diff --git a/envoy/api/v2/cds.proto b/envoy/api/v2/cds.proto
index 00443e03..f3c41181 100644
--- a/envoy/api/v2/cds.proto
+++ b/envoy/api/v2/cds.proto
@@ -17,6 +17,7 @@ import "envoy/api/v2/eds.proto";
 import "envoy/type/percent.proto";
 
 import "google/api/annotations.proto";
+import "google/protobuf/any.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
@@ -46,7 +47,7 @@ service ClusterDiscoveryService {
 // [#protodoc-title: Clusters]
 
 // Configuration for a single upstream cluster.
-// [#comment:next free field: 36]
+// [#comment:next free field: 37]
 message Cluster {
   // Supplies the name of the cluster which must be unique across all clusters.
   // The cluster name is used when emitting
@@ -232,6 +233,13 @@ message Cluster {
   // specific options.
   map<string, google.protobuf.Struct> extension_protocol_options = 35;
 
+  // [#not-implemented-hide:]
+  // The extension_protocol_options field is used to provide extension-specific protocol options
+  // for upstream connections. The key should match the extension filter name, such as
+  // "envoy.filters.network.thrift_proxy". See the extension's documentation for details on
+  // specific options.
+  map<string, google.protobuf.Any> typed_extension_protocol_options = 36;
+
   reserved 15;
 
   // If the DNS refresh rate is specified and the cluster type is either
diff --git a/envoy/api/v2/core/base.proto b/envoy/api/v2/core/base.proto
index 602494fb..b597fa1a 100644
--- a/envoy/api/v2/core/base.proto
+++ b/envoy/api/v2/core/base.proto
@@ -3,6 +3,7 @@ syntax = "proto3";
 package envoy.api.v2.core;
 option go_package = "core";
 
+import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
@@ -186,7 +187,12 @@ message TransportSocket {
 
   // Implementation specific configuration which depends on the implementation being instantiated.
   // See the supported transport socket implementations for further documentation.
-  google.protobuf.Struct config = 2;
+  oneof config_type {
+    google.protobuf.Struct config = 2;
+
+    // [#not-implemented-hide:]
+    google.protobuf.Any typed_config = 3;
+  }
 }
 
 // Generic socket option message. This would be used to set socket options that
diff --git a/envoy/api/v2/core/grpc_service.proto b/envoy/api/v2/core/grpc_service.proto
index 6497543b..f4e919c4 100644
--- a/envoy/api/v2/core/grpc_service.proto
+++ b/envoy/api/v2/core/grpc_service.proto
@@ -4,6 +4,7 @@ package envoy.api.v2.core;
 
 import "envoy/api/v2/core/base.proto";
 
+import "google/protobuf/any.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/empty.proto";
@@ -78,7 +79,12 @@ message GrpcService {
 
       message MetadataCredentialsFromPlugin {
         string name = 1;
-        google.protobuf.Struct config = 2;
+        oneof config_type {
+          google.protobuf.Struct config = 2;
+
+          // [#not-implemented-hide:]
+          google.protobuf.Any typed_config = 3;
+        }
       }
 
       oneof credential_specifier {
diff --git a/envoy/api/v2/core/health_check.proto b/envoy/api/v2/core/health_check.proto
index 0810b22f..2ad6ed31 100644
--- a/envoy/api/v2/core/health_check.proto
+++ b/envoy/api/v2/core/health_check.proto
@@ -4,6 +4,7 @@ package envoy.api.v2.core;
 
 import "envoy/api/v2/core/base.proto";
 
+import "google/protobuf/any.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
@@ -154,7 +155,12 @@ message HealthCheck {
 
     // A custom health checker specific configuration which depends on the custom health checker
     // being instantiated. See :api:`envoy/config/health_checker` for reference.
-    google.protobuf.Struct config = 2;
+    oneof config_type {
+      google.protobuf.Struct config = 2;
+
+      // [#not-implemented-hide:]
+      google.protobuf.Any typed_config = 3;
+    }
   }
 
   oneof health_checker {
diff --git a/envoy/api/v2/listener/listener.proto b/envoy/api/v2/listener/listener.proto
index d72de02c..b224f840 100644
--- a/envoy/api/v2/listener/listener.proto
+++ b/envoy/api/v2/listener/listener.proto
@@ -8,6 +8,7 @@ import "envoy/api/v2/core/address.proto";
 import "envoy/api/v2/auth/cert.proto";
 import "envoy/api/v2/core/base.proto";
 
+import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
@@ -35,8 +36,12 @@ message Filter {
 
   // Filter specific configuration which depends on the filter being
   // instantiated. See the supported filters for further documentation.
-  google.protobuf.Struct config = 2;
+  oneof config_type {
+    google.protobuf.Struct config = 2;
 
+    // [#not-implemented-hide:]
+    google.protobuf.Any typed_config = 4;
+  }
   // [#not-implemented-hide:]
   message DeprecatedV1 {
     string type = 1;
@@ -191,7 +196,12 @@ message ListenerFilter {
   // * :ref:`envoy.listener.tls_inspector <config_listener_filters_tls_inspector>`
   string name = 1 [(validate.rules).string.min_bytes = 1];
 
-  // Filter specific configuration which depends on the filter being
-  // instantiated. See the supported filters for further documentation.
-  google.protobuf.Struct config = 2;
+  // Filter specific configuration which depends on the filter being instantiated.
+  // See the supported filters for further documentation.
+  oneof config_type {
+    google.protobuf.Struct config = 2;
+
+    // [#not-implemented-hide:]
+    google.protobuf.Any typed_config = 3;
+  }
 }
diff --git a/envoy/api/v2/route/route.proto b/envoy/api/v2/route/route.proto
index c576240a..fd5527bb 100644
--- a/envoy/api/v2/route/route.proto
+++ b/envoy/api/v2/route/route.proto
@@ -7,6 +7,7 @@ option java_generic_services = true;
 import "envoy/api/v2/core/base.proto";
 import "envoy/type/range.proto";
 
+import "google/protobuf/any.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
@@ -25,7 +26,7 @@ option (gogoproto.equal_all) = true;
 // host header. This allows a single listener to service multiple top level domain path trees. Once
 // a virtual host is selected based on the domain, the routes are processed in order to see which
 // upstream cluster to route to or whether to perform a redirect.
-// [#comment:next free field: 15]
+// [#comment:next free field: 16]
 message VirtualHost {
   // The logical name of the virtual host. This is used when emitting certain
   // statistics but is not relevant for routing.
@@ -112,6 +113,14 @@ message VirtualHost {
   // for if and how it is utilized.
   map<string, google.protobuf.Struct> per_filter_config = 12;
 
+  // [#not-implemented-hide:]
+  // The per_filter_config field can be used to provide virtual host-specific
+  // configurations for filters. The key should match the filter name, such as
+  // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
+  // specific; see the :ref:`HTTP filter documentation <config_http_filters>`
+  // for if and how it is utilized.
+  map<string, google.protobuf.Any> typed_per_filter_config = 15;
+
   // Decides whether the :ref:`x-envoy-attempt-count
   // <config_http_filters_router_x-envoy-attempt-count>` header should be included
   // in the upstream request. Setting this option will cause it to override any existing header
@@ -130,7 +139,7 @@ message VirtualHost {
 //
 //   Envoy supports routing on HTTP method via :ref:`header matching
 //   <envoy_api_msg_route.HeaderMatcher>`.
-// [#comment:next free field: 13]
+// [#comment:next free field: 14]
 message Route {
   // Route matching parameters.
   RouteMatch match = 1 [(validate.rules).message.required = true, (gogoproto.nullable) = false];
@@ -167,6 +176,14 @@ message Route {
   // if and how it is utilized.
   map<string, google.protobuf.Struct> per_filter_config = 8;
 
+  // [#not-implemented-hide:]
+  // The per_filter_config field can be used to provide route-specific
+  // configurations for filters. The key should match the filter name, such as
+  // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
+  // specific; see the :ref:`HTTP filter documentation <config_http_filters>` for
+  // if and how it is utilized.
+  map<string, google.protobuf.Any> typed_per_filter_config = 13;
+
   // Specifies a set of headers that will be added to requests matching this
   // route. Headers specified at this level are applied before headers from the
   // enclosing :ref:`envoy_api_msg_route.VirtualHost` and
@@ -200,7 +217,7 @@ message Route {
 // multiple upstream clusters along with weights that indicate the percentage of
 // traffic to be forwarded to each cluster. The router selects an upstream cluster based on the
 // weights.
-// [#comment:next free field: 10]
+// [#comment:next free field: 11]
 message WeightedCluster {
   message ClusterWeight {
     // Name of the upstream cluster. The cluster must exist in the
@@ -256,6 +273,14 @@ message WeightedCluster {
     // specific; see the :ref:`HTTP filter documentation <config_http_filters>`
     // for if and how it is utilized.
     map<string, google.protobuf.Struct> per_filter_config = 8;
+
+    // [#not-implemented-hide:]
+    // The per_filter_config field can be used to provide weighted cluster-specific
+    // configurations for filters. The key should match the filter name, such as
+    // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
+    // specific; see the :ref:`HTTP filter documentation <config_http_filters>`
+    // for if and how it is utilized.
+    map<string, google.protobuf.Any> typed_per_filter_config = 10;
   }
 
   // Specifies one or more upstream clusters associated with the route.
@@ -510,7 +535,12 @@ message RouteAction {
 
     message RetryPriority {
       string name = 1 [(validate.rules).string.min_bytes = 1];
-      google.protobuf.Struct config = 2;
+      oneof config_type {
+        google.protobuf.Struct config = 2;
+
+        // [#not-implemented-hide:]
+        google.protobuf.Any typed_config = 3;
+      }
     }
 
     // Specifies an implementation of a RetryPriority which is used to determine the
@@ -520,7 +550,12 @@ message RouteAction {
 
     message RetryHostPredicate {
       string name = 1 [(validate.rules).string.min_bytes = 1];
-      google.protobuf.Struct config = 2;
+      oneof config_type {
+        google.protobuf.Struct config = 2;
+
+        // [#not-implemented-hide:]
+        google.protobuf.Any typed_config = 3;
+      }
     }
 
     // Specifies a collection of RetryHostPredicates that will be consulted when selecting a host
diff --git a/envoy/config/filter/accesslog/v2/accesslog.proto b/envoy/config/filter/accesslog/v2/accesslog.proto
index fb1ec8e7..df9e8567 100644
--- a/envoy/config/filter/accesslog/v2/accesslog.proto
+++ b/envoy/config/filter/accesslog/v2/accesslog.proto
@@ -7,6 +7,7 @@ import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/route/route.proto";
 import "envoy/type/percent.proto";
 
+import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
 
 import "validate/validate.proto";
@@ -24,14 +25,19 @@ message AccessLog {
   // Filter which is used to determine if the access log needs to be written.
   AccessLogFilter filter = 2;
 
-  // Custom configuration that depends on the access log being instantiated. Built-in configurations
-  // include:
+  // Custom configuration that depends on the access log being instantiated. Built-in
+  // configurations include:
   //
   // #. "envoy.file_access_log": :ref:`FileAccessLog
   //    <envoy_api_msg_config.accesslog.v2.FileAccessLog>`
   // #. "envoy.http_grpc_access_log": :ref:`HttpGrpcAccessLogConfig
   //    <envoy_api_msg_config.accesslog.v2.HttpGrpcAccessLogConfig>`
-  google.protobuf.Struct config = 3;
+  oneof config_type {
+    google.protobuf.Struct config = 3;
+
+    // [#not-implemented-hide:]
+    google.protobuf.Any typed_config = 4;
+  }
 }
 
 message AccessLogFilter {
diff --git a/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto b/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto
index 07d57e36..09e8f526 100644
--- a/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto
+++ b/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto
@@ -9,6 +9,7 @@ import "envoy/api/v2/rds.proto";
 import "envoy/config/filter/accesslog/v2/accesslog.proto";
 import "envoy/type/percent.proto";
 
+import "google/protobuf/any.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
@@ -393,9 +394,14 @@ message HttpFilter {
   // * :ref:`envoy.squash <config_http_filters_squash>`
   string name = 1 [(validate.rules).string.min_bytes = 1];
 
-  // Filter specific configuration which depends on the filter being
-  // instantiated. See the supported filters for further documentation.
-  google.protobuf.Struct config = 2;
+  // Filter specific configuration which depends on the filter being instantiated. See the supported
+  // filters for further documentation.
+  oneof config_type {
+    google.protobuf.Struct config = 2;
+
+    // [#not-implemented-hide:]
+    google.protobuf.Any typed_config = 4;
+  }
 
   reserved 3;
 }
diff --git a/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto b/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto
index f8ea4e7d..1ce0d3b4 100644
--- a/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto
+++ b/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto
@@ -5,6 +5,7 @@ option go_package = "v2";
 
 import "envoy/config/filter/network/thrift_proxy/v2alpha1/route.proto";
 
+import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
 
 import "validate/validate.proto";
@@ -89,9 +90,14 @@ message ThriftFilter {
   // * :ref:`envoy.filters.thrift.rate_limit <config_thrift_filters_rate_limit>`
   string name = 1 [(validate.rules).string.min_bytes = 1];
 
-  // Filter specific configuration which depends on the filter being
-  // instantiated. See the supported filters for further documentation.
-  google.protobuf.Struct config = 2;
+  // Filter specific configuration which depends on the filter being instantiated. See the supported
+  // filters for further documentation.
+  oneof config_type {
+    google.protobuf.Struct config = 2;
+
+    // [#not-implemented-hide:]
+    google.protobuf.Any typed_config = 3;
+  }
 }
 
 // ThriftProtocolOptions specifies Thrift upstream protocol options. This object is used in
diff --git a/envoy/config/metrics/v2/stats.proto b/envoy/config/metrics/v2/stats.proto
index f623ed89..542920d8 100644
--- a/envoy/config/metrics/v2/stats.proto
+++ b/envoy/config/metrics/v2/stats.proto
@@ -9,6 +9,7 @@ option go_package = "v2";
 import "envoy/api/v2/core/address.proto";
 import "envoy/type/matcher/string.proto";
 
+import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
@@ -27,10 +28,14 @@ message StatsSink {
   // Sinks optionally support tagged/multiple dimensional metrics.
   string name = 1;
 
-  // Stats sink specific configuration which depends on the sink being
-  // instantiated. See :ref:`StatsdSink <envoy_api_msg_config.metrics.v2.StatsdSink>` for an
-  // example.
-  google.protobuf.Struct config = 2;
+  // Stats sink specific configuration which depends on the sink being instantiated. See
+  // :ref:`StatsdSink <envoy_api_msg_config.metrics.v2.StatsdSink>` for an example.
+  oneof config_type {
+    google.protobuf.Struct config = 2;
+
+    // [#not-implemented-hide:]
+    google.protobuf.Any typed_config = 3;
+  }
 }
 
 // Statistics configuration such as tagging.
diff --git a/envoy/config/overload/v2alpha/overload.proto b/envoy/config/overload/v2alpha/overload.proto
index 4559d0e9..6b37fe43 100644
--- a/envoy/config/overload/v2alpha/overload.proto
+++ b/envoy/config/overload/v2alpha/overload.proto
@@ -3,6 +3,7 @@ syntax = "proto3";
 package envoy.config.overload.v2alpha;
 option go_package = "v2alpha";
 
+import "google/protobuf/any.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 
@@ -26,7 +27,12 @@ message ResourceMonitor {
   string name = 1 [(validate.rules).string.min_bytes = 1];
 
   // Configuration for the resource monitor being instantiated.
-  google.protobuf.Struct config = 2;
+  oneof config_type {
+    google.protobuf.Struct config = 2;
+
+    // [#not-implemented-hide:]
+    google.protobuf.Any typed_config = 3;
+  }
 }
 
 message ThresholdTrigger {
diff --git a/envoy/config/trace/v2/trace.proto b/envoy/config/trace/v2/trace.proto
index 376948bb..16b06f4d 100644
--- a/envoy/config/trace/v2/trace.proto
+++ b/envoy/config/trace/v2/trace.proto
@@ -8,6 +8,7 @@ option go_package = "v2";
 
 import "envoy/api/v2/core/grpc_service.proto";
 
+import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
 
 import "google/protobuf/wrappers.proto";
@@ -26,12 +27,17 @@ message Tracing {
     // *envoy.dynamic.ot* are built-in trace drivers.
     string name = 1 [(validate.rules).string.min_bytes = 1];
 
-    // Trace driver specific configuration which depends on the driver being
-    // instantiated. See the :ref:`LightstepConfig
+    // Trace driver specific configuration which depends on the driver being instantiated.
+    // See the :ref:`LightstepConfig
     // <envoy_api_msg_config.trace.v2.LightstepConfig>`, :ref:`ZipkinConfig
     // <envoy_api_msg_config.trace.v2.ZipkinConfig>`, and :ref:`DynamicOtConfig
     // <envoy_api_msg_config.trace.v2.DynamicOtConfig>` trace drivers for examples.
-    google.protobuf.Struct config = 2;
+    oneof config_type {
+      google.protobuf.Struct config = 2;
+
+      // [#not-implemented-hide:]
+      google.protobuf.Any typed_config = 3;
+    }
   }
   // Provides configuration for the HTTP tracer.
   Http http = 1;