Add filter_chain HTTP filter

[Copilot]

Adds a new HTTP filter filter_chain that wraps a configurable chain of HTTP filters, enabling reusable filter chains with per-route selection.

API

New proto at api/envoy/extensions/filters/http/filter_chain/v3/filter_chain.proto:

• FilterChain: List of filters (min 1 required)
• FilterChainConfig: Default chain + named chains map
• FilterChainConfigPerRoute: Inline chain or named chain reference

Implementation

• Filter resolves chain at decodeHeaders: per-route inline > per-route named > default
• DelegatedFilterChain executes filters in order (decode) / reverse order (encode)
• Uses FilterChainUtility::createFilterChainForFactories for filter instantiation

Example

http_filters:
- name: envoy.filters.http.filter_chain
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.http.filter_chain.v3.FilterChainConfig
    filter_chain:
      filters:
      - name: envoy.filters.http.buffer
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.buffer.v3.Buffer
          max_request_bytes: 1024
    filter_chains:
      large_buffer:
        filters:
        - name: envoy.filters.http.buffer
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.http.buffer.v3.Buffer
            max_request_bytes: 65536

Per-route override:

typed_per_filter_config:
  envoy.filters.http.filter_chain:
    "@type": type.googleapis.com/envoy.extensions.filters.http.filter_chain.v3.FilterChainConfigPerRoute
    filter_chain_name: large_buffer

Files

• source/extensions/filters/http/filter_chain/ - Filter implementation
• test/extensions/filters/http/filter_chain/ - Unit + integration tests
• docs/root/configuration/http/http_filters/filter_chain_filter.rst - Documentation

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dl.google.com
  • Triggering command: /build/bazel_root/install/fb2a7f6d344d2f4e335882534df59296/embedded_tools/jdk/bin/java bazel(envoy) --add-opens=java.base/java.lang=ALL-UNNAMED -Xverify:none -Djava.util.logging.config.file=/build/bazel_root/base/javalog.properties -Dcom.google.devtools.build.lib.util.LogHandlerQuerier.class=com.google.devtools.build.lib.util.SimpleLogHandler$HandlerQuerier -XX:-MaxFDLimit -Djava.library.path=/build/bazel_root/install/fb2a7f6d344d2f4e335882534df59296/embedded_tools/jdk/lib:/build/bazel_root/install/fb2a7f6d344d2f4e335882534df59296/embedded_tools/jdk/lib/server:/build/bazel_root/install/fb2a7f6d344d2f4e335882534df59296/ -Dfile.encoding=ISO-8859-1 -Duser.country= -Duser.language= -Duser.variant= -Xmx3g -DBAZEL_TRACK_SOURCE_DIRECTORIES=1 -Djavax.net.ssl.trustStore=/tmp/custom-cacerts -Djavax.net.ssl.trustStorePassword=changeit -jar /build/bazel_root/install/fb2a7f6d344d2f4e335882534df59296/A-server.jar --max_idle_secs=10800 --noshutdown_on_low_sys_mem --connect_timeout_secs=30 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Create a new HTTP filter. The HTTP filter has a name 'filter_chain'. You should do this with following step:

1. You should design the API.

The API should contains a basic message FilterChain as following:

message FilterChain {
  // Add comment and PGV to ensure this filters contains at least one element
  repeated config.core.v3.TypedExtensionConfig filters = 1;
}

For every filter, we have a filter level config, it is composed of the FilterChain:

message FilterChainConfig {
  // Default filter chain applied when no other filter chains match.
  // This is optional.
  FilterChain filter_chain = 1;

  // Map of named filter chains. The key is an arbitrary name assigned to the filter chain.
  map<string, FilterChain> filter_chains = 2;
}

The filter also have a per route config:

message FilterChainConfigPerRoute {
  // Filter chain to be applied on this route.
  FilterChain filter_chain = 1;

  // Name of the filter chain to be applied on this route. This name should match
  // one of the names defined in the FilterChainConfig.filter_chains map.
  string filter_chain_name = 2;
}

Please add reasonable comment and link the API. You should could find an example in the envoy/api/envoy/extensions/filters/http/*
The API should be linked in the envoy/api/BUILD and envoy/api/versioning/BUILD

2. You should create the filter under the envoy/source/extensions/filters/http. You can find lots of examples in the envoy/source/extensions/filters/http/*

The new filter has no actual logic but works as a wrapper of a filter chain. It will load the configuration as a filter chain. You can take the envoy/source/common/http/filter_chain_helper.h and also envoy/source/common/http/filter_chain_helper.cc as reference to see how to loading a filter chain.

And when we need to create a new filter instance for a incoming HTTP request, it will search the route to see if there is a route level filter chain, if the route level filter chain is there, it will use it as priority. If there is no route level filter chain, the default one will be used.

3. You should create the test under the test/extensions/filters/http/. You can find lots of examples there. But it should contains:

• config loading test.
• function test
• integration test ensure the filter_chain filter could works as multiple filters' wrapper correctly.

4. You should add metadata in the envoy/source/extensions/extensions_metadata.yaml and envoy/source/extensions/extensions_build_config.bzl

5. You should create a document for this filter under envoy/docs/root/configuration/http/http_filters. You can find lots of cases at the envoy/docs/root/configuration/http/http_filters/*.

6. Check the STYLE.md ensure you code meet the requirement.

That's all. Let's start.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.