Envoy filters are namespace based?

1

Hello,

Is there any relation with EnvoyFilters and the namespace they are deployed in ?

I am not able to figure out a way to apply the filter at a service/namespace level using “WorkloadLabels” as mentioned in the documentation:

spec:
  workloadLabels:
    app: reviews
  filters:
  - listenerMatch:
      portNumber: 8080
      listenerType: SIDECAR_INBOUND

only thing that works is listenerType=GATEWAY, which is breaking our system as for each call istio have to scan through the whole filter and for more than 5-10 requests per second it starts giving errors.

What are some best practices and pit-falls in applying EnvoyFilters ?