Issue Type:

• Bug report

My scheme is as follow: I have a client connecting linkerd over TLS. linkerd unpacks the TLS and forwards the communication unencrypted to the target POD on Kubernetes. What happens here is that the Grpc Service gives me the following:

Trace id "0HM08J72M21NK:00000003": HTTP/2 stream error "PROTOCOL_ERROR". A Reset is being sent to the stream.
Microsoft.AspNetCore.Connections.ConnectionAbortedException: The request :scheme header 'https' does not match the transport scheme 'http'.

I am using the k8s namer.

It seems that the :scheme header is being just forwarded from the originating client, however the target scheme should be 'http' since it's an unencrypted communication.

What you expected to happen:
I would expect that the :scheme header is set to http if communication is proxied on unencrypted endpoint

How to reproduce it (as minimally and precisely as possible):
Any client trying to reach some hello-world microservice in grpc,

Anything else we need to know?:

Environment:

• linkerd/namerd version, config files: buoyantio/linkerd:1.7.0