Default filter chain metadata change is not handled as in-place listener update

[guydc]

Title: Default filter chain metadata change causes listener drain

Description:
When changing metadata for default_filter_chain, envoy logs show use full listener update path [...] draining listener:

[2026-01-26 13:12:30.773][9595281][debug][config] [source/extensions/config_subscription/filesystem/filesystem_subscription_impl.cc:84] Filesystem config refresh for ./lds.yaml
[2026-01-26 13:12:30.774][9595281][debug][config] [source/common/listener_manager/listener_manager_impl.cc:602] begin add/update listener: name=listener_0 hash=3675755127090518437
[2026-01-26 13:12:30.774][9595281][debug][config] [source/common/listener_manager/listener_manager_impl.cc:641] use full listener update path for listener name=listener_0 hash=3675755127090518437
[2026-01-26 13:12:30.774][9595281][warning][config] [source/common/listener_manager/listener_impl.cc:1122] reuse_port was configured for TCP listener 'listener_0' and is being force disabled because Envoy is not running on Linux. See the documentation for more information.
[2026-01-26 13:12:30.774][9595281][debug][config] [source/common/listener_manager/listener_manager_impl.cc:91]   filter #0:
[2026-01-26 13:12:30.774][9595281][debug][config] [source/common/listener_manager/listener_manager_impl.cc:104]     name: envoy.http_connection_manager
[2026-01-26 13:12:30.775][9595281][debug][config] [source/common/listener_manager/listener_manager_impl.cc:107]   config: {"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","stat_prefix":"ingress_http","route_config":{"name":"local_route","virtual_hosts":[{"name":"local_service","domains":["*"],"routes":[{"match":{"prefix":"/"},"route":{"cluster":"example_proxy_cluster","host_rewrite_literal":"www.envoyproxy.io"}}]}]},"http_filters":[{"name":"envoy.router","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}]}
[2026-01-26 13:12:30.775][9595281][debug][config] [./source/common/http/filter_chain_helper.h:114]     http filter #0
[2026-01-26 13:12:30.775][9595281][debug][config] [./source/common/http/filter_chain_helper.h:160]       name: envoy.router
[2026-01-26 13:12:30.775][9595281][debug][config] [./source/common/http/filter_chain_helper.h:163]     config: {"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}
[2026-01-26 13:12:30.775][9595281][debug][config] [source/common/listener_manager/filter_chain_manager_impl.cc:163] new fc_contexts has 0 filter chains, including 0 newly built
[2026-01-26 13:12:30.775][9595281][debug][config] [source/common/listener_manager/listener_impl.cc:985] add warming listener: name=listener_0, original_hash=3675755127090518437, tag=3, address=0.0.0.0:10000
[2026-01-26 13:12:30.775][9595281][debug][misc] [source/common/listener_manager/listener_impl.cc:994] Initialize listener listener_0 local-init-manager.
[2026-01-26 13:12:30.775][9595281][debug][init] [source/common/init/manager_impl.cc:49] init manager Listener-local-init-manager listener_0 3675755127090518437 contains no targets
[2026-01-26 13:12:30.775][9595281][debug][init] [source/common/init/watcher_impl.cc:14] init manager Listener-local-init-manager listener_0 3675755127090518437 initialized, notifying Listener-local-init-watcher listener_0
[2026-01-26 13:12:30.775][9595281][debug][config] [source/common/listener_manager/listener_impl.cc:985] warm complete. updating active listener: name=listener_0, original_hash=3675755127090518437, tag=3, address=0.0.0.0:10000
[2026-01-26 13:12:30.775][9595281][debug][config] [source/common/listener_manager/listener_impl.cc:985] draining listener: name=listener_0, original_hash=3792342053112638741, tag=2, address=0.0.0.0:10000
[2026-01-26 13:12:30.775][9595281][info][upstream] [source/common/listener_manager/lds_api.cc:106] lds: add/update listener 'listener_0'

The stat envoy_listener_manager_listener_in_place_updated is not increased.

However, when changing metadata of a filter chain in filter_chains, an in-place update takes place: use in place update filter chain update [...] execute in place filter chain update

[2026-01-26 13:21:15.038][9611864][debug][config] [source/extensions/config_subscription/filesystem/filesystem_subscription_impl.cc:84] Filesystem config refresh for ./lds.yaml
[2026-01-26 13:21:15.038][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:602] begin add/update listener: name=listener_0 hash=11006731002365401332
[2026-01-26 13:21:15.038][9611864][warning][config] [source/common/listener_manager/listener_impl.cc:1122] reuse_port was configured for TCP listener 'listener_0' and is being force disabled because Envoy is not running on Linux. See the documentation for more information.
[2026-01-26 13:21:15.038][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:634] use in place update filter chain update path for listener name=listener_0 hash=11006731002365401332
[2026-01-26 13:21:15.039][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:91]   filter #0:
[2026-01-26 13:21:15.039][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:104]     name: envoy.http_connection_manager
[2026-01-26 13:21:15.039][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:107]   config: {"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","stat_prefix":"ingress_http","route_config":{"name":"local_route","virtual_hosts":[{"name":"local_service","domains":["*"],"routes":[{"match":{"prefix":"/"},"route":{"cluster":"example_proxy_cluster","host_rewrite_literal":"www.envoyproxy.io"}}]}]},"http_filters":[{"name":"envoy.router","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}]}
[2026-01-26 13:21:15.039][9611864][debug][config] [./source/common/http/filter_chain_helper.h:114]     http filter #0
[2026-01-26 13:21:15.039][9611864][debug][config] [./source/common/http/filter_chain_helper.h:160]       name: envoy.router
[2026-01-26 13:21:15.039][9611864][debug][config] [./source/common/http/filter_chain_helper.h:163]     config: {"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}
[2026-01-26 13:21:15.040][9611864][debug][config] [source/common/listener_manager/filter_chain_manager_impl.cc:163] new fc_contexts has 1 filter chains, including 1 newly built
[2026-01-26 13:21:15.040][9611864][debug][config] [source/common/listener_manager/listener_impl.cc:985] add warming listener: name=listener_0, original_hash=11006731002365401332, tag=1, address=0.0.0.0:10000
[2026-01-26 13:21:15.040][9611864][debug][misc] [source/common/listener_manager/listener_impl.cc:994] Initialize listener listener_0 local-init-manager.
[2026-01-26 13:21:15.040][9611864][debug][init] [source/common/init/manager_impl.cc:49] init manager Listener-local-init-manager listener_0 11006731002365401332 contains no targets
[2026-01-26 13:21:15.040][9611864][debug][init] [source/common/init/watcher_impl.cc:14] init manager Listener-local-init-manager listener_0 11006731002365401332 initialized, notifying Listener-local-init-watcher listener_0
[2026-01-26 13:21:15.040][9611864][debug][config] [source/common/listener_manager/listener_impl.cc:985] execute in place filter chain update: name=listener_0, original_hash=11006731002365401332, tag=1, address=0.0.0.0:10000
[2026-01-26 13:21:15.040][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:829] replacing existing listener 1
[2026-01-26 13:21:15.040][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:829] replacing existing listener 1
[2026-01-26 13:21:15.040][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:829] replacing existing listener 1
[2026-01-26 13:21:15.040][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:829] replacing existing listener 1
[2026-01-26 13:21:15.040][9611874][trace][conn_handler] [source/common/listener_manager/active_tcp_listener.cc:76] replacing listener 
[2026-01-26 13:21:15.040][9611876][trace][conn_handler] [source/common/listener_manager/active_tcp_listener.cc:76] replacing listener 
[2026-01-26 13:21:15.040][9611877][trace][conn_handler] [source/common/listener_manager/active_tcp_listener.cc:76] replacing listener 
[2026-01-26 13:21:15.040][9611875][trace][conn_handler] [source/common/listener_manager/active_tcp_listener.cc:76] replacing listener 
[2026-01-26 13:21:15.040][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:829] replacing existing listener 1
[2026-01-26 13:21:15.040][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:829] replacing existing listener 1
[2026-01-26 13:21:15.040][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:829] replacing existing listener 1
[2026-01-26 13:21:15.040][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:829] replacing existing listener 1
[2026-01-26 13:21:15.040][9611880][trace][conn_handler] [source/common/listener_manager/active_tcp_listener.cc:76] replacing listener 
[2026-01-26 13:21:15.040][9611878][trace][conn_handler] [source/common/listener_manager/active_tcp_listener.cc:76] replacing listener 
[2026-01-26 13:21:15.040][9611879][trace][conn_handler] [source/common/listener_manager/active_tcp_listener.cc:76] replacing listener 
[2026-01-26 13:21:15.040][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:829] replacing existing listener 1
[2026-01-26 13:21:15.040][9611864][debug][config] [source/common/listener_manager/listener_manager_impl.cc:829] replacing existing listener 1
[2026-01-26 13:21:15.040][9611883][trace][conn_handler] [source/common/listener_manager/active_tcp_listener.cc:76] replacing listener 
[2026-01-26 13:21:15.040][9611864][debug][config] [source/common/listener_manager/listener_impl.cc:985] draining 1 filter chains in listener listener_0: name=listener_0, original_hash=17310385338202933281, tag=1, address=0.0.0.0:10000

The stat envoy_listener_manager_listener_in_place_updated is not increased. The stat total_listeners_draining is increased for duration of the drain.

Config:

Example (use dynamic lds and change metadata section):

resources:
  - "@type": type.googleapis.com/envoy.config.listener.v3.Listener
    name: listener_0
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 10000
    default_filter_chain:
      metadata:
        filterMetadata:
          namespace:
            foo: bar
      filters:
        - name: envoy.http_connection_manager
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
            stat_prefix: ingress_http
            http_filters:
              - name: envoy.router
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
            route_config:
              name: local_route
              virtual_hosts:
                - name: local_service
                  domains:
                    - "*"
                  routes:
                    - match:
                        prefix: "/"
                      route:
                        host_rewrite_literal: www.envoyproxy.io
                        cluster: example_proxy_cluster

[kyessenov]

The logic for deciding what amounts to a valid in-place upgrade is somewhat ad-hoc. Is it not consistent with the other filter chain for the default filter chain?

[guydc]

updates of metadata in a filter_chains filter chain seems to be handled as in-place without triggering a listener drain.

It also appears that the intention was to treat default_filter_chain similarly, e.g. as seen here: https://github.com/envoyproxy/envoy/blob/5a84ad367fea22dd900610b9d27e0902ff935234/source/common/listener_manager/listener_impl.cc#L1288-L1300/