Problem Statement

Envoy currently supports route configuration isolation in multi tenant environments by allowing a Listener FilterChain to specify a FilterChainMatch based on IP, TCP and TLS layer attributes.

When tenancy can be determined via these types of attributes, a FilterChain can be instantiated with a corresponding HttpConnectionManager RouteConfiguration proto (via static config or RDS) that corresponds to the tenant.

This issue tracks a design proposal to also support tenant differentiation via HTTP layer attributes, such that a single Listener -> HttpConnectionManager filter can be used to process requests for multiple tenants, each of which must be assigned its own RouteConfiguration.

Design Proposal

The design proposal extends Envoy with a Scoped Route Discovery Service API, which supports creating route configuration "scopes" indexed via a dynamically generated key extracted from HTTP layer attributes.

The proposed enhancement can be used to satisfy other use cases as well, such as #4690.