---
title: "Supported configuration"
url: "/reference/envoy-compatibility/supported-configuration/"
kind: "reference"
summary: "The full matrix of Envoy configuration Arion accepts: bootstrap, listeners, filters, routing, clusters and TLS, with what is refused."
---

> Arion site index: [/llms.txt](/llms.txt)

# Supported configuration

The full matrix of Envoy configuration Arion accepts: bootstrap, listeners, filters, routing, clusters and TLS, with what is refused.

Arion accepts a subset of Envoy configuration, and any config it accepts behaves essentially as it would in Envoy. Anything it cannot honour the same way is refused at load — or NACKed over xDS — rather than silently ignored; the reasoning behind this promise is on the [Envoy compatibility](@/docs/concepts/envoy-compatibility.md) page.

A field listed as not supported only causes an error when it is actually set to a non-default value, so configs that merely *could* use an unsupported feature still load. Errors name the offending field and its YAML path.

## Bootstrap

| Area | Status | Notes |
|---|---|---|
| `node` | Partial | `id` and `cluster` only, both required; `metadata`, `locality` and the rest are refused. |
| `admin` | Partial | `address` (socket address) only; `access_log`, `allow_paths`, `profile_path` are refused. |
| `static_resources` | Supported | `listeners`, `clusters`, `secrets`. |
| `dynamic_resources` | Partial | `ads_config.grpc_services` with `envoy_grpc` targets only; `lds_config`, `cds_config` and `google_grpc` are refused. See [xDS resource types](@/reference/xds/resource-types.md). |
| `stats_flush_interval` | Supported | Applies to stats sinks. |
| `stats_sinks` | Partial | The OpenTelemetry sink (`envoy.extensions.stat_sinks.open_telemetry.v3.SinkConfig`): `grpc_service` and `prefix` only. |
| `tracing`, `layered_runtime`, `overload_manager`, `watchdog`, `cluster_manager`, `stats_config`, `hds_config`, bootstrap extensions | Not supported | Tracing is configured on the HTTP connection manager instead. |

## Listeners

Reference: [listeners](@/reference/resources/listeners.md).

| Area | Status | Notes |
|---|---|---|
| `address.socket_address` | Partial | Literal IP addresses only; hostnames are not resolved for listener binds. |
| Internal listeners | Supported | Via `internal_listener: {}` in place of an address; reachable from clusters through internal addresses. |
| `socket_options` | Partial | At most one option, used for `SO_BINDTODEVICE` (requires `CAP_NET_RAW`). |
| `tcp_backlog_size` | Supported | Default 128. |
| Listener `access_log` | Supported | File, stdout and stderr loggers. |
| `filter_chains` | Supported | Each chain needs a unique `filter_chain_match` and a `name`. |
| `filter_chain_match` | Partial | `destination_port`, `prefix_ranges`, `source_prefix_ranges`, `source_ports`, `server_names` (no bare `*` entry). `transport_protocol`, `application_protocols`, `source_type`, `address_suffix` are refused. |
| `default_filter_chain` | Not supported | Refused when set; a chain without a `filter_chain_match` acts as the catch-all instead. |
| `listener_filters` | Partial | `tls_inspector`, `proxy_protocol`, listener `local_ratelimit` — see the [listener filter reference](@/reference/filters/listener/tls-inspector.md). |
| Chain `transport_socket` | Partial | `DownstreamTlsContext` and `RawBuffer`; `require_client_certificate` supported, `require_sni` refused. |
| UDP / QUIC listeners | Not supported | TCP only. |
| `additional_addresses`, `use_original_dst`, `filter_chain_matcher`, `connection_balance_config`, `reuse_port`, `bind_to_port`, `per_connection_buffer_limit_bytes`, listener-filter timeouts | Not supported | Refused when set. |

## Network filters

Five network filters exist. `RBAC`, `RateLimit` and `ConnectionLimit` must appear before the terminal filter of a chain, which is either the HTTP connection manager or the TCP proxy.

| Filter (`@type` under `typed_config`) | Status | Notes |
|---|---|---|
| `envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager` | Supported | See the [HCM reference](@/reference/filters/network/http-connection-manager.md) and the section below. |
| `envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy` | Partial | `cluster` / `weighted_clusters` and `access_log`; idle timeouts, tunneling and hash policy are refused. [Reference](@/reference/filters/network/tcp-proxy.md). |
| `envoy.extensions.filters.network.rbac.v3.RBAC` | Supported | Connection-level allow/deny. [Reference](@/reference/filters/network/rbac.md). |
| `envoy.extensions.filters.network.ratelimit.v3.RateLimit` | Supported | Global rate limiting over gRPC. [Reference](@/reference/filters/network/rate-limit.md). |
| `envoy.extensions.filters.network.connection_limit.v3.ConnectionLimit` | Supported | Per-filter-chain connection cap. [Reference](@/reference/filters/network/connection-limit.md). |

## HTTP connection manager

| Area | Status | Notes |
|---|---|---|
| `codec_type` | Partial | `AUTO`, `HTTP1`, `HTTP2`; HTTP/3 is not supported. |
| `route_config` / `rds` | Supported | Inline route config, or RDS with `config_source: { ads: {} }` only. |
| `http_filters` | Supported | The final filter must be the router, which cannot be disabled. |
| `request_timeout` | Supported | Whole-request timeout. |
| `upgrade_configs` | Partial | `websocket` only; CONNECT upgrades are refused. |
| XFF handling | Supported | `use_remote_address`, `skip_xff_append`, `xff_num_trusted_hops`. |
| Request IDs | Supported | `generate_request_id`, `preserve_external_request_id`, `always_set_request_id_in_response`. |
| `tracing` | Supported | OpenTelemetry tracer — see [tracing](@/docs/observe/tracing.md). |
| `access_log` | Partial | File, stdout, stderr with text format strings; see Observability below. |
| `early_header_mutation_extensions` | Supported | Header mutations applied before routing. |
| `normalize_path`, `merge_slashes`, `local_reply_config`, `stream_idle_timeout`, `server_name`, `max_request_headers_kb`, `forward_client_cert_details`, HTTP/1–2 protocol options on the HCM | Not supported | Refused when set; `stat_prefix` is accepted but ignored with a warning. |

## HTTP filters

Ten HTTP filters exist. Per-route overrides go in a route's `typed_per_filter_config`, either directly or wrapped in `envoy.config.route.v3.FilterConfig` (which adds `disabled`); virtual-host and route-config level overrides are not supported.

| Filter (`@type`) | Status | Per-route override | Notes |
|---|---|---|---|
| `envoy.extensions.filters.http.router.v3.Router` | Supported | — | Required terminal filter; its option fields are refused when set. [Reference](@/reference/filters/http/router.md). |
| `envoy.extensions.filters.http.cors.v3.Cors` / `CorsPolicy` | Supported | — | [Reference](@/reference/filters/http/cors.md). |
| `envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit` | Supported | `LocalRateLimit` | [Reference](@/reference/filters/http/local-rate-limit.md). |
| `envoy.extensions.filters.http.rbac.v3.RBAC` | Supported | `RBACPerRoute` | [Reference](@/reference/filters/http/rbac.md). |
| `envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication` | Supported | — | Local and remote JWKS. [Reference](@/reference/filters/http/jwt-authn.md). |
| `envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor` | Supported | `ExtProcPerRoute` | [Reference](@/reference/filters/http/ext-proc.md). |
| `envoy.extensions.filters.http.wasm.v3.Wasm` | Partial | — | Local module code only; remote fetch is refused. [Reference](@/reference/filters/http/wasm.md). |
| `arion.extensions.filters.http.mcp.mcp_gateway.v3.McpGateway` | Supported | — | Arion extension. [Reference](@/reference/filters/http/mcp-gateway.md). |
| `arion.extensions.filters.http.user_rate_limit.v3.UserRateLimiter` | Supported | — | Arion extension. [Reference](@/reference/filters/http/user-rate-limit.md). |
| `arion.extensions.filters.http.cedar.cedar_policy.v3.CedarPolicy` | Supported | — | Arion extension. [Reference](@/reference/filters/http/cedar-policy.md). |

## Routing

Reference: [routes](@/reference/resources/routes.md).

| Area | Status | Notes |
|---|---|---|
| Virtual host `domains` | Supported | Exact and wildcard domains, longest match wins. |
| Path match | Supported | `prefix`, `path`, `safe_regex`, `path_separated_prefix`; `case_sensitive`. |
| Header match | Supported | Exact, prefix, suffix, contains, safe_regex and present matchers. |
| Query parameter match | Supported | `present_match` and `string_match`. |
| Actions | Supported | `route`, `redirect`, `direct_response`. |
| Cluster selection | Supported | `cluster`, `weighted_clusters`, `cluster_header`. |
| Path rewrites | Supported | `prefix_rewrite` and `regex_rewrite`. |
| Retry policy | Supported | `retry_on` (`5xx`, `gateway-error`, `reset`, `connect-failure`, `envoy-ratelimited`, `retriable-4xx`, `refused-stream`, `retriable-status-codes`, `retriable-headers`, `http3-post-connect-failure`), `num_retries`, `per_try_timeout`, backoff, retriable status codes and headers; per virtual host or per route. |
| Hash policy | Supported | Source IP, header or query parameter, with `terminal`; used by ring-hash and Maglev clusters. |
| Header mutations | Supported | Request/response add and remove at route-config, virtual-host and route level; `most_specific_header_mutations_wins`. |
| Route `timeout` | Supported | Default 15s; `cluster_not_found_response_code` configurable. |
| `priority` | Supported | `DEFAULT` and `HIGH`, matching circuit-breaker threshold sets. |
| Host rewrite, request mirroring, hedging | Not supported | `host_rewrite_specifier`, `request_mirror_policies` and `hedge_policy` are refused when set. |

## Clusters

Reference: [clusters](@/reference/resources/clusters.md).

| Area | Status | Notes |
|---|---|---|
| `type: STATIC` | Supported | Requires `load_assignment`. |
| `type: STRICT_DNS` | Supported | Requires `load_assignment`; DNS tuning fields (`dns_refresh_rate`, `respect_dns_ttl`, resolvers) are refused. |
| `type: EDS` | Supported | Endpoints over ADS; `eds_cluster_config` is refused, so the EDS resource name is the cluster name. |
| `type: ORIGINAL_DST` | Supported | Requires `lb_policy: CLUSTER_PROVIDED`; destination from the connection, an HTTP header, or a metadata key; `upstream_port_override`. |
| `type: LOGICAL_DNS` | Not supported | Refused; use `STRICT_DNS`. |
| Custom cluster types (`cluster_type`) | Not supported | Refused. |
| `lb_policy` | Supported | `ROUND_ROBIN`, `RANDOM`, `LEAST_REQUEST`, `RING_HASH`, `MAGLEV`; `CLUSTER_PROVIDED` for original-destination clusters. |
| `load_balancing_policy` | Partial | The standard policies above plus an override-host policy (pick the host named by a header or metadata, with a fallback policy). |
| Endpoints | Supported | Socket, Unix pipe and internal addresses; per-endpoint `load_balancing_weight` and health status; endpoint groups carry `priority`, while `locality` itself is refused. |
| Health checks | Partial | HTTP, TCP and gRPC checkers; custom health checks and HTTP/3 codec are refused. See [health checks](@/docs/traffic/health-checks-and-resilience.md). |
| `circuit_breakers` | Partial | Per-priority `max_connections`, `max_requests`, `max_retries`, `track_remaining`; `max_pending_requests`, `retry_budget` and `max_connection_pools` are refused. |
| `outlier_detection` | Not supported | Refused when set. |
| Protocol options | Partial | `typed_extension_protocol_options` with `HttpProtocolOptions`: explicit HTTP/1.1 or HTTP/2 (with keepalive settings). `auto_config`, `use_downstream_protocol_config` and HTTP/3 are refused, as are the deprecated cluster-level protocol option fields. |
| `transport_socket` | Supported | `UpstreamTlsContext`, PROXY protocol upstream transport (v1/v2, pass-through TLVs) and `RawBuffer`. |
| `connect_timeout`, `cleanup_interval`, `upstream_bind_config` | Supported | Bind config carries a bind device only. |
| `lb_subset_config`, `common_lb_config`, upstream `filters`, `max_requests_per_connection`, `preconnect_policy` | Not supported | Refused when set. |

## Secrets and TLS

Reference: [secrets](@/reference/resources/secrets.md).

| Area | Status | Notes |
|---|---|---|
| Static `secrets` | Partial | `tls_certificate` (chain + key) and `validation_context`; `generic_secret` and `session_ticket_keys` are refused. |
| Certificate material | Supported | Any `DataSource`: file path, inline string or bytes, or an environment variable; `watched_directory` is refused. |
| SDS | Partial | Reference by `name` only; the per-secret `sds_config` source is refused (delivery is always the ADS stream). Removal deletes the stored secret; existing listeners and clusters retain their built TLS contexts until those consumers are updated. |
| Validation | Partial | `trusted_ca` with `trust_chain_verification` (including `ACCEPT_UNTRUSTED`), inline or via SDS name; `combined_validation_context` and certificate providers are refused. |
| TLS parameters | Partial | TLS 1.2 and 1.3 only: minimum and maximum protocol version (default minimum 1.2, TLS 1.0/1.1 refused); ALPN, cipher-suite and curve selection are refused. |
| Client certificates (mTLS) | Supported | `require_client_certificate` on the downstream context. |

## Observability outputs

| Area | Status | Notes |
|---|---|---|
| Access loggers | Partial | `envoy.access_loggers.file`, `stdout`, `stderr` with text formats (`text_format` or `text_format_source`, plus `omit_empty_values`); `json_format`, access-log `filter`, gRPC and OpenTelemetry loggers are refused. See [access-log operators](@/reference/observability/access-log-operators.md). |
| Stats sinks | Partial | OpenTelemetry gRPC sink only; delta reporting and tag options are refused. |
| Tracing | Supported | Configured per HTTP connection manager — see [tracing](@/docs/observe/tracing.md). |

## Commonly asked, not supported

Each of these is absent from Arion today. Setting the corresponding Envoy field or filter makes the config refuse to load, which is the intended behaviour: you find out at startup, not in production.

| Feature | Where it would appear |
|---|---|
| `ext_authz` (HTTP or network filter) | `http_filters` / filter chains |
| OAuth2 / OIDC filters | `http_filters` |
| Outlier detection | `clusters[].outlier_detection` |
| `LOGICAL_DNS` clusters | `clusters[].type` |
| Host rewrite | `route.host_rewrite_literal` and friends |
| Request mirroring | `route.request_mirror_policies` |
| Hedging | `route.hedge_policy` / HCM |
| Access log `json_format` | `access_log[].log_format` |
| Access-log filters and gRPC access loggers | `access_log[]` |
| Tap filter | `http_filters` |
| Compression / decompression filters | `http_filters` |
| UDP listeners, QUIC, HTTP/3 | listeners / codec / protocol options |

For authorization needs usually met with `ext_authz`, see [ext_proc](@/reference/filters/http/ext-proc.md), [RBAC](@/reference/filters/http/rbac.md) and [Cedar policies](@/docs/security/cedar-policies.md).