Description:
Envoy can route traffic to clusters based on external given input, e.g. cluster_header in http_conn_manager, and there will be similar proposal for TCP in #4444. We should disallow traffic from listeners going to certain clusters, e.g. xDS API cluster (especially SDS), ratelimit cluster, ext_authz cluster etc.

cc @rshriram

Relevant Links:
#4444 (comment)