/values.yaml

@@ -350,6 +350,9 @@ pod:
             initialDelaySeconds: 10
             periodSeconds: 5
             timeoutSeconds: 5
+  env:
+    apiserver:
+      GODEBUG: http2server=0,http2client=0
 
 manifests:
   configmap_bin: true