diff --git a/api/filter/network/tcp_proxy.proto b/api/filter/network/tcp_proxy.proto
index 417641ff..86c00829 100644
--- a/api/filter/network/tcp_proxy.proto
+++ b/api/filter/network/tcp_proxy.proto
@@ -13,8 +13,6 @@ import "validate/validate.proto";
 
 // [#protodoc-title: TCP Proxy]
 // TCP Proxy :ref:`configuration overview <config_network_filters_tcp_proxy>`.
-// [#v2-api-diff: The route match now takes place in the :ref:`FilterChainMatch
-// <envoy_api_msg_FilterChainMatch>` table].
 
 message TcpProxy {
   // The prefix to use when emitting :ref:`statistics
@@ -22,7 +20,17 @@ message TcpProxy {
   string stat_prefix = 1 [(validate.rules).string.min_bytes = 1];
 
   // The upstream cluster to connect to.
-  string cluster = 2 [(validate.rules).string.min_bytes = 1];
+  //
+  // .. note::
+  //
+  //  Once full filter chain matching is implemented in listeners, this field will become the only
+  //  way to configure the target cluster. All other matching will be done via :ref:`filter chain
+  //  matching rules <envoy_api_msg_FilterChainMatch>`. For very simple configurations, this field
+  //  can still be used to select the cluster when no other matching rules are required. Otherwise,
+  //  a :ref:`deprecated_v1 <envoy_api_field_filter.network.TcpProxy.deprecated_v1>` configuration
+  //  is required to use more complex routing in the interim.
+  //
+  string cluster = 2;
 
   // [#not-implemented-hide:] The idle timeout for connections managed by the TCP proxy
   // filter. The idle timeout is defined as the period in which there is no
@@ -39,11 +47,10 @@ message TcpProxy {
   // emitted by the this tcp_proxy.
   repeated accesslog.AccessLog access_log = 5;
 
-  // [#not-implemented-hide:]
+  // TCP Proxy filter configuration using V1 format, until Envoy gets the
+  // ability to match source/destination at the listener level (called
+  // :ref:`filter chain match <envoy_api_msg_FilterChainMatch>`).
   message DeprecatedV1 {
-    // [V2-API-DIFF] This is deprecated in v2. Routes will be matched using
-    // the FilterChainMatch in Listeners.
-    //
     // A TCP proxy route consists of a set of optional L4 criteria and the
     // name of a cluster. If a downstream connection matches all the
     // specified criteria, the cluster in the route is used for the
@@ -92,10 +99,11 @@ message TcpProxy {
 
     // The route table for the filter. All filter instances must have a route
     // table, even if it is empty.
-    repeated TCPRoute routes = 1;
+    repeated TCPRoute routes = 1 [(validate.rules).repeated .min_items = 1];
   }
 
-  // [#not-implemented-hide:] Hide from v2 docs.
+  // TCP Proxy filter configuration using deprecated V1 format. This is required for complex
+  // routing until filter chain matching in the listener is implemented.
   DeprecatedV1 deprecated_v1 = 6;
 
   // The maximum number of unsuccessful connection attempts that will be made before