When HTTP/2 is enabled for the upstream cluster, WebSocket connections won't work since they are disabled by default for HTTP/2 in Envoy:

envoyproxy/envoy#8156

This issue can arise when you have two mappings sharing the same upstream cluster, with one having use_websocket: true and the other having grpc: true (which forces HTTP/2 on the upstream cluster). For this case one workaround is to set cluster_tag on the mapping withuse_websocket: true – this will create a dedicated upstream cluster without HTTP/2 enabled.

A possible solution is to automatically set allow_connect in the HTTP/2 options of the cluster:

https://github.com/envoyproxy/envoy/blob/8a149cbce8450b8aaf5575cbd66591e472e9d778/api/envoy/config/core/v3/protocol.proto#L486

when use_websocket is set and the upstream cluster is configured for HTTP/2.