wellknown.OriginalDestination:         "envoy.listener.original_dst",
		"envoy.filters.listener.original_src": "envoy.listener.original_src",
		wellknown.ProxyProtocol:               "envoy.listener.proxy_protocol",
		wellknown.TLSInspector:                "envoy.listener.tls_inspector",
		wellknown.ClientSSLAuth:               "envoy.client_ssl_auth",
		wellknown.ExternalAuthorization:       "envoy.ext_authz",

			ListenerFilters: []*listener.ListenerFilter{
				{
					Name: "http-filter-to-be-removed-then-add",
				},
				{
					Name: "before proxy_protocol",
				},
				{
					Name: "envoy.filters.listener.proxy_protocol",
				},
				{
					Name: "after proxy_protocol",
				},
			},
		},
		{
			Name: "network-filter-to-be-replaced",
			Address: &core.Address{

)

// Listener filter names
const (
	// OriginalDestination listener filter
	OriginalDestination = "envoy.filters.listener.original_dst"
	// ProxyProtocol listener filter
	ProxyProtocol = "envoy.filters.listener.proxy_protocol"
	// TLSInspector listener filter
	TLSInspector = "envoy.filters.listener.tls_inspector" // nolint:golint,revive
	// HTTPInspector listener filter

	"fmt"
	"reflect"
	"testing"

	cluster "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
	core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
	proxyprotocol "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/proxy_protocol/v3"
	tls "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"

	networking "istio.io/api/networking/v1alpha3"
	"istio.io/istio/pilot/pkg/model"

			TypedConfig: protoconv.MessageToAny(&originalsrc.OriginalSrc{
				Mark: 1337,
			}),
		},
	}
	ProxyProtocol = &listener.ListenerFilter{
		Name: wellknown.ProxyProtocol,
		ConfigType: &listener.ListenerFilter_TypedConfig{
			TypedConfig: protoconv.MessageToAny(&proxy_proto.ProxyProtocol{}),
		},
	}
	EmptySessionFilter = &hcm.HttpFilter{
		Name: util.StatefulSessionFilter,

	loadBalancer := policy.LoadBalancer
	tls := policy.Tls
	proxyProtocol := policy.ProxyProtocol

	// Check if CA Certificate should be System CA Certificate
	if features.VerifyCertAtClient && tls != nil && tls.CaCertificates == "" {
		tls.CaCertificates = "system"
	}

	return connectionPool, outlierDetection, loadBalancer, tls, proxyProtocol
}

	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/original_src/v3"
	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/proxy_protocol/v3"
	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/tls_inspector/v3"
	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/connection_limit/v3"

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
- |
  **Added** support for outbound traffic Proxy Protocol. By specifying proxyProtocol in a DestinationRule.trafficPolicy,

				Scheme:  scheme.TCP,
				Address: gateway,
				// Envoy requires PROXY protocol TCP payloads have a minimum size, see:
				// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/listener/proxy_protocol/v3/proxy_protocol.proto
				// If the PROXY protocol filter is enabled, Envoy should parse and consume the header out of the TCP payload, otherwise echo it back as-is.
				Message:              "This is a test TCP message",

- name: "etcd"
  connection:
    proxyProtocol: "Direct"
`,
			expectedResult: &apiserver.EgressSelectorConfiguration{
				TypeMeta: metav1.TypeMeta{
					Kind:       "",
					APIVersion: "",
				},
				EgressSelections: []apiserver.EgressSelection{
					{
						Name: "cluster",
						Connection: apiserver.Connection{
							ProxyProtocol: "HTTPConnect",
							Transport: &apiserver.Transport{