Arion accepts a subset of Envoy configuration, and any config it accepts behaves essentially as it would in Envoy. Anything it cannot honour the same way is refused at load — or NACKed over xDS — rather than silently ignored; the reasoning behind this promise is on the Envoy compatibility page.
A field listed as not supported only causes an error when it is actually set to a non-default value, so configs that merely could use an unsupported feature still load. Errors name the offending field and its YAML path.
Bootstrap
| Area | Status | Notes |
|---|---|---|
node | Partial | id and cluster only, both required; metadata, locality and the rest are refused. |
admin | Partial | address (socket address) only; access_log, allow_paths, profile_path are refused. |
static_resources | Supported | listeners, clusters, secrets. |
dynamic_resources | Partial | ads_config.grpc_services with envoy_grpc targets only; lds_config, cds_config and google_grpc are refused. See xDS resource types. |
stats_flush_interval | Supported | Applies to stats sinks. |
stats_sinks | Partial | The OpenTelemetry sink (envoy.extensions.stat_sinks.open_telemetry.v3.SinkConfig): grpc_service and prefix only. |
tracing, layered_runtime, overload_manager, watchdog, cluster_manager, stats_config, hds_config, bootstrap extensions | Not supported | Tracing is configured on the HTTP connection manager instead. |
Listeners
Reference: listeners.
| Area | Status | Notes |
|---|---|---|
address.socket_address | Partial | Literal IP addresses only; hostnames are not resolved for listener binds. |
| Internal listeners | Supported | Via internal_listener: {} in place of an address; reachable from clusters through internal addresses. |
socket_options | Partial | At most one option, used for SO_BINDTODEVICE (requires CAP_NET_RAW). |
tcp_backlog_size | Supported | Default 128. |
Listener access_log | Supported | File, stdout and stderr loggers. |
filter_chains | Supported | Each chain needs a unique filter_chain_match and a name. |
filter_chain_match | Partial | destination_port, prefix_ranges, source_prefix_ranges, source_ports, server_names (no bare * entry). transport_protocol, application_protocols, source_type, address_suffix are refused. |
default_filter_chain | Not supported | Refused when set; a chain without a filter_chain_match acts as the catch-all instead. |
listener_filters | Partial | tls_inspector, proxy_protocol, listener local_ratelimit — see the listener filter reference. |
Chain transport_socket | Partial | DownstreamTlsContext and RawBuffer; require_client_certificate supported, require_sni refused. |
| UDP / QUIC listeners | Not supported | TCP only. |
additional_addresses, use_original_dst, filter_chain_matcher, connection_balance_config, reuse_port, bind_to_port, per_connection_buffer_limit_bytes, listener-filter timeouts | Not supported | Refused when set. |
Network filters
Five network filters exist. RBAC, RateLimit and ConnectionLimit must appear before the terminal filter of a chain, which is either the HTTP connection manager or the TCP proxy.
Filter (@type under typed_config) | Status | Notes |
|---|---|---|
envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager | Supported | See the HCM reference and the section below. |
envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy | Partial | cluster / weighted_clusters and access_log; idle timeouts, tunneling and hash policy are refused. Reference. |
envoy.extensions.filters.network.rbac.v3.RBAC | Supported | Connection-level allow/deny. Reference. |
envoy.extensions.filters.network.ratelimit.v3.RateLimit | Supported | Global rate limiting over gRPC. Reference. |
envoy.extensions.filters.network.connection_limit.v3.ConnectionLimit | Supported | Per-filter-chain connection cap. Reference. |
HTTP connection manager
| Area | Status | Notes |
|---|---|---|
codec_type | Partial | AUTO, HTTP1, HTTP2; HTTP/3 is not supported. |
route_config / rds | Supported | Inline route config, or RDS with config_source: { ads: {} } only. |
http_filters | Supported | The final filter must be the router, which cannot be disabled. |
request_timeout | Supported | Whole-request timeout. |
upgrade_configs | Partial | websocket only; CONNECT upgrades are refused. |
| XFF handling | Supported | use_remote_address, skip_xff_append, xff_num_trusted_hops. |
| Request IDs | Supported | generate_request_id, preserve_external_request_id, always_set_request_id_in_response. |
tracing | Supported | OpenTelemetry tracer — see tracing. |
access_log | Partial | File, stdout, stderr with text format strings; see Observability below. |
early_header_mutation_extensions | Supported | Header mutations applied before routing. |
normalize_path, merge_slashes, local_reply_config, stream_idle_timeout, server_name, max_request_headers_kb, forward_client_cert_details, HTTP/1–2 protocol options on the HCM | Not supported | Refused when set; stat_prefix is accepted but ignored with a warning. |
HTTP filters
Ten HTTP filters exist. Per-route overrides go in a route's typed_per_filter_config, either directly or wrapped in envoy.config.route.v3.FilterConfig (which adds disabled); virtual-host and route-config level overrides are not supported.
Filter (@type) | Status | Per-route override | Notes |
|---|---|---|---|
envoy.extensions.filters.http.router.v3.Router | Supported | — | Required terminal filter; its option fields are refused when set. Reference. |
envoy.extensions.filters.http.cors.v3.Cors / CorsPolicy | Supported | — | Reference. |
envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit | Supported | LocalRateLimit | Reference. |
envoy.extensions.filters.http.rbac.v3.RBAC | Supported | RBACPerRoute | Reference. |
envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication | Supported | — | Local and remote JWKS. Reference. |
envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor | Supported | ExtProcPerRoute | Reference. |
envoy.extensions.filters.http.wasm.v3.Wasm | Partial | — | Local module code only; remote fetch is refused. Reference. |
arion.extensions.filters.http.mcp.mcp_gateway.v3.McpGateway | Supported | — | Arion extension. Reference. |
arion.extensions.filters.http.user_rate_limit.v3.UserRateLimiter | Supported | — | Arion extension. Reference. |
arion.extensions.filters.http.cedar.cedar_policy.v3.CedarPolicy | Supported | — | Arion extension. Reference. |
Routing
Reference: routes.
| Area | Status | Notes |
|---|---|---|
Virtual host domains | Supported | Exact and wildcard domains, longest match wins. |
| Path match | Supported | prefix, path, safe_regex, path_separated_prefix; case_sensitive. |
| Header match | Supported | Exact, prefix, suffix, contains, safe_regex and present matchers. |
| Query parameter match | Supported | present_match and string_match. |
| Actions | Supported | route, redirect, direct_response. |
| Cluster selection | Supported | cluster, weighted_clusters, cluster_header. |
| Path rewrites | Supported | prefix_rewrite and regex_rewrite. |
| Retry policy | Supported | retry_on (5xx, gateway-error, reset, connect-failure, envoy-ratelimited, retriable-4xx, refused-stream, retriable-status-codes, retriable-headers, http3-post-connect-failure), num_retries, per_try_timeout, backoff, retriable status codes and headers; per virtual host or per route. |
| Hash policy | Supported | Source IP, header or query parameter, with terminal; used by ring-hash and Maglev clusters. |
| Header mutations | Supported | Request/response add and remove at route-config, virtual-host and route level; most_specific_header_mutations_wins. |
Route timeout | Supported | Default 15s; cluster_not_found_response_code configurable. |
priority | Supported | DEFAULT and HIGH, matching circuit-breaker threshold sets. |
| Host rewrite, request mirroring, hedging | Not supported | host_rewrite_specifier, request_mirror_policies and hedge_policy are refused when set. |
Clusters
Reference: clusters.
| Area | Status | Notes |
|---|---|---|
type: STATIC | Supported | Requires load_assignment. |
type: STRICT_DNS | Supported | Requires load_assignment; DNS tuning fields (dns_refresh_rate, respect_dns_ttl, resolvers) are refused. |
type: EDS | Supported | Endpoints over ADS; eds_cluster_config is refused, so the EDS resource name is the cluster name. |
type: ORIGINAL_DST | Supported | Requires lb_policy: CLUSTER_PROVIDED; destination from the connection, an HTTP header, or a metadata key; upstream_port_override. |
type: LOGICAL_DNS | Not supported | Refused; use STRICT_DNS. |
Custom cluster types (cluster_type) | Not supported | Refused. |
lb_policy | Supported | ROUND_ROBIN, RANDOM, LEAST_REQUEST, RING_HASH, MAGLEV; CLUSTER_PROVIDED for original-destination clusters. |
load_balancing_policy | Partial | The standard policies above plus an override-host policy (pick the host named by a header or metadata, with a fallback policy). |
| Endpoints | Supported | Socket, Unix pipe and internal addresses; per-endpoint load_balancing_weight and health status; endpoint groups carry priority, while locality itself is refused. |
| Health checks | Partial | HTTP, TCP and gRPC checkers; custom health checks and HTTP/3 codec are refused. See health checks. |
circuit_breakers | Partial | Per-priority max_connections, max_requests, max_retries, track_remaining; max_pending_requests, retry_budget and max_connection_pools are refused. |
outlier_detection | Not supported | Refused when set. |
| Protocol options | Partial | typed_extension_protocol_options with HttpProtocolOptions: explicit HTTP/1.1 or HTTP/2 (with keepalive settings). auto_config, use_downstream_protocol_config and HTTP/3 are refused, as are the deprecated cluster-level protocol option fields. |
transport_socket | Supported | UpstreamTlsContext, PROXY protocol upstream transport (v1/v2, pass-through TLVs) and RawBuffer. |
connect_timeout, cleanup_interval, upstream_bind_config | Supported | Bind config carries a bind device only. |
lb_subset_config, common_lb_config, upstream filters, max_requests_per_connection, preconnect_policy | Not supported | Refused when set. |
Secrets and TLS
Reference: secrets.
| Area | Status | Notes |
|---|---|---|
Static secrets | Partial | tls_certificate (chain + key) and validation_context; generic_secret and session_ticket_keys are refused. |
| Certificate material | Supported | Any DataSource: file path, inline string or bytes, or an environment variable; watched_directory is refused. |
| SDS | Partial | Reference by name only; the per-secret sds_config source is refused (delivery is always the ADS stream). Removal deletes the stored secret; existing listeners and clusters retain their built TLS contexts until those consumers are updated. |
| Validation | Partial | trusted_ca with trust_chain_verification (including ACCEPT_UNTRUSTED), inline or via SDS name; combined_validation_context and certificate providers are refused. |
| TLS parameters | Partial | TLS 1.2 and 1.3 only: minimum and maximum protocol version (default minimum 1.2, TLS 1.0/1.1 refused); ALPN, cipher-suite and curve selection are refused. |
| Client certificates (mTLS) | Supported | require_client_certificate on the downstream context. |
Observability outputs
| Area | Status | Notes |
|---|---|---|
| Access loggers | Partial | envoy.access_loggers.file, stdout, stderr with text formats (text_format or text_format_source, plus omit_empty_values); json_format, access-log filter, gRPC and OpenTelemetry loggers are refused. See access-log operators. |
| Stats sinks | Partial | OpenTelemetry gRPC sink only; delta reporting and tag options are refused. |
| Tracing | Supported | Configured per HTTP connection manager — see tracing. |
Commonly asked, not supported
Each of these is absent from Arion today. Setting the corresponding Envoy field or filter makes the config refuse to load, which is the intended behaviour: you find out at startup, not in production.
| Feature | Where it would appear |
|---|---|
ext_authz (HTTP or network filter) | http_filters / filter chains |
| OAuth2 / OIDC filters | http_filters |
| Outlier detection | clusters[].outlier_detection |
LOGICAL_DNS clusters | clusters[].type |
| Host rewrite | route.host_rewrite_literal and friends |
| Request mirroring | route.request_mirror_policies |
| Hedging | route.hedge_policy / HCM |
Access log json_format | access_log[].log_format |
| Access-log filters and gRPC access loggers | access_log[] |
| Tap filter | http_filters |
| Compression / decompression filters | http_filters |
| UDP listeners, QUIC, HTTP/3 | listeners / codec / protocol options |
For authorization needs usually met with ext_authz, see ext_proc, RBAC and Cedar policies.