Implement “REPLACE" operation in the Envoyfilter API

[zhaohuabing]

Describe the feature request

We want to use EnvoyFIlter API to add a Redis Proxy network filter in the listener, but it conflicts with the existing TCP proxy. Adding a "REPLACE" operation in the Envoyfilter API would solve this problem.

We can't use the Istio build-in Redis xDS implementation because it's too simple to support our Redis use case such as read policy and mirroring.

Describe alternatives you've considered

[ ] Docs
[ ] Installation
[*] Networking
[ ] Performance and Scalability
[ ] Extensions and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

Additional context

[howardjohn]

#27426

[hzxuzhonghu]

@zhaohuabing What's the background of implementing Replace? Especially only for NETWORK_FILTER and NETWORK_FILTER, isn't Remove & Add satisfying you?

[zhaohuabing]

@hzxuzhonghu The original reason is the one in the description of this issue:

We want to use EnvoyFIlter API to add a Redis Proxy network filter in the listener, but it conflicts with the existing TCP proxy. Adding a "REPLACE" operation in the Envoyfilter API would solve this problem.

Basically, sometimes we need to replace the TCP proxy in the listener with a more specific filter that can understand layer-7 traffic.

[hzxuzhonghu]

Yeah, i understand it. What i am confused is can Remove and Add do that too?

[zhaohuabing]

The semantic of "Remove & Add" is not exactly the same as "Replace", because order matters in a filter chain.

[hzxuzhonghu]

Got it, how about InsertBefore/After

[zhaohuabing]

Might work. But then the "Replace" logic would depend on other filters in the filter chain. I prefer "Replace" because it‘s more elegant. Is there any reason we want to eliminate the "Replace" operation?

[zhaohuabing]

Currently, Aeraki is heavily using "Replace" operation to replace the default TCP filter with protocol-specific filters to support other layer-7 protocols in Istio.

[hzxuzhonghu]

Not eliminate, just to be clear about the use case

[mandarjog]

@hzxuzhonghu replace is a cleaner version of merge, when you do not want merge semantics. Add-remove makes you handle handling, but replace does not.