envoy: add Tap http filter if configured

[denniskniep]

Summary

If configured an tap http filter is added to the envoy config.
The added tap filter is configured for admin control and therefore available if the envoy admin endpoint is configured.

How to test

Prerequisite enable envoy admin endpoint via config:
envoy_admin_address: localhost:9901

Set config envoy_admin_enable_tap to true

and subscribe to the tap:

curl -X POST http://localhost:9901/tap -H "Content-Type: application/yaml" \
-d 'config_id: downstream
tap_config:
  match_config:
    any_match: true
  output_config:
    sinks:
      - format: JSON_BODY_AS_STRING
        streaming_admin: {}'

see also:

• Pure Envoy Demo: https://github.com/denniskniep/envoy-tap-and-accesslogs-demo
• Docs: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/tap_filter

Checklist

• reference any related issues
• updated docs
• updated unit tests
• updated UPGRADING.md
• add appropriate tag (improvement / bug / etc)
• ready for review

[desimone]

Thanks @denniskniep -- I know we covered this async, but would you mind filling out a corresponding feature request to capture the use case behind this addition? In general, we try to think super carefully about new configuration surface area so I'd love to bubble this up.

[denniskniep]

@desimone I raised a corresponding feature request, see #5052

[desimone]

Thank you @denniskniep; will review next product planning session.