connect: Add Envoy 1.22 to integration tests, remove Envoy 1.18 (#12805)

Co-authored-by: R.B. Boyer <rb@hashicorp.com>

.changelog/12805.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: Add Envoy 1.22.0 to support matrix, remove 1.18.6
+```

.circleci/config.yml

@@ -847,13 +847,13 @@ jobs:
           command: make test-coverage-ci
       - run: *notify-slack-failure
 
-  envoy-integration-test-1_18_6: &ENVOY_TESTS
+  envoy-integration-test-1_19_3: &ENVOY_TESTS
     machine:
       image: ubuntu-2004:202101-01
     parallelism: 4
     resource_class: medium
     environment:
-      ENVOY_VERSION: "1.18.6"
+      ENVOY_VERSION: "1.19.3"
     steps: &ENVOY_INTEGRATION_TEST_STEPS
       - checkout
       # Get go binary from workspace
@@ -886,11 +886,6 @@ jobs:
           path: *TEST_RESULTS_DIR
       - run: *notify-slack-failure
 
-  envoy-integration-test-1_19_3:
-    <<: *ENVOY_TESTS
-    environment:
-      ENVOY_VERSION: "1.19.3"
-
   envoy-integration-test-1_20_2:
     <<: *ENVOY_TESTS
     environment:
@@ -901,6 +896,11 @@ jobs:
     environment:
       ENVOY_VERSION: "1.21.1"
 
+  envoy-integration-test-1_22_0:
+    <<: *ENVOY_TESTS
+    environment:
+      ENVOY_VERSION: "1.22.0"
+
   # run integration tests for the connect ca providers
   test-connect-ca-providers:
     docker:
@@ -1142,9 +1142,6 @@ workflows:
       - nomad-integration-0_8:
           requires:
             - dev-build
-      - envoy-integration-test-1_18_6:
-          requires:
-            - dev-build
       - envoy-integration-test-1_19_3:
           requires:
             - dev-build
@@ -1154,6 +1151,9 @@ workflows:
       - envoy-integration-test-1_21_1:
           requires:
             - dev-build
+      - envoy-integration-test-1_22_0:
+          requires:
+            - dev-build
 
   website:
     unless: << pipeline.parameters.trigger-load-test >>

agent/xds/delta.go

@@ -470,16 +470,6 @@ func (t *xDSDeltaType) Recv(req *envoy_discovery_v3.DeltaDiscoveryRequest, sf su
 		t.wildcard = len(req.ResourceNamesSubscribe) == 0
 		t.registered = true
 		registeredThisTime = true
-
-		if sf.ForceLDSandCDSToAlwaysUseWildcardsOnReconnect {
-			switch t.typeURL {
-			case xdscommon.ListenerType, xdscommon.ClusterType:
-				if !t.wildcard {
-					t.wildcard = true
-					logger.Trace("fixing Envoy bug fixed in 1.19.0 by inferring wildcard mode for type")
-				}
-			}
-		}
 	}
 
 	/*

agent/xds/delta_test.go

@@ -657,72 +657,6 @@ func TestServer_DeltaAggregatedResources_v3_SlowEndpointPopulation(t *testing.T)
 	}
 }
 
-func TestServer_DeltaAggregatedResources_v3_GetAllClusterAfterConsulRestarted(t *testing.T) {
-	// This illustrates a scenario related to https://github.com/hashicorp/consul/issues/11833
-
-	aclResolve := func(id string) (acl.Authorizer, error) {
-		// Allow all
-		return acl.RootAuthorizer("manage"), nil
-	}
-	scenario := newTestServerDeltaScenario(t, aclResolve, "web-sidecar-proxy", "", 0, false)
-	_, mgr, errCh, envoy := scenario.server, scenario.mgr, scenario.errCh, scenario.envoy
-	envoy.EnvoyVersion = "1.18.0"
-
-	sid := structs.NewServiceID("web-sidecar-proxy", nil)
-
-	// Register the proxy to create state needed to Watch() on
-	mgr.RegisterProxy(t, sid)
-
-	var snap *proxycfg.ConfigSnapshot
-	runStep(t, "get into state after consul restarted", func(t *testing.T) {
-		snap = newTestSnapshot(t, nil, "")
-
-		// Send initial cluster discover.
-		// This is to simulate the discovery request call from envoy after disconnected from consul ads stream.
-		//
-		// We need to force it to be an older version of envoy so that the logic shifts.
-		envoy.SendDeltaReq(t, xdscommon.ClusterType, &envoy_discovery_v3.DeltaDiscoveryRequest{
-			ResourceNamesSubscribe: []string{
-				"local_app",
-				"db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-			},
-			InitialResourceVersions: map[string]string{
-				"local_app": "a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447",
-				"db.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul": "5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03",
-			},
-		})
-
-		// Check no response sent yet
-		assertDeltaChanBlocked(t, envoy.deltaStream.sendCh)
-
-		requireProtocolVersionGauge(t, scenario, "v3", 1)
-
-		// Deliver a new snapshot
-		// the config contains 3 clusters: local_app, db, geo-cache.
-		// this is to simulate the fact that there is one additional (upstream) cluster gets added to the sidecar service
-		// during the time xds disconnected (consul restarted).
-		mgr.DeliverConfig(t, sid, snap)
-
-		assertDeltaResponseSent(t, envoy.deltaStream.sendCh, &envoy_discovery_v3.DeltaDiscoveryResponse{
-			TypeUrl: xdscommon.ClusterType,
-			Nonce:   hexString(1),
-			Resources: makeTestResources(t,
-				makeTestCluster(t, snap, "tcp:local_app"),
-				makeTestCluster(t, snap, "tcp:db"),
-				makeTestCluster(t, snap, "tcp:geo-cache"),
-			),
-		})
-	})
-
-	envoy.Close()
-	select {
-	case err := <-errCh:
-		require.NoError(t, err)
-	case <-time.After(50 * time.Millisecond):
-		t.Fatalf("timed out waiting for handler to finish")
-	}
-}
-
 func TestServer_DeltaAggregatedResources_v3_BasicProtocol_TCP_clusterChangesImpactEndpoints(t *testing.T) {
 	aclResolve := func(id string) (acl.Authorizer, error) {
 		// Allow all

agent/xds/envoy_versioning.go

@@ -11,9 +11,7 @@ import (
 var (
 	// minSupportedVersion is the oldest mainline version we support. This should always be
 	// the zero'th point release of the last element of proxysupport.EnvoyVersions.
-	minSupportedVersion = version.Must(version.NewVersion("1.18.0"))
+	minSupportedVersion = version.Must(version.NewVersion("1.19.0"))
-
-	minVersionToForceLDSandCDSToAlwaysUseWildcardsOnReconnect = version.Must(version.NewVersion("1.19.0"))
 
 	specificUnsupportedVersions = []unsupportedVersion{}
 )
@@ -25,19 +23,8 @@ type unsupportedVersion struct {
 }
 
 type supportedProxyFeatures struct {
-	// Older versions of Envoy incorrectly exploded a wildcard subscription for
+	// Put feature switches here when necessary. For reference, The most recent remove of a feature flag was removed in
-	// LDS and CDS into specific line items on incremental xDS reconnect. They
+	// <insert PR here>.
-	// would populate both InitialResourceVersions and ResourceNamesSubscribe
-	// when they SHOULD have left ResourceNamesSubscribe empty (or used an
-	// explicit "*" in later Envoy versions) to imply wildcard mode. On
-	// reconnect, Consul interpreted the lack of the wildcard attribute as
-	// implying that the Envoy instance should not receive updates for any
-	// newly created listeners and clusters for the remaining life of that
-	// Envoy sidecar process.
-	//
-	// see: https://github.com/envoyproxy/envoy/issues/16063
-	// see: https://github.com/envoyproxy/envoy/pull/16153
-	ForceLDSandCDSToAlwaysUseWildcardsOnReconnect bool
 }
 
 func determineSupportedProxyFeatures(node *envoy_core_v3.Node) (supportedProxyFeatures, error) {
@@ -75,9 +62,7 @@ func determineSupportedProxyFeaturesFromVersion(version *version.Version) (suppo
 
 	sf := supportedProxyFeatures{}
 
-	if version.LessThan(minVersionToForceLDSandCDSToAlwaysUseWildcardsOnReconnect) {
+	// when feature flags necessary, populate here by calling version.LessThan(...)
-		sf.ForceLDSandCDSToAlwaysUseWildcardsOnReconnect = true
-	}
 
 	return sf, nil
 }

agent/xds/envoy_versioning_test.go

@@ -118,10 +118,13 @@ func TestDetermineSupportedProxyFeaturesFromString(t *testing.T) {
 		"1.16.4": {expectErr: "Envoy 1.16.4 " + errTooOld},
 		"1.16.5": {expectErr: "Envoy 1.16.5 " + errTooOld},
 		"1.16.6": {expectErr: "Envoy 1.16.6 " + errTooOld},
+		"1.17.4": {expectErr: "Envoy 1.17.4 " + errTooOld},
+		"1.18.6": {expectErr: "Envoy 1.18.6 " + errTooOld},
 	}
 
 	// Insert a bunch of valid versions.
 	// Populate feature flags here when appropriate. See consul 1.10.x for reference.
+	/* Example from 1.18
 	for _, v := range []string{
 		"1.18.0", "1.18.1", "1.18.2", "1.18.3", "1.18.4", "1.18.5", "1.18.6",
 	} {
@@ -129,10 +132,12 @@ func TestDetermineSupportedProxyFeaturesFromString(t *testing.T) {
 			ForceLDSandCDSToAlwaysUseWildcardsOnReconnect: true,
 		}}
 	}
+	*/
 	for _, v := range []string{
 		"1.19.0", "1.19.1", "1.19.2", "1.19.3",
 		"1.20.0", "1.20.1", "1.20.2",
 		"1.21.1",
+		"1.22.0",
 	} {
 		cases[v] = testcase{expect: supportedProxyFeatures{}}
 	}

agent/xds/listeners.go

@@ -18,8 +18,13 @@ import (
 	envoy_core_v3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
 	envoy_listener_v3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
 	envoy_route_v3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	envoy_grpc_http1_bridge_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/grpc_http1_bridge/v3"
 	envoy_grpc_stats_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/grpc_stats/v3"
+	envoy_http_router_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/router/v3"
+	envoy_original_dst_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/original_dst/v3"
+	envoy_tls_inspector_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/tls_inspector/v3"
 	envoy_http_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	envoy_sni_cluster_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/sni_cluster/v3"
 	envoy_tcp_proxy_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/tcp_proxy/v3"
 	envoy_tls_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
 	envoy_type_v3 "github.com/envoyproxy/go-control-plane/envoy/type/v3"
@@ -80,18 +85,19 @@ func (s *ResourceGenerator) listenersFromSnapshotConnectProxy(cfgSnap *proxycfg.
 			port = cfgSnap.Proxy.TransparentProxy.OutboundListenerPort
 		}
 
+		originalDstFilter, err := makeEnvoyListenerFilter("envoy.filters.listener.original_dst", &envoy_original_dst_v3.OriginalDst{})
+		if err != nil {
+			return nil, err
+		}
+
 		outboundListener = makePortListener(OutboundListenerName, "127.0.0.1", port, envoy_core_v3.TrafficDirection_OUTBOUND)
 		outboundListener.FilterChains = make([]*envoy_listener_v3.FilterChain, 0)
 		outboundListener.ListenerFilters = []*envoy_listener_v3.ListenerFilter{
-			{
 			// The original_dst filter is a listener filter that recovers the original destination
 			// address before the iptables redirection. This filter is needed for transparent
 			// proxies because they route to upstreams using filter chains that match on the
 			// destination IP address. If the filter is not present, no chain will match.
-				//
+			originalDstFilter,
-				// TODO(tproxy): Hard-coded until we upgrade the go-control-plane library
-				Name: "envoy.filters.listener.original_dst",
-			},
 		}
 	}
 
@@ -1058,9 +1064,15 @@ func (s *ResourceGenerator) makeTerminatingGatewayListener(
 	if err != nil {
 		return nil, err
 	}
+
+	sniCluster, err := makeSNIClusterFilter()
+	if err != nil {
+		return nil, err
+	}
+
 	fallback := &envoy_listener_v3.FilterChain{
 		Filters: []*envoy_listener_v3.Filter{
-			{Name: "envoy.filters.network.sni_cluster"},
+			sniCluster,
 			tcpProxy,
 		},
 	}
@@ -1383,7 +1395,7 @@ func makeListenerFilter(opts listenerFilterOpts) (*envoy_listener_v3.Filter, err
 }
 
 func makeTLSInspectorListenerFilter() (*envoy_listener_v3.ListenerFilter, error) {
-	return &envoy_listener_v3.ListenerFilter{Name: "envoy.filters.listener.tls_inspector"}, nil
+	return makeEnvoyListenerFilter("envoy.filters.listener.tls_inspector", &envoy_tls_inspector_v3.TlsInspector{})
 }
 
 func makeSNIFilterChainMatch(sniMatches ...string) *envoy_listener_v3.FilterChainMatch {
@@ -1393,8 +1405,7 @@ func makeSNIFilterChainMatch(sniMatches ...string) *envoy_listener_v3.FilterChai
 }
 
 func makeSNIClusterFilter() (*envoy_listener_v3.Filter, error) {
-	// This filter has no config which is why we are not calling make
+	return makeFilter("envoy.filters.network.sni_cluster", &envoy_sni_cluster_v3.SniCluster{})
-	return &envoy_listener_v3.Filter{Name: "envoy.filters.network.sni_cluster"}, nil
 }
 
 func makeTCPProxyFilter(filterName, cluster, statPrefix string) (*envoy_listener_v3.Filter, error) {
@@ -1413,13 +1424,16 @@ func makeStatPrefix(prefix, filterName string) string {
 }
 
 func makeHTTPFilter(opts listenerFilterOpts) (*envoy_listener_v3.Filter, error) {
+	router, err := makeEnvoyHTTPFilter("envoy.filters.http.router", &envoy_http_router_v3.Router{})
+	if err != nil {
+		return nil, err
+	}
+
 	cfg := &envoy_http_v3.HttpConnectionManager{
 		StatPrefix: makeStatPrefix(opts.statPrefix, opts.filterName),
 		CodecType:  envoy_http_v3.HttpConnectionManager_AUTO,
 		HttpFilters: []*envoy_http_v3.HttpFilter{
-			{
+			router,
-				Name: "envoy.filters.http.router",
-			},
 		},
 		Tracing: &envoy_http_v3.HttpConnectionManager_Tracing{
 			// Don't trace any requests by default unless the client application
@@ -1508,10 +1522,13 @@ func makeHTTPFilter(opts listenerFilterOpts) (*envoy_listener_v3.Filter, error)
 	}
 
 	if opts.protocol == "grpc" {
-		// Add grpc bridge before router and authz
+		grpcHttp1Bridge, err := makeEnvoyHTTPFilter(
-		cfg.HttpFilters = append([]*envoy_http_v3.HttpFilter{{
+			"envoy.filters.http.grpc_http1_bridge",
-			Name: "envoy.filters.http.grpc_http1_bridge",
+			&envoy_grpc_http1_bridge_v3.Config{},
-		}}, cfg.HttpFilters...)
+		)
+		if err != nil {
+			return nil, err
+		}
 
 		// In envoy 1.14.x the default value "stats_for_all_methods=true" was
 		// deprecated, and was changed to "false" in 1.18.x. Avoid using the
@@ -1527,14 +1544,28 @@ func makeHTTPFilter(opts listenerFilterOpts) (*envoy_listener_v3.Filter, error)
 		if err != nil {
 			return nil, err
 		}
+
+		// Add grpc bridge before router and authz, and the stats in front of that.
 		cfg.HttpFilters = append([]*envoy_http_v3.HttpFilter{
 			grpcStatsFilter,
+			grpcHttp1Bridge,
 		}, cfg.HttpFilters...)
 	}
 
 	return makeFilter("envoy.filters.network.http_connection_manager", cfg)
 }
 
+func makeEnvoyListenerFilter(name string, cfg proto.Message) (*envoy_listener_v3.ListenerFilter, error) {
+	any, err := ptypes.MarshalAny(cfg)
+	if err != nil {
+		return nil, err
+	}
+	return &envoy_listener_v3.ListenerFilter{
+		Name:       name,
+		ConfigType: &envoy_listener_v3.ListenerFilter_TypedConfig{TypedConfig: any},
+	}, nil
+}
+
 func makeFilter(name string, cfg proto.Message) (*envoy_listener_v3.Filter, error) {
 	any, err := ptypes.MarshalAny(cfg)
 	if err != nil {

agent/xds/proxysupport/proxysupport.go

@@ -7,8 +7,8 @@ package proxysupport
 //
 // see: https://www.consul.io/docs/connect/proxies/envoy#supported-versions
 var EnvoyVersions = []string{
+	"1.22.0",
 	"1.21.1",
 	"1.20.2",
 	"1.19.3",
-	"1.18.6",
 }

agent/xds/testdata/listeners/connect-proxy-with-chain-and-overrides.latest.golden

@@ -36,10 +36,16 @@
                     }
                   },
                   {
-                    "name": "envoy.filters.http.grpc_http1_bridge"
+                    "name": "envoy.filters.http.grpc_http1_bridge",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.grpc_http1_bridge.v3.Config"
+                    }
                   },
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/connect-proxy-with-grpc-chain.latest.golden

@@ -36,10 +36,16 @@
                     }
                   },
                   {
-                    "name": "envoy.filters.http.grpc_http1_bridge"
+                    "name": "envoy.filters.http.grpc_http1_bridge",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.grpc_http1_bridge.v3.Config"
+                    }
                   },
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/connect-proxy-with-http-chain.latest.golden

@@ -29,7 +29,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/connect-proxy-with-http2-chain.latest.golden

@@ -29,7 +29,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/expose-checks.latest.golden

@@ -57,7 +57,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/expose-paths-local-app-paths.latest.golden

@@ -41,7 +41,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -96,7 +99,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/expose-paths-new-cluster-http2.latest.golden

@@ -41,7 +41,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -99,7 +102,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/http-listener-with-timeouts.latest.golden

@@ -101,7 +101,10 @@
                     }
                   },
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/http-public-listener.latest.golden

@@ -100,7 +100,10 @@
                     }
                   },
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/http-upstream.latest.golden

@@ -41,7 +41,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/ingress-http-multiple-services.latest.golden

@@ -29,7 +29,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -72,7 +75,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/ingress-splitter-with-resolver-redirect.latest.golden

@@ -29,7 +29,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/ingress-with-sds-listener+service-level.latest.golden

@@ -34,7 +34,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -96,7 +99,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -143,7 +149,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ],
       "trafficDirection": "OUTBOUND"

agent/xds/testdata/listeners/ingress-with-sds-listener-gw-level-http.latest.golden

@@ -29,7 +29,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/ingress-with-sds-service-level-mixed-no-tls.latest.golden

@@ -34,7 +34,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -96,7 +99,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -111,7 +117,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ],
       "trafficDirection": "OUTBOUND"

agent/xds/testdata/listeners/ingress-with-sds-service-level.latest.golden

@@ -34,7 +34,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -101,7 +104,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -148,7 +154,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ],
       "trafficDirection": "OUTBOUND"

agent/xds/testdata/listeners/ingress-with-single-tls-listener.latest.golden

@@ -29,7 +29,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -72,7 +75,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/ingress-with-tls-min-version-listeners-gateway-defaults.latest.golden

@@ -29,7 +29,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -99,7 +102,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -169,7 +175,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -239,7 +248,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -309,7 +321,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/ingress-with-tls-mixed-listeners.latest.golden

@@ -29,7 +29,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -99,7 +102,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/ingress-with-tls-mixed-min-version-listeners.latest.golden

@@ -29,7 +29,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -99,7 +102,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -169,7 +175,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/mesh-gateway-custom-addresses.latest.golden

@@ -65,7 +65,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -80,7 +83,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ]
     },
@@ -148,7 +154,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -163,7 +172,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ]
     },
@@ -231,7 +243,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -246,7 +261,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ]
     },
@@ -314,7 +332,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -329,7 +350,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ]
     }

agent/xds/testdata/listeners/mesh-gateway-no-services.latest.golden

@@ -14,7 +14,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -29,7 +32,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ]
     }

agent/xds/testdata/listeners/mesh-gateway-tagged-addresses.latest.golden

@@ -65,7 +65,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -80,7 +83,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ]
     },
@@ -148,7 +154,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -163,7 +172,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ]
     }

agent/xds/testdata/listeners/mesh-gateway-using-federation-states.latest.golden

@@ -65,7 +65,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -80,7 +83,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ]
     }

agent/xds/testdata/listeners/mesh-gateway.latest.golden

@@ -65,7 +65,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -80,7 +83,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ]
     }

agent/xds/testdata/listeners/splitter-with-resolver-redirect.latest.golden

@@ -29,7 +29,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {

agent/xds/testdata/listeners/terminating-gateway-custom-and-tagged-addresses.latest.golden

@@ -230,7 +230,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -245,7 +248,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ],
       "trafficDirection": "INBOUND"
@@ -479,7 +485,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -494,7 +503,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ],
       "trafficDirection": "INBOUND"

agent/xds/testdata/listeners/terminating-gateway-no-api-cert.latest.golden

@@ -176,7 +176,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -191,7 +194,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ],
       "trafficDirection": "INBOUND"

agent/xds/testdata/listeners/terminating-gateway-no-services.latest.golden

@@ -14,7 +14,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -29,7 +32,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ],
       "trafficDirection": "INBOUND"

agent/xds/testdata/listeners/terminating-gateway-service-subsets.latest.golden

@@ -205,7 +205,10 @@
                     }
                   },
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -276,7 +279,10 @@
                     }
                   },
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -347,7 +353,10 @@
                     }
                   },
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -389,7 +398,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -404,7 +416,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ],
       "trafficDirection": "INBOUND"

agent/xds/testdata/listeners/terminating-gateway-with-tls-incoming-cipher-suites.latest.golden

@@ -242,7 +242,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -257,7 +260,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ],
       "trafficDirection": "INBOUND"

agent/xds/testdata/listeners/terminating-gateway-with-tls-incoming-max-version.latest.golden

@@ -230,7 +230,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -245,7 +248,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ],
       "trafficDirection": "INBOUND"

agent/xds/testdata/listeners/terminating-gateway-with-tls-incoming-min-version.latest.golden

@@ -230,7 +230,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -245,7 +248,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ],
       "trafficDirection": "INBOUND"

agent/xds/testdata/listeners/terminating-gateway.latest.golden

@@ -230,7 +230,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -245,7 +248,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ],
       "trafficDirection": "INBOUND"

agent/xds/testdata/listeners/transparent-proxy-catalog-destinations-only.latest.golden

@@ -59,7 +59,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.original_dst"
+          "name": "envoy.filters.listener.original_dst",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.original_dst.v3.OriginalDst"
+          }
         }
       ],
       "trafficDirection": "OUTBOUND"

agent/xds/testdata/listeners/transparent-proxy-dial-instances-directly.latest.golden

@@ -115,7 +115,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.original_dst"
+          "name": "envoy.filters.listener.original_dst",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.original_dst.v3.OriginalDst"
+          }
         }
       ],
       "trafficDirection": "OUTBOUND"

agent/xds/testdata/listeners/transparent-proxy-http-upstream.latest.golden

@@ -78,7 +78,10 @@
                 },
                 "httpFilters": [
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -105,7 +108,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.original_dst"
+          "name": "envoy.filters.listener.original_dst",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.original_dst.v3.OriginalDst"
+          }
         }
       ],
       "trafficDirection": "OUTBOUND"

agent/xds/testdata/listeners/transparent-proxy-terminating-gateway.latest.golden

@@ -79,7 +79,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.original_dst"
+          "name": "envoy.filters.listener.original_dst",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.original_dst.v3.OriginalDst"
+          }
         }
       ],
       "trafficDirection": "OUTBOUND"

agent/xds/testdata/listeners/transparent-proxy.latest.golden

@@ -75,7 +75,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.original_dst"
+          "name": "envoy.filters.listener.original_dst",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.original_dst.v3.OriginalDst"
+          }
         }
       ],
       "trafficDirection": "OUTBOUND"

agent/xds/testdata/serverless_plugin/listeners/lambda-terminating-gateway-with-service-resolvers.latest.golden

@@ -158,7 +158,10 @@
                     }
                   },
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -237,7 +240,10 @@
                     }
                   },
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -370,7 +376,10 @@
                     }
                   },
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -413,7 +422,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -428,7 +440,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ],
       "trafficDirection": "INBOUND"

agent/xds/testdata/serverless_plugin/listeners/lambda-terminating-gateway.latest.golden

@@ -212,7 +212,10 @@
                     }
                   },
                   {
-                    "name": "envoy.filters.http.router"
+                    "name": "envoy.filters.http.router",
+                    "typedConfig": {
+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                    }
                   }
                 ],
                 "tracing": {
@@ -255,7 +258,10 @@
         {
           "filters": [
             {
-              "name": "envoy.filters.network.sni_cluster"
+              "name": "envoy.filters.network.sni_cluster",
+              "typedConfig": {
+                "@type": "type.googleapis.com/envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+              }
             },
             {
               "name": "envoy.filters.network.tcp_proxy",
@@ -270,7 +276,10 @@
       ],
       "listenerFilters": [
         {
-          "name": "envoy.filters.listener.tls_inspector"
+          "name": "envoy.filters.listener.tls_inspector",
+          "typedConfig": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+          }
         }
       ],
       "trafficDirection": "INBOUND"

agent/xds/xds_protocol_helpers_test.go

@@ -14,6 +14,7 @@ import (
 	envoy_listener_v3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
 	envoy_rbac_v3 "github.com/envoyproxy/go-control-plane/envoy/config/rbac/v3"
 	envoy_route_v3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	envoy_http_router_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/router/v3"
 	envoy_http_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
 	envoy_network_rbac_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/rbac/v3"
 	envoy_tcp_proxy_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/tcp_proxy/v3"
@@ -306,6 +307,18 @@ func xdsNewFilter(t *testing.T, name string, cfg proto.Message) *envoy_listener_
 	return f
 }
 
+func xdsNewListenerFilter(t *testing.T, name string, cfg proto.Message) *envoy_listener_v3.ListenerFilter {
+	f, err := makeEnvoyListenerFilter(name, cfg)
+	require.NoError(t, err)
+	return f
+}
+
+func xdsNewHttpFilter(t *testing.T, name string, cfg proto.Message) *envoy_http_v3.HttpFilter {
+	f, err := makeEnvoyHTTPFilter(name, cfg)
+	require.NoError(t, err)
+	return f
+}
+
 func mustHashResource(t *testing.T, res proto.Message) string {
 	v, err := hashResource(res)
 	require.NoError(t, err)
@@ -626,7 +639,7 @@ func makeTestListener(t *testing.T, snap *proxycfg.ConfigSnapshot, fixtureName s
 					Filters: []*envoy_listener_v3.Filter{
 						xdsNewFilter(t, "envoy.filters.network.http_connection_manager", &envoy_http_v3.HttpConnectionManager{
 							HttpFilters: []*envoy_http_v3.HttpFilter{
-								{Name: "envoy.filters.http.router"},
+								xdsNewHttpFilter(t, "envoy.filters.http.router", &envoy_http_router_v3.Router{}),
 							},
 							RouteSpecifier: &envoy_http_v3.HttpConnectionManager_RouteConfig{
 								RouteConfig: makeTestRoute(t, "http2:db:inline"),
@@ -651,7 +664,7 @@ func makeTestListener(t *testing.T, snap *proxycfg.ConfigSnapshot, fixtureName s
 					Filters: []*envoy_listener_v3.Filter{
 						xdsNewFilter(t, "envoy.filters.network.http_connection_manager", &envoy_http_v3.HttpConnectionManager{
 							HttpFilters: []*envoy_http_v3.HttpFilter{
-								{Name: "envoy.filters.http.router"},
+								xdsNewHttpFilter(t, "envoy.filters.http.router", &envoy_http_router_v3.Router{}),
 							},
 							RouteSpecifier: &envoy_http_v3.HttpConnectionManager_Rds{
 								Rds: &envoy_http_v3.Rds{
@@ -679,7 +692,7 @@ func makeTestListener(t *testing.T, snap *proxycfg.ConfigSnapshot, fixtureName s
 					Filters: []*envoy_listener_v3.Filter{
 						xdsNewFilter(t, "envoy.filters.network.http_connection_manager", &envoy_http_v3.HttpConnectionManager{
 							HttpFilters: []*envoy_http_v3.HttpFilter{
-								{Name: "envoy.filters.http.router"},
+								xdsNewHttpFilter(t, "envoy.filters.http.router", &envoy_http_router_v3.Router{}),
 							},
 							RouteSpecifier: &envoy_http_v3.HttpConnectionManager_Rds{
 								Rds: &envoy_http_v3.Rds{

command/connect/envoy/bootstrap_config.go

@@ -686,7 +686,10 @@ func (c *BootstrapConfig) generateListenerConfig(args *BootstrapTplArgs, bindAdd
 							},
 							"http_filters": [
 								{
-									"name": "envoy.filters.http.router"
+									"name": "envoy.filters.http.router",
+									"typedConfig": {
+									"@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+									}
 								}
 							]
 						}

command/connect/envoy/bootstrap_config_test.go

@@ -139,7 +139,10 @@ const (
 			},
 			"http_filters": [
 				{
-				  "name": "envoy.filters.http.router"
+					"name": "envoy.filters.http.router",
+					"typedConfig": {
+						"@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+					}
 				}
 			  ]
 			}
@@ -197,7 +200,10 @@ const (
 			},
 			"http_filters": [
 				{
-				  "name": "envoy.filters.http.router"
+					"name": "envoy.filters.http.router",
+					"typedConfig": {
+						"@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+					}
 				}
 			  ]
 			}
@@ -255,7 +261,10 @@ const (
 			},
 			"http_filters": [
 				{
-				  "name": "envoy.filters.http.router"
+					"name": "envoy.filters.http.router",
+					"typedConfig": {
+						"@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+					}
 				}
 			  ]
 			}
@@ -313,7 +322,10 @@ const (
             },
             "http_filters": [
               {
-                "name": "envoy.filters.http.router"
+                "name": "envoy.filters.http.router",
+                "typedConfig": {
+                  "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                }
               }
             ]
           }
@@ -371,7 +383,10 @@ const (
             },
             "http_filters": [
               {
-                "name": "envoy.filters.http.router"
+                "name": "envoy.filters.http.router",
+                "typedConfig": {
+                  "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                }
               }
             ]
           }

command/connect/envoy/testdata/ingress-gateway-address-specified.golden

@@ -121,7 +121,10 @@
                   },
                   "http_filters": [
                     {
-                      "name": "envoy.filters.http.router"
+                      "name": "envoy.filters.http.router",
+                      "typedConfig": {
+                        "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                      }
                     }
                   ]
                 }

command/connect/envoy/testdata/ingress-gateway-no-auto-register.golden

@@ -121,7 +121,10 @@
                   },
                   "http_filters": [
                     {
-                      "name": "envoy.filters.http.router"
+                      "name": "envoy.filters.http.router",
+                      "typedConfig": {
+                        "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                      }
                     }
                   ]
                 }

command/connect/envoy/testdata/ingress-gateway-register-with-service-and-proxy-id.golden

@@ -121,7 +121,10 @@
                   },
                   "http_filters": [
                     {
-                      "name": "envoy.filters.http.router"
+                      "name": "envoy.filters.http.router",
+                      "typedConfig": {
+                        "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                      }
                     }
                   ]
                 }

command/connect/envoy/testdata/ingress-gateway-register-with-service-without-proxy-id.golden

@@ -121,7 +121,10 @@
                   },
                   "http_filters": [
                     {
-                      "name": "envoy.filters.http.router"
+                      "name": "envoy.filters.http.router",
+                      "typedConfig": {
+                        "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                      }
                     }
                   ]
                 }

command/connect/envoy/testdata/ingress-gateway.golden

@@ -121,7 +121,10 @@
                   },
                   "http_filters": [
                     {
-                      "name": "envoy.filters.http.router"
+                      "name": "envoy.filters.http.router",
+                      "typedConfig": {
+                        "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                      }
                     }
                   ]
                 }

command/connect/envoy/testdata/prometheus-metrics.golden

@@ -121,7 +121,10 @@
                   },
                   "http_filters": [
                     {
-                      "name": "envoy.filters.http.router"
+                      "name": "envoy.filters.http.router",
+                      "typedConfig": {
+                        "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+                      }
                     }
                   ]
                 }

test/integration/connect/envoy/run-tests.sh

@@ -10,7 +10,7 @@ readonly HASHICORP_DOCKER_PROXY="docker.mirror.hashicorp.services"
 DEBUG=${DEBUG:-}
 
 # ENVOY_VERSION to run each test against
-ENVOY_VERSION=${ENVOY_VERSION:-"1.21.1"}
+ENVOY_VERSION=${ENVOY_VERSION:-"1.22.0"}
 export ENVOY_VERSION
 
 export DOCKER_BUILDKIT=1

website/content/docs/connect/proxies/envoy.mdx

@@ -36,7 +36,7 @@ Consul supports **four major Envoy releases** at the beginning of each major Con
 
 | Consul Version      | Compatible Envoy Versions                                                          |
 | ------------------- | -----------------------------------------------------------------------------------|
-| 1.12.x              | 1.21.1, 1.20.2, 1.19.3, 1.18.6                                                     |
+| 1.12.x              | 1.22.0, 1.21.1, 1.20.2, 1.19.3                                                     |
 | 1.11.x              | 1.20.2, 1.19.3, 1.18.6, 1.17.4<sup>1</sup>                                         |
 | 1.10.x              | 1.18.6, 1.17.4<sup>1</sup>, 1.16.5<sup>1</sup> , 1.15.5<sup>1</sup>                |
 | 1.9.x               | 1.16.5<sup>1</sup>, 1.15.5<sup>1</sup>, 1.14.7<sup>1,2</sup>, 1.13.7<sup>1,2</sup> |