Blocking:

1. Fix When cluster is removed and added back, Envoy fails to properly send a new SDS request, leading to all requests getting 503 (TestIngressRequestAuthentication failure) #28315
2. Provide a way for ext_authz services to be sent. Probably also will need Telemetry provider as well when we have that?
3. Either automagically solve EnvoyFilter references as well, OR add upgrade note for this and provide some way to manually work around it
4. Fix 503 during VirtualService update in 1.8 #29310 (new cluster races reference to it)