diff --git a/networking/v1alpha3/envoy_filter.pb.go b/networking/v1alpha3/envoy_filter.pb.go
index f35e7da8ea4..5f7a23157fe 100644
--- a/networking/v1alpha3/envoy_filter.pb.go
+++ b/networking/v1alpha3/envoy_filter.pb.go
@@ -16,6 +16,9 @@
 // The behavior is undefined if multiple EnvoyFilter configurations conflict
 // with each other.
 //
+// NOTE 3: For filters of `filterType: HTTP` you must include a `listenerMatch` section
+// with a `listenerProtocol: HTTP` or the filter have no effect.
+//
 // The following example for Kubernetes enables Envoy's Lua filter for all
 // inbound HTTP calls arriving at service port 8080 of the reviews service pod with
 // labels "app: reviews".
@@ -195,7 +198,7 @@ func (EnvoyFilter_Filter_FilterType) EnumDescriptor() ([]byte, []int) {
 }
 
 type EnvoyFilter struct {
-	// One or more labels that indicate a specific set of pods/VMs whose
+	// Zero or more labels that indicate a specific set of pods/VMs whose
 	// proxies should be configured to use these additional filters.  The
 	// scope of label search is platform dependent. On Kubernetes, for
 	// example, the scope includes pods running in all reachable
diff --git a/networking/v1alpha3/envoy_filter.pb.html b/networking/v1alpha3/envoy_filter.pb.html
index 2b4a7e7345d..d2be82dc024 100644
--- a/networking/v1alpha3/envoy_filter.pb.html
+++ b/networking/v1alpha3/envoy_filter.pb.html
@@ -21,6 +21,9 @@
 The behavior is undefined if multiple EnvoyFilter configurations conflict
 with each other.</p>
 
+<p>NOTE 3: For filters of <code>filterType: HTTP</code> you must include a <code>listenerMatch</code> section
+with a <code>listenerProtocol: HTTP</code> or the filter have no effect.</p>
+
 <p>The following example for Kubernetes enables Envoy&rsquo;s Lua filter for all
 inbound HTTP calls arriving at service port 8080 of the reviews service pod with
 labels &ldquo;app: reviews&rdquo;.</p>
@@ -59,7 +62,7 @@ <h2 id="EnvoyFilter">EnvoyFilter</h2>
 <td><code>workloadLabels</code></td>
 <td><code>map&lt;string,&nbsp;string&gt;</code></td>
 <td>
-<p>One or more labels that indicate a specific set of pods/VMs whose
+<p>Zero or more labels that indicate a specific set of pods/VMs whose
 proxies should be configured to use these additional filters.  The
 scope of label search is platform dependent. On Kubernetes, for
 example, the scope includes pods running in all reachable
diff --git a/networking/v1alpha3/envoy_filter.proto b/networking/v1alpha3/envoy_filter.proto
index acc76ce364a..a0aab1b7273 100644
--- a/networking/v1alpha3/envoy_filter.proto
+++ b/networking/v1alpha3/envoy_filter.proto
@@ -35,6 +35,9 @@ import "google/protobuf/struct.proto";
 // The behavior is undefined if multiple EnvoyFilter configurations conflict
 // with each other.
 //
+// NOTE 3: For filters of `filterType: HTTP` you must include a `listenerMatch` section
+// with a `listenerProtocol: HTTP` or the filter have no effect.
+//
 // The following example for Kubernetes enables Envoy's Lua filter for all
 // inbound HTTP calls arriving at service port 8080 of the reviews service pod with
 // labels "app: reviews".
@@ -63,7 +66,7 @@ package istio.networking.v1alpha3;
 option go_package = "istio.io/api/networking/v1alpha3";
 
 message EnvoyFilter {
-  // One or more labels that indicate a specific set of pods/VMs whose
+  // Zero or more labels that indicate a specific set of pods/VMs whose
   // proxies should be configured to use these additional filters.  The
   // scope of label search is platform dependent. On Kubernetes, for
   // example, the scope includes pods running in all reachable