Starting with #3778, Envoy ignores unknown fields in the configuration. This is enabled by default and without the ability to turn it off, which already lead to invalid configuration sneaking into tests (see: #4051).

Presumably, the reasoning behind that change was for proxies to be able to accept configuration produced by newer control planes, effectively ignoring new features they don't know about yet.

Unfortunately, this leads to Envoy silently accepting invalid (e.g. simple typo means that the setting is ignored and feature is not configured) and/or not working (e.g. new feature that's required for the deployment is silently ignored by older proxies, leading to unexpected behavior) configurations.

Having said that, we cannot rely on proxies and control planes always being in sync, and the drift can happen the other way around as well, i.e. having proxies with new features, without the ability to configure or even disable (!) them by older control planes, so we should have a solution for both scenarios.

Ultimately, having new features disabled by default and requiring explicit opt-in, might be the safest and easiest option to solve that. Though, it pushes the responsibility for configuring sane defaults onto control planes.

As for the unknown fields in the configuration, I think that control planes could send a list of fields that are safe to be ignored by the proxies.

Thoughts?

cc @mattklein123 @alyssawilk @htuch @ggreenway @kyessenov @rshriram