Description:
Per the discussion in PR 2559, Envoy's logic for determining whether any given request is internal or external, and what the trusted address of the origin client is, has become very complicated. And even with this complexity, the mechanism isn't sufficiently general to cover the needs of all users.

One potential improvement would be to create a plug-in interface so Envoy users can plug in their own logic. Another would be to simplify the configuration semantics for the current functionality.