I noticed in the docs:

port: (required, integer) The TCP port that the listener should listen on. Currently only TCP listeners are supported which bind to all local interfaces.

I would like to use envoy to terminate both incoming and outgoing Mutual Auth TLS (with service type specific certs). For this to work in a secure fashion I need egress ports to bind to 127.0.0.1 so that random folks on the network can't hit envoy and use it to impersonate the service using envoy. Is there any sense on how difficult it would be to add this functionality? I wouldn't mind contributing a patchset but I have no idea where to start.