The docs for upstream filters imply that all network filters work: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/filter.proto#envoy-v3-api-msg-config-cluster-v3-filter

In reality, the network filter needs to be registered specifically as an upstream network filter: a NamedUpstreamNetworkFilterConfigFactory needs to be registered vs a NamedNetworkFilterConfigFactory.

This should be made clearer in the docs.