should we explore letting users mix raw Envoy config into the Contour-generated output?

[skriss]

One way to give users more flexibility to customize the Envoy config without having to hand-code every desired tuneable would be to give them some way to mix raw Envoy config into Contour's generated output.

There are obviously plenty of complexities and pitfalls here so I'm not saying we definitely should do it; I'm just wondering if folks think it's something we should explore more, or whether it's a non-starter.

[jpeach]

Some related issues are #2385, #3006. Istio also has a CRD for patching Envoy config.

[skriss]

Also found #857 which has some interesting back-story and discussion.

[youngnick]

The problem here is that if we allow people do to this, how do we support them when it breaks? How do we ensure that people mixing in Envoy things won't inadvertently create a security problem (such as with the SNI routing problem that we had to do an inline Lua fix for?)

I agree that just giving people this would one hundred percent make a large class of issues go away, and people have asked for it specifically in the past. But is the tradeoff worth it? I'm not convinced it is.

What's Istio's stance on support for if you use the patching?

[jpeach]

The problem here is that if we allow people do to this, how do we support them when it breaks?

Yeh I think that we would want to provide substantially better debugging tools for this.