Per route HTTP filter chains

Per route HTTP filter chains

Envoy presently has a single filter chain configured in the HTTP connection manager. There are multiple mechanisms to change filter's behavior based on the selected route.

1. Some filter support per-route configuration override.
2. There is per-route flag to disable a filter altogether, so filter manager skips calling its callbacks.
3. There is a new filter chain filter, that can change filter chain composition based on selected route.
4. Ad there is composite filter, although it is more powerful and allows changing business logic based on dynamic attributes.

However these mechanisms are not quite enough for handling agentic traffic. Agents often emit very different types of requests, including inference (LLM), MCP, A2A, traditional REST, etc. These requests need different filter chains, sometimes having 0 common filters between them. For example LLM request to self-host cluster may need ext_proc to endpoint selector. LLM request to external provider may need transcoder to provider schema and guardrails callout. MCP needs filter with MCP parsers and filters that deal with MCP authorization.

Building a single filter chain in HCM and than using one of the override mechanisms is cumbersome in practice and leads to very complicated and error prone filter chain configurations.

This proposal is to allow selected route to fully override filter chain configured in HCM andHCM instantiating filter chain configured in selected route.

The clearRouteCache method will not create new filter chain.

Proposed Route API change.

message Route {
  //...
  repeated Filter filters = 21;
}


message Filter {
  // The name of the filter configuration.
  string name = 1 [(validate.rules).string = {min_len: 1}];

  // Filter specific configuration which depends on the filter being
  // instantiated. See the supported filters for further documentation.
  // Note that Envoy's :ref:`downstream network
  // filters <config_network_filters>` are not valid upstream network filters.
  // Only one of typed_config or config_discovery can be used.
  google.protobuf.Any typed_config = 2;

  // Configuration source specifier for an extension configuration discovery
  // service. In case of a failure and without the default configuration, the
  // listener closes the connections.
  // Only one of typed_config or config_discovery can be used.
  core.v3.ExtensionConfigSource config_discovery = 3;
}