Add a top-level HTTP Filter Chain Matcher for HCM

[agrawroh]

Description

We have a lot of use-cases where we need subset of routes having entirely different set of HTTP filters. For example, we need DFP + Router for a subset of routes and RBAC, Header Mutations, Compressor, Router for another set of routes.

Today, the only way to do this is to install all the HTTP filters in the main chain and turn them on or off using per-route filters and/or use something like Composite Filters along with ExtensionsWithMatcher but it's not very clean and scalable when you have thousands of routes.

Proposal

Add an http_filter_chain_matcher field to HttpConnectionManager that allows defining multiple named filter chains and matching logic to select between them. For example,

http_filter_chains:
  - name: dfp-chain
    typed_config: {...}
  - name: stateful-sessions-chain
    typed_config: {...}

http_filter_chain_matcher:
  matcher:
    matcher_list:
      matchers:
      - predicate:
          single_predicate:
            input:
              name: request-path
              typed_config:
                "@type": type.googleapis.com/envoy.type.matcher.v3.HttpRequestHeaderMatchInput
                header_name: ":path"
            value_match:
              prefix: "/storage/"
        on_match:
          action:
            name: pick-filter-chain
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpFilterChain
              name: dfp-chain
      
      - predicate:
          single_predicate:
            input:
              name: request-path
              typed_config:
                "@type": type.googleapis.com/envoy.type.matcher.v3.HttpRequestHeaderMatchInput
                header_name: ":path"
            value_match:
              prefix: "/api/"
        on_match:
          action:
            name: pick-filter-chain
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpFilterChain
              name: stateful-sessions-chain

This would be very similar to how we allow different Network Chains to be picked up using well defined L4 input criteria. We are extending that same approach to the HTTP filters.

All other features like per-route configs should keep working on the selected sub-filter chain as is.

cc @wbpcode @kyessenov

[yanavlasov]

I think this is a good idea.

[wbpcode]

Hmmm. My previous practice is to disable all the filters by default in the http_filters. And then, if we want per route filter chain, we only need to enable the necessary filter in specific route.

The advantage is most update could be done by RDS and no connection draining.

With the proposal in this issue, it not only bring a much more complex filter chains. And any update may need to drain the connection.

---

Given your example in the issue description, could we configure different set of routes in different VirtualHost or different RouteConfiguration in Scope RDS.
Then, we needn't to enable specific filters for every route one by one, we can enable it for specific VirtualHost or RouteConfiguration.

[wbpcode]

Or we will suggest to support filter list in the composer filter. It needn't bring too much complexity to our core API/code.

[wbpcode]

See also #40885 I think that API should be very similar with your API designed here except the API in the 40885 is an enhancement to the composite.