diff --git a/api/envoy/api/v2/cds.proto b/api/envoy/api/v2/cds.proto
index 55d4e19727a17..f4209f85ab75b 100644
--- a/api/envoy/api/v2/cds.proto
+++ b/api/envoy/api/v2/cds.proto
@@ -610,7 +610,7 @@ message Cluster {
   // for upstream connections. The key should match the extension filter name, such as
   // "envoy.filters.network.thrift_proxy". See the extension's documentation for details on
   // specific options.
-  map<string, google.protobuf.Struct> extension_protocol_options = 35;
+  map<string, google.protobuf.Struct> extension_protocol_options = 35 [deprecated = true];
 
   // The extension_protocol_options field is used to provide extension-specific protocol options
   // for upstream connections. The key should match the extension filter name, such as
@@ -810,7 +810,7 @@ message LoadBalancingPolicy {
 
     // Optional config for the LB policy.
     // No more than one of these two fields may be populated.
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
     google.protobuf.Any typed_config = 3;
   }
diff --git a/api/envoy/api/v2/core/base.proto b/api/envoy/api/v2/core/base.proto
index 52184fd4a6c61..6d6bab9e3fb05 100644
--- a/api/envoy/api/v2/core/base.proto
+++ b/api/envoy/api/v2/core/base.proto
@@ -240,7 +240,7 @@ message TransportSocket {
   // Implementation specific configuration which depends on the implementation being instantiated.
   // See the supported transport socket implementations for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
     google.protobuf.Any typed_config = 3;
   }
diff --git a/api/envoy/api/v2/core/grpc_service.proto b/api/envoy/api/v2/core/grpc_service.proto
index 767b24e86716d..8614c86ee30e6 100644
--- a/api/envoy/api/v2/core/grpc_service.proto
+++ b/api/envoy/api/v2/core/grpc_service.proto
@@ -80,7 +80,7 @@ message GrpcService {
         string name = 1;
 
         oneof config_type {
-          google.protobuf.Struct config = 2;
+          google.protobuf.Struct config = 2 [deprecated = true];
 
           google.protobuf.Any typed_config = 3;
         }
diff --git a/api/envoy/api/v2/core/health_check.proto b/api/envoy/api/v2/core/health_check.proto
index 5740ff340ada4..cd6fd79a324e0 100644
--- a/api/envoy/api/v2/core/health_check.proto
+++ b/api/envoy/api/v2/core/health_check.proto
@@ -157,7 +157,7 @@ message HealthCheck {
     // A custom health checker specific configuration which depends on the custom health checker
     // being instantiated. See :api:`envoy/config/health_checker` for reference.
     oneof config_type {
-      google.protobuf.Struct config = 2;
+      google.protobuf.Struct config = 2 [deprecated = true];
 
       google.protobuf.Any typed_config = 3;
     }
diff --git a/api/envoy/api/v2/listener/listener.proto b/api/envoy/api/v2/listener/listener.proto
index 13311ec5e8d87..dbe3d351ece49 100644
--- a/api/envoy/api/v2/listener/listener.proto
+++ b/api/envoy/api/v2/listener/listener.proto
@@ -31,7 +31,7 @@ message Filter {
   // Filter specific configuration which depends on the filter being
   // instantiated. See the supported filters for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
     google.protobuf.Any typed_config = 4;
   }
@@ -212,7 +212,7 @@ message ListenerFilter {
   // Filter specific configuration which depends on the filter being instantiated.
   // See the supported filters for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
     google.protobuf.Any typed_config = 3;
   }
diff --git a/api/envoy/api/v2/route/route.proto b/api/envoy/api/v2/route/route.proto
index 15a8fc1edc720..8fad335774cc7 100644
--- a/api/envoy/api/v2/route/route.proto
+++ b/api/envoy/api/v2/route/route.proto
@@ -117,7 +117,7 @@ message VirtualHost {
   // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
   // specific; see the :ref:`HTTP filter documentation <config_http_filters>`
   // for if and how it is utilized.
-  map<string, google.protobuf.Struct> per_filter_config = 12;
+  map<string, google.protobuf.Struct> per_filter_config = 12 [deprecated = true];
 
   // The per_filter_config field can be used to provide virtual host-specific
   // configurations for filters. The key should match the filter name, such as
@@ -197,7 +197,7 @@ message Route {
   // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
   // specific; see the :ref:`HTTP filter documentation <config_http_filters>` for
   // if and how it is utilized.
-  map<string, google.protobuf.Struct> per_filter_config = 8;
+  map<string, google.protobuf.Struct> per_filter_config = 8 [deprecated = true];
 
   // The per_filter_config field can be used to provide route-specific
   // configurations for filters. The key should match the filter name, such as
@@ -303,7 +303,7 @@ message WeightedCluster {
     // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
     // specific; see the :ref:`HTTP filter documentation <config_http_filters>`
     // for if and how it is utilized.
-    map<string, google.protobuf.Struct> per_filter_config = 8;
+    map<string, google.protobuf.Struct> per_filter_config = 8 [deprecated = true];
 
     // The per_filter_config field can be used to provide weighted cluster-specific
     // configurations for filters. The key should match the filter name, such as
@@ -869,7 +869,7 @@ message RetryPolicy {
     string name = 1 [(validate.rules).string = {min_bytes: 1}];
 
     oneof config_type {
-      google.protobuf.Struct config = 2;
+      google.protobuf.Struct config = 2 [deprecated = true];
 
       google.protobuf.Any typed_config = 3;
     }
@@ -879,7 +879,7 @@ message RetryPolicy {
     string name = 1 [(validate.rules).string = {min_bytes: 1}];
 
     oneof config_type {
-      google.protobuf.Struct config = 2;
+      google.protobuf.Struct config = 2 [deprecated = true];
 
       google.protobuf.Any typed_config = 3;
     }
diff --git a/api/envoy/api/v3alpha/cds.proto b/api/envoy/api/v3alpha/cds.proto
index 4902e2756ccbd..4099ae767e5d8 100644
--- a/api/envoy/api/v3alpha/cds.proto
+++ b/api/envoy/api/v3alpha/cds.proto
@@ -449,9 +449,9 @@ message Cluster {
     google.protobuf.Duration max_interval = 2 [(validate.rules).duration = {gt {nanos: 1000000}}];
   }
 
-  reserved 12, 15, 11;
+  reserved 12, 15, 11, 35;
 
-  reserved "tls_context";
+  reserved "tls_context", "extension_protocol_options";
 
   // Configuration to use different transport sockets for different endpoints.
   // The entry of *envoy.transport_socket* in the
@@ -595,12 +595,6 @@ message Cluster {
   // connections to happen over plain text.
   core.Http2ProtocolOptions http2_protocol_options = 14;
 
-  // The extension_protocol_options field is used to provide extension-specific protocol options
-  // for upstream connections. The key should match the extension filter name, such as
-  // "envoy.filters.network.thrift_proxy". See the extension's documentation for details on
-  // specific options.
-  map<string, google.protobuf.Struct> extension_protocol_options = 35;
-
   // The extension_protocol_options field is used to provide extension-specific protocol options
   // for upstream connections. The key should match the extension filter name, such as
   // "envoy.filters.network.thrift_proxy". See the extension's documentation for details on
@@ -794,13 +788,13 @@ message Cluster {
 // type LoadBalancingPolicy that specifies the child policy.
 message LoadBalancingPolicy {
   message Policy {
+    reserved 2;
+
+    reserved "config";
+
     // Required. The name of the LB policy.
     string name = 1;
 
-    // Optional config for the LB policy.
-    // No more than one of these two fields may be populated.
-    google.protobuf.Struct config = 2;
-
     google.protobuf.Any typed_config = 3;
   }
 
diff --git a/api/envoy/api/v3alpha/core/base.proto b/api/envoy/api/v3alpha/core/base.proto
index 5856d9ea4d812..04de5b4f6c916 100644
--- a/api/envoy/api/v3alpha/core/base.proto
+++ b/api/envoy/api/v3alpha/core/base.proto
@@ -234,6 +234,10 @@ message AsyncDataSource {
 // empty, a default transport socket implementation and configuration will be
 // chosen based on the platform and existence of tls_context.
 message TransportSocket {
+  reserved 2;
+
+  reserved "config";
+
   // The name of the transport socket to instantiate. The name must match a supported transport
   // socket implementation.
   string name = 1 [(validate.rules).string = {min_bytes: 1}];
@@ -241,8 +245,6 @@ message TransportSocket {
   // Implementation specific configuration which depends on the implementation being instantiated.
   // See the supported transport socket implementations for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
-
     google.protobuf.Any typed_config = 3;
   }
 }
diff --git a/api/envoy/api/v3alpha/core/grpc_service.proto b/api/envoy/api/v3alpha/core/grpc_service.proto
index 3d977f8765601..c02e438faf96f 100644
--- a/api/envoy/api/v3alpha/core/grpc_service.proto
+++ b/api/envoy/api/v3alpha/core/grpc_service.proto
@@ -77,11 +77,13 @@ message GrpcService {
       }
 
       message MetadataCredentialsFromPlugin {
+        reserved 2;
+
+        reserved "config";
+
         string name = 1;
 
         oneof config_type {
-          google.protobuf.Struct config = 2;
-
           google.protobuf.Any typed_config = 3;
         }
       }
diff --git a/api/envoy/api/v3alpha/core/health_check.proto b/api/envoy/api/v3alpha/core/health_check.proto
index eb42ba9375493..e95f7943f537d 100644
--- a/api/envoy/api/v3alpha/core/health_check.proto
+++ b/api/envoy/api/v3alpha/core/health_check.proto
@@ -151,14 +151,16 @@ message HealthCheck {
 
   // Custom health check.
   message CustomHealthCheck {
+    reserved 2;
+
+    reserved "config";
+
     // The registered name of the custom health checker.
     string name = 1 [(validate.rules).string = {min_bytes: 1}];
 
     // A custom health checker specific configuration which depends on the custom health checker
     // being instantiated. See :api:`envoy/config/health_checker` for reference.
     oneof config_type {
-      google.protobuf.Struct config = 2;
-
       google.protobuf.Any typed_config = 3;
     }
   }
diff --git a/api/envoy/api/v3alpha/listener/listener.proto b/api/envoy/api/v3alpha/listener/listener.proto
index 5c35cc2458a5f..b964f1d3f9680 100644
--- a/api/envoy/api/v3alpha/listener/listener.proto
+++ b/api/envoy/api/v3alpha/listener/listener.proto
@@ -19,7 +19,9 @@ import "validate/validate.proto";
 // Listener :ref:`configuration overview <config_listeners>`
 
 message Filter {
-  reserved 3;
+  reserved 3, 2;
+
+  reserved "config";
 
   // The name of the filter to instantiate. The name must match a
   // :ref:`supported filter <config_network_filters>`.
@@ -28,8 +30,6 @@ message Filter {
   // Filter specific configuration which depends on the filter being
   // instantiated. See the supported filters for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
-
     google.protobuf.Any typed_config = 4;
   }
 }
@@ -198,6 +198,10 @@ message FilterChain {
 }
 
 message ListenerFilter {
+  reserved 2;
+
+  reserved "config";
+
   // The name of the filter to instantiate. The name must match a
   // :ref:`supported filter <config_listener_filters>`.
   string name = 1 [(validate.rules).string = {min_bytes: 1}];
@@ -205,8 +209,6 @@ message ListenerFilter {
   // Filter specific configuration which depends on the filter being instantiated.
   // See the supported filters for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
-
     google.protobuf.Any typed_config = 3;
   }
 }
diff --git a/api/envoy/api/v3alpha/route/route.proto b/api/envoy/api/v3alpha/route/route.proto
index ac9c4dd7f373f..fc437a038413b 100644
--- a/api/envoy/api/v3alpha/route/route.proto
+++ b/api/envoy/api/v3alpha/route/route.proto
@@ -43,7 +43,9 @@ message VirtualHost {
     ALL = 2;
   }
 
-  reserved 9;
+  reserved 9, 12;
+
+  reserved "per_filter_config";
 
   // The logical name of the virtual host. This is used when emitting certain
   // statistics but is not relevant for routing.
@@ -112,13 +114,6 @@ message VirtualHost {
   // Indicates that the virtual host has a CORS policy.
   CorsPolicy cors = 8;
 
-  // The per_filter_config field can be used to provide virtual host-specific
-  // configurations for filters. The key should match the filter name, such as
-  // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
-  // specific; see the :ref:`HTTP filter documentation <config_http_filters>`
-  // for if and how it is utilized.
-  map<string, google.protobuf.Struct> per_filter_config = 12;
-
   // The per_filter_config field can be used to provide virtual host-specific
   // configurations for filters. The key should match the filter name, such as
   // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
@@ -161,7 +156,9 @@ message VirtualHost {
 //   <envoy_api_msg_api.v3alpha.route.HeaderMatcher>`.
 // [#next-free-field: 17]
 message Route {
-  reserved 6;
+  reserved 6, 8;
+
+  reserved "per_filter_config";
 
   // Name for the route.
   string name = 14;
@@ -192,13 +189,6 @@ message Route {
   // Decorator for the matched route.
   Decorator decorator = 5;
 
-  // The per_filter_config field can be used to provide route-specific
-  // configurations for filters. The key should match the filter name, such as
-  // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
-  // specific; see the :ref:`HTTP filter documentation <config_http_filters>` for
-  // if and how it is utilized.
-  map<string, google.protobuf.Struct> per_filter_config = 8;
-
   // The per_filter_config field can be used to provide route-specific
   // configurations for filters. The key should match the filter name, such as
   // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
@@ -251,7 +241,9 @@ message Route {
 message WeightedCluster {
   // [#next-free-field: 11]
   message ClusterWeight {
-    reserved 7;
+    reserved 7, 8;
+
+    reserved "per_filter_config";
 
     // Name of the upstream cluster. The cluster must exist in the
     // :ref:`cluster manager configuration <config_cluster_manager>`.
@@ -299,13 +291,6 @@ message WeightedCluster {
     // through the enclosing :ref:`envoy_api_msg_route.RouteAction`.
     repeated string response_headers_to_remove = 6;
 
-    // The per_filter_config field can be used to provide weighted cluster-specific
-    // configurations for filters. The key should match the filter name, such as
-    // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
-    // specific; see the :ref:`HTTP filter documentation <config_http_filters>`
-    // for if and how it is utilized.
-    map<string, google.protobuf.Struct> per_filter_config = 8;
-
     // The per_filter_config field can be used to provide weighted cluster-specific
     // configurations for filters. The key should match the filter name, such as
     // *envoy.buffer* for the HTTP buffer filter. Use of this field is filter
@@ -820,21 +805,25 @@ message RouteAction {
 // [#next-free-field: 11]
 message RetryPolicy {
   message RetryPriority {
+    reserved 2;
+
+    reserved "config";
+
     string name = 1 [(validate.rules).string = {min_bytes: 1}];
 
     oneof config_type {
-      google.protobuf.Struct config = 2;
-
       google.protobuf.Any typed_config = 3;
     }
   }
 
   message RetryHostPredicate {
+    reserved 2;
+
+    reserved "config";
+
     string name = 1 [(validate.rules).string = {min_bytes: 1}];
 
     oneof config_type {
-      google.protobuf.Struct config = 2;
-
       google.protobuf.Any typed_config = 3;
     }
   }
diff --git a/api/envoy/config/bootstrap/v3alpha/BUILD b/api/envoy/config/bootstrap/v3alpha/BUILD
index a4d8d71b4287a..8ce92ade1e2f4 100644
--- a/api/envoy/config/bootstrap/v3alpha/BUILD
+++ b/api/envoy/config/bootstrap/v3alpha/BUILD
@@ -10,7 +10,7 @@ api_proto_package(
         "//envoy/api/v3alpha/auth:pkg",
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/config/metrics/v3alpha:pkg",
-        "//envoy/config/overload/v2alpha:pkg",
+        "//envoy/config/overload/v3alpha:pkg",
         "//envoy/config/trace/v3alpha:pkg",
     ],
 )
diff --git a/api/envoy/config/bootstrap/v3alpha/bootstrap.proto b/api/envoy/config/bootstrap/v3alpha/bootstrap.proto
index b4a22c0dee8f8..f3ea300e75798 100644
--- a/api/envoy/config/bootstrap/v3alpha/bootstrap.proto
+++ b/api/envoy/config/bootstrap/v3alpha/bootstrap.proto
@@ -13,7 +13,7 @@ import "envoy/api/v3alpha/core/base.proto";
 import "envoy/api/v3alpha/core/config_source.proto";
 import "envoy/api/v3alpha/lds.proto";
 import "envoy/config/metrics/v3alpha/stats.proto";
-import "envoy/config/overload/v2alpha/overload.proto";
+import "envoy/config/overload/v3alpha/overload.proto";
 import "envoy/config/trace/v3alpha/trace.proto";
 
 import "google/protobuf/duration.proto";
@@ -126,7 +126,7 @@ message Bootstrap {
   Admin admin = 12;
 
   // Optional overload manager configuration.
-  overload.v2alpha.OverloadManager overload_manager = 15;
+  overload.v3alpha.OverloadManager overload_manager = 15;
 
   // Enable :ref:`stats for event dispatcher <operations_performance>`, defaults to false.
   // Note that this records a value for each iteration of the event loop on every thread. This
diff --git a/api/envoy/config/filter/accesslog/v2/accesslog.proto b/api/envoy/config/filter/accesslog/v2/accesslog.proto
index d351eeab09004..bd4abe7f20e5c 100644
--- a/api/envoy/config/filter/accesslog/v2/accesslog.proto
+++ b/api/envoy/config/filter/accesslog/v2/accesslog.proto
@@ -39,7 +39,7 @@ message AccessLog {
   // #. "envoy.tcp_grpc_access_log": :ref:`TcpGrpcAccessLogConfig
   //    <envoy_api_msg_config.accesslog.v2.TcpGrpcAccessLogConfig>`
   oneof config_type {
-    google.protobuf.Struct config = 3;
+    google.protobuf.Struct config = 3 [deprecated = true];
 
     google.protobuf.Any typed_config = 4;
   }
diff --git a/api/envoy/config/filter/accesslog/v3alpha/accesslog.proto b/api/envoy/config/filter/accesslog/v3alpha/accesslog.proto
index efaeffc9dbf9c..48a641c793f91 100644
--- a/api/envoy/config/filter/accesslog/v3alpha/accesslog.proto
+++ b/api/envoy/config/filter/accesslog/v3alpha/accesslog.proto
@@ -18,6 +18,10 @@ import "validate/validate.proto";
 // [#protodoc-title: Common access log types]
 
 message AccessLog {
+  reserved 3;
+
+  reserved "config";
+
   // The name of the access log implementation to instantiate. The name must
   // match a statically registered access log. Current built-in loggers include:
   //
@@ -39,8 +43,6 @@ message AccessLog {
   // #. "envoy.tcp_grpc_access_log": :ref:`TcpGrpcAccessLogConfig
   //    <envoy_api_msg_config.accesslog.v3alpha.TcpGrpcAccessLogConfig>`
   oneof config_type {
-    google.protobuf.Struct config = 3;
-
     google.protobuf.Any typed_config = 4;
   }
 }
diff --git a/api/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto b/api/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto
index 01fba7f1d0bb7..19f3fe3dd37d7 100644
--- a/api/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto
+++ b/api/envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto
@@ -609,7 +609,7 @@ message HttpFilter {
   // Filter specific configuration which depends on the filter being instantiated. See the supported
   // filters for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
     google.protobuf.Any typed_config = 4;
   }
diff --git a/api/envoy/config/filter/network/http_connection_manager/v3alpha/http_connection_manager.proto b/api/envoy/config/filter/network/http_connection_manager/v3alpha/http_connection_manager.proto
index c936d98b6c9f0..f96b590d7130a 100644
--- a/api/envoy/config/filter/network/http_connection_manager/v3alpha/http_connection_manager.proto
+++ b/api/envoy/config/filter/network/http_connection_manager/v3alpha/http_connection_manager.proto
@@ -589,7 +589,9 @@ message ScopedRds {
 }
 
 message HttpFilter {
-  reserved 3;
+  reserved 3, 2;
+
+  reserved "config";
 
   // The name of the filter to instantiate. The name must match a
   // :ref:`supported filter <config_http_filters>`.
@@ -598,8 +600,6 @@ message HttpFilter {
   // Filter specific configuration which depends on the filter being instantiated. See the supported
   // filters for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
-
     google.protobuf.Any typed_config = 4;
   }
 }
diff --git a/api/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto b/api/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto
index 7c756b365f157..b0e25c2407cf5 100644
--- a/api/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto
+++ b/api/envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto
@@ -90,7 +90,7 @@ message ThriftFilter {
   // Filter specific configuration which depends on the filter being instantiated. See the supported
   // filters for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
     google.protobuf.Any typed_config = 3;
   }
diff --git a/api/envoy/config/filter/network/thrift_proxy/v3alpha/thrift_proxy.proto b/api/envoy/config/filter/network/thrift_proxy/v3alpha/thrift_proxy.proto
index d8e3b331089a8..dffacb51e2dad 100644
--- a/api/envoy/config/filter/network/thrift_proxy/v3alpha/thrift_proxy.proto
+++ b/api/envoy/config/filter/network/thrift_proxy/v3alpha/thrift_proxy.proto
@@ -79,6 +79,10 @@ message ThriftProxy {
 
 // ThriftFilter configures a Thrift filter.
 message ThriftFilter {
+  reserved 2;
+
+  reserved "config";
+
   // The name of the filter to instantiate. The name must match a supported
   // filter. The built-in filters are:
   //
@@ -90,8 +94,6 @@ message ThriftFilter {
   // Filter specific configuration which depends on the filter being instantiated. See the supported
   // filters for further documentation.
   oneof config_type {
-    google.protobuf.Struct config = 2;
-
     google.protobuf.Any typed_config = 3;
   }
 }
diff --git a/api/envoy/config/metrics/v2/stats.proto b/api/envoy/config/metrics/v2/stats.proto
index c3b5668d54e5e..79f2ce81f3ce8 100644
--- a/api/envoy/config/metrics/v2/stats.proto
+++ b/api/envoy/config/metrics/v2/stats.proto
@@ -34,7 +34,7 @@ message StatsSink {
   // Stats sink specific configuration which depends on the sink being instantiated. See
   // :ref:`StatsdSink <envoy_api_msg_config.metrics.v2.StatsdSink>` for an example.
   oneof config_type {
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
     google.protobuf.Any typed_config = 3;
   }
diff --git a/api/envoy/config/metrics/v3alpha/stats.proto b/api/envoy/config/metrics/v3alpha/stats.proto
index 08d4f3ed6a3ae..f9905f209eaba 100644
--- a/api/envoy/config/metrics/v3alpha/stats.proto
+++ b/api/envoy/config/metrics/v3alpha/stats.proto
@@ -20,6 +20,10 @@ import "validate/validate.proto";
 
 // Configuration for pluggable stats sinks.
 message StatsSink {
+  reserved 2;
+
+  reserved "config";
+
   // The name of the stats sink to instantiate. The name must match a supported
   // stats sink. The built-in stats sinks are:
   //
@@ -34,8 +38,6 @@ message StatsSink {
   // Stats sink specific configuration which depends on the sink being instantiated. See
   // :ref:`StatsdSink <envoy_api_msg_config.metrics.v3alpha.StatsdSink>` for an example.
   oneof config_type {
-    google.protobuf.Struct config = 2;
-
     google.protobuf.Any typed_config = 3;
   }
 }
diff --git a/api/envoy/config/overload/v2alpha/overload.proto b/api/envoy/config/overload/v2alpha/overload.proto
index dad27524bdb03..889b3683454a7 100644
--- a/api/envoy/config/overload/v2alpha/overload.proto
+++ b/api/envoy/config/overload/v2alpha/overload.proto
@@ -31,7 +31,7 @@ message ResourceMonitor {
 
   // Configuration for the resource monitor being instantiated.
   oneof config_type {
-    google.protobuf.Struct config = 2;
+    google.protobuf.Struct config = 2 [deprecated = true];
 
     google.protobuf.Any typed_config = 3;
   }
diff --git a/api/envoy/config/overload/v3alpha/BUILD b/api/envoy/config/overload/v3alpha/BUILD
new file mode 100644
index 0000000000000..5dc095ade27a9
--- /dev/null
+++ b/api/envoy/config/overload/v3alpha/BUILD
@@ -0,0 +1,7 @@
+# DO NOT EDIT. This file is generated by tools/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package()
diff --git a/api/envoy/config/overload/v3alpha/overload.proto b/api/envoy/config/overload/v3alpha/overload.proto
new file mode 100644
index 0000000000000..0cc5c720240c4
--- /dev/null
+++ b/api/envoy/config/overload/v3alpha/overload.proto
@@ -0,0 +1,80 @@
+syntax = "proto3";
+
+package envoy.config.overload.v3alpha;
+
+option java_outer_classname = "OverloadProto";
+option java_multiple_files = true;
+option java_package = "io.envoyproxy.envoy.config.overload.v3alpha";
+
+import "google/protobuf/any.proto";
+import "google/protobuf/duration.proto";
+import "google/protobuf/struct.proto";
+
+import "validate/validate.proto";
+
+// [#protodoc-title: Overload Manager]
+
+// The Overload Manager provides an extensible framework to protect Envoy instances
+// from overload of various resources (memory, cpu, file descriptors, etc).
+// It monitors a configurable set of resources and notifies registered listeners
+// when triggers related to those resources fire.
+
+message ResourceMonitor {
+  reserved 2;
+
+  reserved "config";
+
+  // The name of the resource monitor to instantiate. Must match a registered
+  // resource monitor type. The built-in resource monitors are:
+  //
+  // * :ref:`envoy.resource_monitors.fixed_heap
+  //   <envoy_api_msg_config.resource_monitor.fixed_heap.v2alpha.FixedHeapConfig>`
+  // * :ref:`envoy.resource_monitors.injected_resource
+  //   <envoy_api_msg_config.resource_monitor.injected_resource.v2alpha.InjectedResourceConfig>`
+  string name = 1 [(validate.rules).string = {min_bytes: 1}];
+
+  // Configuration for the resource monitor being instantiated.
+  oneof config_type {
+    google.protobuf.Any typed_config = 3;
+  }
+}
+
+message ThresholdTrigger {
+  // If the resource pressure is greater than or equal to this value, the trigger
+  // will fire.
+  double value = 1 [(validate.rules).double = {lte: 1.0 gte: 0.0}];
+}
+
+message Trigger {
+  // The name of the resource this is a trigger for.
+  string name = 1 [(validate.rules).string = {min_bytes: 1}];
+
+  oneof trigger_oneof {
+    option (validate.required) = true;
+
+    ThresholdTrigger threshold = 2;
+  }
+}
+
+message OverloadAction {
+  // The name of the overload action. This is just a well-known string that listeners can
+  // use for registering callbacks. Custom overload actions should be named using reverse
+  // DNS to ensure uniqueness.
+  string name = 1 [(validate.rules).string = {min_bytes: 1}];
+
+  // A set of triggers for this action. If any of these triggers fire the overload action
+  // is activated. Listeners are notified when the overload action transitions from
+  // inactivated to activated, or vice versa.
+  repeated Trigger triggers = 2 [(validate.rules).repeated = {min_items: 1}];
+}
+
+message OverloadManager {
+  // The interval for refreshing resource usage.
+  google.protobuf.Duration refresh_interval = 1;
+
+  // The set of resources to monitor.
+  repeated ResourceMonitor resource_monitors = 2 [(validate.rules).repeated = {min_items: 1}];
+
+  // The set of overload actions.
+  repeated OverloadAction actions = 3;
+}
diff --git a/api/envoy/config/trace/v2/trace.proto b/api/envoy/config/trace/v2/trace.proto
index 9ea6979b5ab29..0825e697b76f7 100644
--- a/api/envoy/config/trace/v2/trace.proto
+++ b/api/envoy/config/trace/v2/trace.proto
@@ -49,7 +49,7 @@ message Tracing {
     // [#comment: TODO(marco) when XRay is implemented, uncomment the following; - :ref:`XRayConfig
     // <envoy_api_msg_config.trace.v2.XRayConfig>`]
     oneof config_type {
-      google.protobuf.Struct config = 2;
+      google.protobuf.Struct config = 2 [deprecated = true];
 
       google.protobuf.Any typed_config = 3;
     }
diff --git a/api/envoy/config/trace/v3alpha/trace.proto b/api/envoy/config/trace/v3alpha/trace.proto
index da396f8755f4c..0311e04c3b3ac 100644
--- a/api/envoy/config/trace/v3alpha/trace.proto
+++ b/api/envoy/config/trace/v3alpha/trace.proto
@@ -27,6 +27,10 @@ import "validate/validate.proto";
 // tracers in the future, but right now the HTTP tracer is the only one supported.
 message Tracing {
   message Http {
+    reserved 2;
+
+    reserved "config";
+
     // The name of the HTTP trace driver to instantiate. The name must match a
     // supported HTTP trace driver. Built-in trace drivers:
     //
@@ -49,8 +53,6 @@ message Tracing {
     // [#comment: TODO(marco) when XRay is implemented, uncomment the following; - :ref:`XRayConfig
     // <envoy_api_msg_config.trace.v3alpha.XRayConfig>`]
     oneof config_type {
-      google.protobuf.Struct config = 2;
-
       google.protobuf.Any typed_config = 3;
     }
   }
diff --git a/docs/root/intro/deprecated.rst b/docs/root/intro/deprecated.rst
index 13dd37322c5f0..51288d445ebab 100644
--- a/docs/root/intro/deprecated.rst
+++ b/docs/root/intro/deprecated.rst
@@ -51,6 +51,8 @@ Version 1.12.0 (pending)
 * Ext_authz filter stats `ok`, `error`, `denied`, `failure_mode_allowed` in
   *cluster.<route target cluster>.ext_authz.* namespace is deprecated.
   Use *http.<stat_prefix>.ext_authz.* namespace to access same counters instead.
+* Use of google.protobuf.Struct for extension opaque configs is deprecated. Use google.protobuf.Any instead or pack
+  udpa.type.v1.TypedStruct in google.protobuf.Any.
 
 Version 1.11.2 (October 8, 2019)
 ================================
diff --git a/include/envoy/protobuf/message_validator.h b/include/envoy/protobuf/message_validator.h
index 8c2ac4bc8c4ed..613b8c964249e 100644
--- a/include/envoy/protobuf/message_validator.h
+++ b/include/envoy/protobuf/message_validator.h
@@ -1,5 +1,6 @@
 #pragma once
 
+#include "envoy/common/exception.h"
 #include "envoy/common/pure.h"
 
 #include "common/protobuf/protobuf.h"
@@ -9,6 +10,15 @@
 namespace Envoy {
 namespace ProtobufMessage {
 
+/**
+ * Exception class for reporting validation errors due to the presence of unknown
+ * fields in a protobuf
+ */
+class UnknownProtoFieldException : public EnvoyException {
+public:
+  UnknownProtoFieldException(const std::string& message) : EnvoyException(message) {}
+};
+
 /**
  * Visitor interface for a Protobuf::Message. The methods of ValidationVisitor are invoked to
  * perform validation based on events encountered during or after the parsing of proto binary
diff --git a/source/common/config/filesystem_subscription_impl.cc b/source/common/config/filesystem_subscription_impl.cc
index 80a693c69d9cd..4fae62266b349 100644
--- a/source/common/config/filesystem_subscription_impl.cc
+++ b/source/common/config/filesystem_subscription_impl.cc
@@ -32,6 +32,14 @@ void FilesystemSubscriptionImpl::updateResourceInterest(const std::set<std::stri
   stats_.update_attempt_.inc();
 }
 
+void FilesystemSubscriptionImpl::configRejected(const EnvoyException& e,
+                                                const std::string& message) {
+  ENVOY_LOG(warn, "Filesystem config update rejected: {}", e.what());
+  ENVOY_LOG(debug, "Failed configuration:\n{}", message);
+  stats_.update_rejected_.inc();
+  callbacks_.onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason::UpdateRejected, &e);
+}
+
 void FilesystemSubscriptionImpl::refresh() {
   ENVOY_LOG(debug, "Filesystem config refresh for {}", path_);
   stats_.update_attempt_.inc();
@@ -44,12 +52,11 @@ void FilesystemSubscriptionImpl::refresh() {
     stats_.version_.set(HashUtil::xxHash64(message.version_info()));
     stats_.update_success_.inc();
     ENVOY_LOG(debug, "Filesystem config update accepted for {}: {}", path_, message.DebugString());
+  } catch (const ProtobufMessage::UnknownProtoFieldException& e) {
+    configRejected(e, message.DebugString());
   } catch (const EnvoyException& e) {
     if (config_update_available) {
-      ENVOY_LOG(warn, "Filesystem config update rejected: {}", e.what());
-      ENVOY_LOG(debug, "Failed configuration:\n{}", message.DebugString());
-      stats_.update_rejected_.inc();
-      callbacks_.onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason::UpdateRejected, &e);
+      configRejected(e, message.DebugString());
     } else {
       ENVOY_LOG(warn, "Filesystem config update failure: {}", e.what());
       stats_.update_failure_.inc();
diff --git a/source/common/config/filesystem_subscription_impl.h b/source/common/config/filesystem_subscription_impl.h
index 851935f1638e8..6937a8ecf6df4 100644
--- a/source/common/config/filesystem_subscription_impl.h
+++ b/source/common/config/filesystem_subscription_impl.h
@@ -32,6 +32,7 @@ class FilesystemSubscriptionImpl : public Config::Subscription,
 
 private:
   void refresh();
+  void configRejected(const EnvoyException& e, const std::string& message);
 
   bool started_{};
   const std::string path_;
diff --git a/source/common/protobuf/message_validator_impl.cc b/source/common/protobuf/message_validator_impl.cc
index e07ae6ea8221d..9b164a925da5c 100644
--- a/source/common/protobuf/message_validator_impl.cc
+++ b/source/common/protobuf/message_validator_impl.cc
@@ -34,7 +34,8 @@ void WarningValidationVisitorImpl::onUnknownField(absl::string_view description)
 }
 
 void StrictValidationVisitorImpl::onUnknownField(absl::string_view description) {
-  throw EnvoyException(absl::StrCat("Protobuf message (", description, ") has unknown fields"));
+  throw UnknownProtoFieldException(
+      absl::StrCat("Protobuf message (", description, ") has unknown fields"));
 }
 
 ValidationVisitor& getNullValidationVisitor() {
diff --git a/test/common/access_log/access_log_impl_test.cc b/test/common/access_log/access_log_impl_test.cc
index 0a4c408e662ec..d7fb4383c1f66 100644
--- a/test/common/access_log/access_log_impl_test.cc
+++ b/test/common/access_log/access_log_impl_test.cc
@@ -65,7 +65,8 @@ class AccessLogImplTest : public testing::Test {
 TEST_F(AccessLogImplTest, LogMoreData) {
   const std::string yaml = R"EOF(
 name: envoy.file_access_log
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -87,7 +88,8 @@ name: envoy.file_access_log
 TEST_F(AccessLogImplTest, DownstreamDisconnect) {
   const std::string yaml = R"EOF(
 name: envoy.file_access_log
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -108,7 +110,8 @@ name: envoy.file_access_log
 TEST_F(AccessLogImplTest, RouteName) {
   const std::string yaml = R"EOF(
 name: envoy.file_access_log
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   format: "[%START_TIME%] \"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH):256% %PROTOCOL%\" %RESPONSE_CODE% %RESPONSE_FLAGS% %ROUTE_NAME% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% \"%REQ(X-FORWARDED-FOR)%\" \"%REQ(USER-AGENT)%\" \"%REQ(X-REQUEST-ID)%\"  \"%REQ(:AUTHORITY)%\"\n"
   )EOF";
@@ -134,7 +137,8 @@ name: envoy.file_access_log
 TEST_F(AccessLogImplTest, EnvoyUpstreamServiceTime) {
   const std::string yaml = R"EOF(
 name: envoy.file_access_log
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -152,7 +156,8 @@ name: envoy.file_access_log
 TEST_F(AccessLogImplTest, NoFilter) {
   const std::string yaml = R"EOF(
 name: envoy.file_access_log
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -171,7 +176,8 @@ TEST_F(AccessLogImplTest, UpstreamHost) {
 
   const std::string yaml = R"EOF(
 name: envoy.file_access_log
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -202,7 +208,8 @@ name: envoy.file_access_log
           value:
             default_value: 1000000
             runtime_key: key_b
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -239,7 +246,8 @@ name: envoy.file_access_log
             value:
               default_value: 1000000
               runtime_key: key_c
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -263,7 +271,8 @@ name: envoy.file_access_log
 filter:
   runtime_filter:
     runtime_key: access_log.test_key
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -304,7 +313,8 @@ name: envoy.file_access_log
     percent_sampled:
       numerator: 5
       denominator: TEN_THOUSAND
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -346,7 +356,8 @@ name: envoy.file_access_log
       numerator: 5
       denominator: MILLION
     use_independent_randomness: true
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -372,7 +383,8 @@ TEST_F(AccessLogImplTest, PathRewrite) {
 
   const std::string yaml = R"EOF(
 name: envoy.file_access_log
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -390,7 +402,8 @@ TEST_F(AccessLogImplTest, HealthCheckTrue) {
 name: envoy.file_access_log
 filter:
   not_health_check_filter: {}
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -408,7 +421,8 @@ TEST_F(AccessLogImplTest, HealthCheckFalse) {
 name: envoy.file_access_log
 filter:
   not_health_check_filter: {}
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: "/dev/null"
   )EOF";
 
@@ -434,7 +448,8 @@ TEST_F(AccessLogImplTest, RequestTracing) {
 name: envoy.file_access_log
 filter:
   traceable_filter: {}
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -467,7 +482,8 @@ TEST(AccessLogImplTestCtor, FiltersMissingInOrAndFilter) {
 name: envoy.file_access_log
 filter:
   or_filter: {}
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
     )EOF";
 
@@ -480,7 +496,8 @@ name: envoy.file_access_log
 name: envoy.file_access_log
 filter:
   and_filter: {}
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
     )EOF";
 
@@ -502,7 +519,8 @@ name: envoy.file_access_log
               default_value: 500
               runtime_key: key
       - not_health_check_filter: {}
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -537,7 +555,8 @@ name: envoy.file_access_log
             default_value: 500
             runtime_key: key
     - not_health_check_filter: {}
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -579,7 +598,8 @@ name: envoy.file_access_log
                 default_value: 500
                 runtime_key: key_b
     - not_health_check_filter: {}
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -678,7 +698,8 @@ name: envoy.file_access_log
       value:
         default_value: 499
         runtime_key: hello
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -702,7 +723,8 @@ name: envoy.file_access_log
   header_filter:
     header:
       name: test-header
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -725,7 +747,8 @@ name: envoy.file_access_log
       name: test-header
       exact_match: exact-match-value
 
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -754,7 +777,8 @@ name: envoy.file_access_log
       safe_regex_match:
         google_re2: {}
         regex: "\\d{3}"
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -788,7 +812,8 @@ name: envoy.file_access_log
       range_match:
         start: -10
         end: 0
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -827,7 +852,8 @@ TEST_F(AccessLogImplTest, ResponseFlagFilterAnyFlag) {
 name: envoy.file_access_log
 filter:
   response_flag_filter: {}
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -848,7 +874,8 @@ name: envoy.file_access_log
   response_flag_filter:
     flags:
       - UO
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -874,7 +901,8 @@ name: envoy.file_access_log
     flags:
       - UO
       - RL
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -916,8 +944,9 @@ name: envoy.file_access_log
       - URX
       - SI
       - IH
-      - DPE
-config:
+      - DPE      
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -963,7 +992,8 @@ name: envoy.file_access_log
   response_flag_filter:
     flags:
       - UnsupportedFlag
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -976,8 +1006,9 @@ name: envoy.file_access_log
       "ResponseFlagFilterValidationError.Flags[i]: [\"value must be in list \" [\"LH\" \"UH\" "
       "\"UT\" \"LR\" \"UR\" \"UF\" \"UC\" \"UO\" \"NR\" \"DI\" \"FI\" \"RL\" \"UAEX\" \"RLSE\" "
       "\"DC\" \"URX\" \"SI\" \"IH\" \"DPE\"]]): name: \"envoy.file_access_log\"\nfilter {\n  "
-      "response_flag_filter {\n    flags: \"UnsupportedFlag\"\n  }\n}\nconfig {\n  fields {\n    "
-      "key: \"path\"\n    value {\n      string_value: \"/dev/null\"\n    }\n  }\n}\n");
+      "response_flag_filter {\n    flags: \"UnsupportedFlag\"\n  }\n}\ntyped_config {\n  "
+      "[type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog] {\n    path: \"/dev/null\"\n  "
+      "}\n}\n");
 }
 
 TEST_F(AccessLogImplTest, ValidateTypedConfig) {
@@ -1013,7 +1044,8 @@ name: envoy.file_access_log
   grpc_status_filter:
     statuses:
       - {}
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
 )EOF";
 
@@ -1043,7 +1075,8 @@ name: envoy.file_access_log
   grpc_status_filter:
     statuses:
       - NOT_A_VALID_CODE
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -1058,7 +1091,8 @@ name: envoy.file_access_log
   grpc_status_filter:
     statuses:
       - OK
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -1078,7 +1112,8 @@ name: envoy.file_access_log
   grpc_status_filter:
     statuses:
       - {}
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
 )EOF";
 
@@ -1109,7 +1144,8 @@ name: envoy.file_access_log
   grpc_status_filter:
     statuses:
       - UNKNOWN
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -1128,7 +1164,8 @@ name: envoy.file_access_log
     exclude: true
     statuses:
       - OK
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -1152,7 +1189,8 @@ name: envoy.file_access_log
     exclude: false
     statuses:
       - OK
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -1172,7 +1210,8 @@ name: envoy.file_access_log
   grpc_status_filter:
     statuses:
       - OK
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -1217,7 +1256,8 @@ name: envoy.file_access_log
     config:
       header:
         name: test-header
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -1288,7 +1328,8 @@ name: envoy.file_access_log
     name: sample_extension_filter
     config:
       rate: 5
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -1313,7 +1354,8 @@ name: envoy.file_access_log
     name: unregistered_extension_filter
     config:
       foo: bar
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
   )EOF";
 
@@ -1327,7 +1369,8 @@ name: envoy.file_access_log
 filter:
   extension_filter:
     name: bar
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
   path: /dev/null
     )EOF";
 
diff --git a/test/common/protobuf/message_validator_impl_test.cc b/test/common/protobuf/message_validator_impl_test.cc
index a2fa6f4b011a3..cc58c6fd205b5 100644
--- a/test/common/protobuf/message_validator_impl_test.cc
+++ b/test/common/protobuf/message_validator_impl_test.cc
@@ -45,7 +45,8 @@ TEST(WarningValidationVisitorImpl, UnknownField) {
 // The strict validation visitor throws on unknown fields.
 TEST(StrictValidationVisitorImpl, UnknownField) {
   StrictValidationVisitorImpl strict_validation_visitor;
-  EXPECT_THROW_WITH_MESSAGE(strict_validation_visitor.onUnknownField("foo"), EnvoyException,
+  EXPECT_THROW_WITH_MESSAGE(strict_validation_visitor.onUnknownField("foo"),
+                            UnknownProtoFieldException,
                             "Protobuf message (foo) has unknown fields");
 }
 
diff --git a/test/common/router/config_impl_test.cc b/test/common/router/config_impl_test.cc
index 2e30e0d99bb2e..1c2a74bccc2e6 100644
--- a/test/common/router/config_impl_test.cc
+++ b/test/common/router/config_impl_test.cc
@@ -6238,7 +6238,7 @@ class PerFilterConfigsTest : public testing::Test, public ConfigImplTestBase {
       registered_default_factory_;
 };
 
-TEST_F(PerFilterConfigsTest, TypedConfigFilterError) {
+TEST_F(PerFilterConfigsTest, DEPRECATED_FEATURE_TEST(TypedConfigFilterError)) {
   {
     const std::string yaml = R"EOF(
 name: foo
@@ -6280,9 +6280,8 @@ name: foo
   }
 }
 
-TEST_F(PerFilterConfigsTest, UnknownFilter) {
-  {
-    const std::string yaml = R"EOF(
+TEST_F(PerFilterConfigsTest, DEPRECATED_FEATURE_TEST(UnknownFilterStruct)) {
+  const std::string yaml = R"EOF(
 name: foo
 virtual_hosts:
   - name: bar
@@ -6293,13 +6292,13 @@ name: foo
     per_filter_config: { unknown.filter: {} }
 )EOF";
 
-    EXPECT_THROW_WITH_MESSAGE(
-        TestConfigImpl(parseRouteConfigurationFromV2Yaml(yaml), factory_context_, true),
-        EnvoyException, "Didn't find a registered implementation for name: 'unknown.filter'");
-  }
+  EXPECT_THROW_WITH_MESSAGE(
+      TestConfigImpl(parseRouteConfigurationFromV2Yaml(yaml), factory_context_, true),
+      EnvoyException, "Didn't find a registered implementation for name: 'unknown.filter'");
+}
 
-  {
-    const std::string yaml = R"EOF(
+TEST_F(PerFilterConfigsTest, UnknownFilterAny) {
+  const std::string yaml = R"EOF(
 name: foo
 virtual_hosts:
   - name: bar
@@ -6312,17 +6311,15 @@ name: foo
         "@type": type.googleapis.com/google.protobuf.Timestamp
 )EOF";
 
-    EXPECT_THROW_WITH_MESSAGE(
-        TestConfigImpl(parseRouteConfigurationFromV2Yaml(yaml), factory_context_, true),
-        EnvoyException, "Didn't find a registered implementation for name: 'unknown.filter'");
-  }
+  EXPECT_THROW_WITH_MESSAGE(
+      TestConfigImpl(parseRouteConfigurationFromV2Yaml(yaml), factory_context_, true),
+      EnvoyException, "Didn't find a registered implementation for name: 'unknown.filter'");
 }
 
 // Test that a trivially specified NamedHttpFilterConfigFactory ignores per_filter_config without
 // error.
-TEST_F(PerFilterConfigsTest, DefaultFilterImplementation) {
-  {
-    const std::string yaml = R"EOF(
+TEST_F(PerFilterConfigsTest, DEPRECATED_FEATURE_TEST(DefaultFilterImplementationStruct)) {
+  const std::string yaml = R"EOF(
 name: foo
 virtual_hosts:
   - name: bar
@@ -6333,11 +6330,11 @@ name: foo
     per_filter_config: { test.default.filter: { seconds: 123} }
 )EOF";
 
-    checkNoPerFilterConfig(yaml);
-  }
+  checkNoPerFilterConfig(yaml);
+}
 
-  {
-    const std::string yaml = R"EOF(
+TEST_F(PerFilterConfigsTest, DefaultFilterImplementationAny) {
+  const std::string yaml = R"EOF(
 name: foo
 virtual_hosts:
   - name: bar
@@ -6352,11 +6349,10 @@ name: foo
           seconds: 123
 )EOF";
 
-    checkNoPerFilterConfig(yaml);
-  }
+  checkNoPerFilterConfig(yaml);
 }
 
-TEST_F(PerFilterConfigsTest, RouteLocalConfig) {
+TEST_F(PerFilterConfigsTest, DEPRECATED_FEATURE_TEST(RouteLocalConfig)) {
   const std::string yaml = R"EOF(
 name: foo
 virtual_hosts:
@@ -6396,7 +6392,7 @@ name: foo
   checkEach(yaml, 123, 123, 456);
 }
 
-TEST_F(PerFilterConfigsTest, WeightedClusterConfig) {
+TEST_F(PerFilterConfigsTest, DEPRECATED_FEATURE_TEST(WeightedClusterConfig)) {
   const std::string yaml = R"EOF(
 name: foo
 virtual_hosts:
@@ -6416,7 +6412,35 @@ name: foo
   checkEach(yaml, 789, 789, 1011);
 }
 
-TEST_F(PerFilterConfigsTest, WeightedClusterFallthroughConfig) {
+TEST_F(PerFilterConfigsTest, WeightedClusterTypedConfig) {
+  const std::string yaml = R"EOF(
+name: foo
+virtual_hosts:
+  - name: bar
+    domains: ["*"]
+    routes:
+      - match: { prefix: "/" }
+        route:
+          weighted_clusters:
+            clusters:
+              - name: baz
+                weight: 100
+                typed_per_filter_config:
+                  test.filter:
+                    "@type": type.googleapis.com/google.protobuf.Timestamp
+                    value:
+                      seconds: 789
+    typed_per_filter_config:
+      test.filter:
+        "@type": type.googleapis.com/google.protobuf.Timestamp
+        value:
+          seconds: 1011
+)EOF";
+
+  checkEach(yaml, 789, 789, 1011);
+}
+
+TEST_F(PerFilterConfigsTest, DEPRECATED_FEATURE_TEST(WeightedClusterFallthroughConfig)) {
   const std::string yaml = R"EOF(
 name: foo
 virtual_hosts:
@@ -6436,6 +6460,34 @@ name: foo
   checkEach(yaml, 1213, 1213, 1415);
 }
 
+TEST_F(PerFilterConfigsTest, WeightedClusterFallthroughTypedConfig) {
+  const std::string yaml = R"EOF(
+name: foo
+virtual_hosts:
+  - name: bar
+    domains: ["*"]
+    routes:
+      - match: { prefix: "/" }
+        route:
+          weighted_clusters:
+            clusters:
+              - name: baz
+                weight: 100
+        typed_per_filter_config:
+          test.filter:
+            "@type": type.googleapis.com/google.protobuf.Timestamp
+            value:
+              seconds: 1213
+    typed_per_filter_config:
+      test.filter:
+        "@type": type.googleapis.com/google.protobuf.Timestamp
+        value:
+          seconds: 1415
+)EOF";
+
+  checkEach(yaml, 1213, 1213, 1415);
+}
+
 } // namespace
 } // namespace Router
 } // namespace Envoy
diff --git a/test/config/integration/google_com_proxy_port_0.v2.yaml b/test/config/integration/google_com_proxy_port_0.v2.yaml
index feafcd384925a..67f4e54d29228 100644
--- a/test/config/integration/google_com_proxy_port_0.v2.yaml
+++ b/test/config/integration/google_com_proxy_port_0.v2.yaml
@@ -15,7 +15,8 @@ static_resources:
     filter_chains:
     - filters:
       - name: envoy.http_connection_manager
-        config:
+        typed_config:
+          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
           stat_prefix: ingress_http
           codec_type: AUTO
           route_config:
diff --git a/test/config/integration/server.yaml b/test/config/integration/server.yaml
index e26cc5cf5e981..a96f37db2094b 100644
--- a/test/config/integration/server.yaml
+++ b/test/config/integration/server.yaml
@@ -7,7 +7,8 @@ static_resources:
     filter_chains:
     - filters:
       - name: envoy.http_connection_manager
-        config:
+        typed_config:
+          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
           drain_timeout: 5s
           route_config:
             virtual_hosts:
@@ -41,13 +42,16 @@ static_resources:
           stat_prefix: router
           http_filters:
           - name: envoy.health_check
-            config:
+            typed_config:
+              "@type": type.googleapis.com/envoy.config.filter.http.health_check.v2.HealthCheck
               pass_through_mode: false
           - name: envoy.router
-            config: {}
+            typed_config:
+              "@type": type.googleapis.com/envoy.config.filter.http.router.v2.Router
           access_log:
           - name: envoy.file_access_log
-            config:
+            typed_config:
+              "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
               path: /dev/null
             filter:
               or_filter:
@@ -71,7 +75,8 @@ static_resources:
     filter_chains:
     - filters:
       - name: envoy.redis_proxy
-        config:
+        typed_config:
+          "@type": type.googleapis.com/envoy.config.filter.network.redis_proxy.v2.RedisProxy
           settings:
             op_timeout: 0.4s
           stat_prefix: redis
@@ -125,7 +130,8 @@ cluster_manager: {}
 flags_path: "/invalid_flags"
 stats_sinks:
 - name: envoy.statsd
-  config:
+  typed_config:
+    "@type": type.googleapis.com/envoy.config.metrics.v2.StatsdSink
     address:
       socket_address:
         address: {{ ip_loopback_address }}
diff --git a/test/config/integration/server_unix_listener.yaml b/test/config/integration/server_unix_listener.yaml
index bd0c6f090403b..72c4e98597f62 100644
--- a/test/config/integration/server_unix_listener.yaml
+++ b/test/config/integration/server_unix_listener.yaml
@@ -6,10 +6,12 @@ static_resources:
     filter_chains:
     - filters:
       - name: envoy.http_connection_manager
-        config:
+        typed_config:
+          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
           http_filters:
           - name: envoy.router
-            config: {}
+            typed_config:
+              "@type": type.googleapis.com/envoy.config.filter.http.router.v2.Router
           codec_type: auto
           stat_prefix: router
           drain_timeout: 5s
diff --git a/test/config/integration/server_xds.cds.with_unknown_field.yaml b/test/config/integration/server_xds.cds.with_unknown_field.yaml
index 01d794ab4032c..0b07a4597e1f8 100644
--- a/test/config/integration/server_xds.cds.with_unknown_field.yaml
+++ b/test/config/integration/server_xds.cds.with_unknown_field.yaml
@@ -8,8 +8,10 @@ resources:
     eds_config: { path: {{ eds_json_path }} }
   lb_policy: ROUND_ROBIN
   http2_protocol_options: {}
-  extension_protocol_options:
+  typed_extension_protocol_options:
     envoy.test.dynamic_validation:
-      stat_prefix: blah
-      cluster: blah
-      foo: bar
+      "@type": type.googleapis.com/google.protobuf.Struct
+      value:
+        stat_prefix: blah
+        cluster: blah
+        foo: bar
diff --git a/test/config/integration/server_xds.lds.with_unknown_field.yaml b/test/config/integration/server_xds.lds.with_unknown_field.yaml
index e1fe53b7127b8..09135bb3ffb9f 100644
--- a/test/config/integration/server_xds.lds.with_unknown_field.yaml
+++ b/test/config/integration/server_xds.lds.with_unknown_field.yaml
@@ -9,7 +9,8 @@ resources:
   filter_chains:
   - filters:
     - name: envoy.http_connection_manager
-      config:
+      typed_config:
+        "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
         codec_type: HTTP2
         drain_timeout: 5s
         stat_prefix: router
diff --git a/test/config/integration/server_xds.lds.yaml b/test/config/integration/server_xds.lds.yaml
index c23cff5ffcf44..777ee0e51e4cd 100644
--- a/test/config/integration/server_xds.lds.yaml
+++ b/test/config/integration/server_xds.lds.yaml
@@ -9,7 +9,8 @@ resources:
   filter_chains:
   - filters:
     - name: envoy.http_connection_manager
-      config:
+      typed_config:
+        "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
         codec_type: HTTP2
         drain_timeout: 5s
         stat_prefix: router
diff --git a/test/config/utility.cc b/test/config/utility.cc
index 943f6e6cbd8f3..094358e695e8c 100644
--- a/test/config/utility.cc
+++ b/test/config/utility.cc
@@ -81,7 +81,8 @@ const std::string ConfigHelper::TCP_PROXY_CONFIG = BASE_CONFIG + R"EOF(
     filter_chains:
       filters:
         name: envoy.tcp_proxy
-        config:
+        typed_config:
+          "@type": type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy
           stat_prefix: tcp_stats
           cluster: cluster_0
 )EOF";
@@ -90,7 +91,8 @@ const std::string ConfigHelper::HTTP_PROXY_CONFIG = BASE_CONFIG + R"EOF(
     filter_chains:
       filters:
         name: envoy.http_connection_manager
-        config:
+        typed_config:
+          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
           stat_prefix: config_test
           http_filters:
             name: envoy.router
@@ -99,7 +101,8 @@ const std::string ConfigHelper::HTTP_PROXY_CONFIG = BASE_CONFIG + R"EOF(
             name: envoy.file_access_log
             filter:
               not_health_check_filter:  {}
-            config:
+            typed_config:
+              "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
               path: /dev/null
           route_config:
             virtual_hosts:
@@ -116,28 +119,32 @@ const std::string ConfigHelper::HTTP_PROXY_CONFIG = BASE_CONFIG + R"EOF(
 const std::string ConfigHelper::DEFAULT_BUFFER_FILTER =
     R"EOF(
 name: envoy.buffer
-config:
+typed_config:
+    "@type": type.googleapis.com/envoy.config.filter.http.buffer.v2.Buffer
     max_request_bytes : 5242880
 )EOF";
 
 const std::string ConfigHelper::SMALL_BUFFER_FILTER =
     R"EOF(
 name: envoy.buffer
-config:
+typed_config:
+    "@type": type.googleapis.com/envoy.config.filter.http.buffer.v2.Buffer
     max_request_bytes : 1024
 )EOF";
 
 const std::string ConfigHelper::DEFAULT_HEALTH_CHECK_FILTER =
     R"EOF(
 name: envoy.health_check
-config:
+typed_config:
+    "@type": type.googleapis.com/envoy.config.filter.http.health_check.v2.HealthCheck
     pass_through_mode: false
 )EOF";
 
 const std::string ConfigHelper::DEFAULT_SQUASH_FILTER =
     R"EOF(
 name: envoy.squash
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.squash.v2.Squash
   cluster: squash
   attachment_template:
     spec:
@@ -192,7 +199,8 @@ std::string ConfigHelper::discoveredClustersBootstrap(const std::string& api_typ
     filter_chains:
       filters:
         name: envoy.http_connection_manager
-        config:
+        typed_config:
+          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
           stat_prefix: config_test
           http_filters:
             name: envoy.router
@@ -596,7 +604,7 @@ bool ConfigHelper::setAccessLog(const std::string& filename) {
   loadHttpConnectionManager(hcm_config);
   envoy::config::accesslog::v2::FileAccessLog access_log_config;
   access_log_config.set_path(filename);
-  TestUtility::jsonConvert(access_log_config, *hcm_config.mutable_access_log(0)->mutable_config());
+  hcm_config.mutable_access_log(0)->mutable_typed_config()->PackFrom(access_log_config);
   storeHttpConnectionManager(hcm_config);
   return true;
 }
@@ -663,7 +671,12 @@ bool ConfigHelper::loadHttpConnectionManager(
   RELEASE_ASSERT(!finalized_, "");
   auto* hcm_filter = getFilterFromListener("envoy.http_connection_manager");
   if (hcm_filter) {
-    TestUtility::jsonConvert(*hcm_filter->mutable_config(), hcm);
+    auto* config = hcm_filter->mutable_typed_config();
+    ASSERT(config->Is<
+           envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager>());
+    hcm = MessageUtil::anyConvert<
+        envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager>(
+        *config);
     return true;
   }
   return false;
@@ -672,10 +685,10 @@ bool ConfigHelper::loadHttpConnectionManager(
 void ConfigHelper::storeHttpConnectionManager(
     const envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
   RELEASE_ASSERT(!finalized_, "");
-  auto* hcm_config_struct =
-      getFilterFromListener("envoy.http_connection_manager")->mutable_config();
+  auto* hcm_config_any =
+      getFilterFromListener("envoy.http_connection_manager")->mutable_typed_config();
 
-  TestUtility::jsonConvert(hcm, *hcm_config_struct);
+  hcm_config_any->PackFrom(hcm);
 }
 
 void ConfigHelper::addConfigModifier(ConfigModifierFunction function) {
diff --git a/test/extensions/access_loggers/grpc/http_grpc_access_log_integration_test.cc b/test/extensions/access_loggers/grpc/http_grpc_access_log_integration_test.cc
index 3436c6b62b427..736b42fdc1e34 100644
--- a/test/extensions/access_loggers/grpc/http_grpc_access_log_integration_test.cc
+++ b/test/extensions/access_loggers/grpc/http_grpc_access_log_integration_test.cc
@@ -47,7 +47,7 @@ class AccessLogIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
           common_config->set_log_name("foo");
           setGrpcService(*common_config->mutable_grpc_service(), "accesslog",
                          fake_upstreams_.back()->localAddress());
-          TestUtility::jsonConvert(config, *access_log->mutable_config());
+          access_log->mutable_typed_config()->PackFrom(config);
         });
 
     HttpIntegrationTest::initialize();
diff --git a/test/extensions/access_loggers/grpc/tcp_grpc_access_log_integration_test.cc b/test/extensions/access_loggers/grpc/tcp_grpc_access_log_integration_test.cc
index 8ad6bbe7bb68e..23e6316a6f2b4 100644
--- a/test/extensions/access_loggers/grpc/tcp_grpc_access_log_integration_test.cc
+++ b/test/extensions/access_loggers/grpc/tcp_grpc_access_log_integration_test.cc
@@ -53,10 +53,12 @@ class TcpGrpcAccessLogIntegrationTest : public Grpc::GrpcClientIntegrationParamT
     config_helper_.addConfigModifier([this](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
       auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
       auto* filter_chain = listener->mutable_filter_chains(0);
-      auto* config_blob = filter_chain->mutable_filters(0)->mutable_config();
+      auto* config_blob = filter_chain->mutable_filters(0)->mutable_typed_config();
 
-      envoy::config::filter::network::tcp_proxy::v2::TcpProxy tcp_proxy_config;
-      TestUtility::jsonConvert(*config_blob, tcp_proxy_config);
+      ASSERT_TRUE(config_blob->Is<envoy::config::filter::network::tcp_proxy::v2::TcpProxy>());
+      auto tcp_proxy_config =
+          MessageUtil::anyConvert<envoy::config::filter::network::tcp_proxy::v2::TcpProxy>(
+              *config_blob);
 
       auto* access_log = tcp_proxy_config.add_access_log();
       access_log->set_name("envoy.tcp_grpc_access_log");
@@ -65,9 +67,8 @@ class TcpGrpcAccessLogIntegrationTest : public Grpc::GrpcClientIntegrationParamT
       common_config->set_log_name("foo");
       setGrpcService(*common_config->mutable_grpc_service(), "accesslog",
                      fake_upstreams_.back()->localAddress());
-      TestUtility::jsonConvert(access_log_config, *access_log->mutable_config());
-
-      TestUtility::jsonConvert(tcp_proxy_config, *config_blob);
+      access_log->mutable_typed_config()->PackFrom(access_log_config);
+      config_blob->PackFrom(tcp_proxy_config);
     });
     BaseIntegrationTest::initialize();
   }
diff --git a/test/extensions/clusters/redis/redis_cluster_integration_test.cc b/test/extensions/clusters/redis/redis_cluster_integration_test.cc
index ccb80dc21d852..cc62bc16dac3d 100644
--- a/test/extensions/clusters/redis/redis_cluster_integration_test.cc
+++ b/test/extensions/clusters/redis/redis_cluster_integration_test.cc
@@ -33,7 +33,8 @@ const std::string& listenerConfig() {
     filter_chains:
       filters:
         name: envoy.redis_proxy
-        config:
+        typed_config:
+          "@type": type.googleapis.com/envoy.config.filter.network.redis_proxy.v2.RedisProxy
           stat_prefix: redis_stats
           prefix_routes:
             catch_all_route:
@@ -80,8 +81,10 @@ const std::string& testConfigWithReadPolicy() {
 
 const std::string& testConfigWithAuth() {
   CONSTRUCT_ON_FIRST_USE(std::string, testConfig() + R"EOF(
-      extension_protocol_options:
-        envoy.redis_proxy: { auth_password: { inline_string: somepassword }}
+      typed_extension_protocol_options:
+        envoy.redis_proxy:
+          "@type": type.googleapis.com/envoy.config.filter.network.redis_proxy.v2.RedisProtocolOptions
+          auth_password: { inline_string: somepassword }
 )EOF");
 }
 
diff --git a/test/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter_integration_test.h b/test/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter_integration_test.h
index d7358d65df1b1..02ba05d0919aa 100644
--- a/test/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter_integration_test.h
+++ b/test/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter_integration_test.h
@@ -9,7 +9,8 @@ namespace Envoy {
 const std::string ADAPTIVE_CONCURRENCY_CONFIG =
     R"EOF(
 name: envoy.filters.http.adaptive_concurrency
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.adaptive_concurrency.v2alpha.AdaptiveConcurrency
   gradient_controller_config:
     sample_aggregate_percentile:
       value: 50
diff --git a/test/extensions/filters/http/buffer/buffer_filter_integration_test.cc b/test/extensions/filters/http/buffer/buffer_filter_integration_test.cc
index 5e468e209340b..2160108835057 100644
--- a/test/extensions/filters/http/buffer/buffer_filter_integration_test.cc
+++ b/test/extensions/filters/http/buffer/buffer_filter_integration_test.cc
@@ -1,3 +1,5 @@
+#include "envoy/config/filter/http/buffer/v2/buffer.pb.h"
+
 #include "common/protobuf/utility.h"
 
 #include "test/integration/http_protocol_integration.h"
@@ -113,18 +115,18 @@ TEST_P(BufferIntegrationTest, RouterRequestBufferLimitExceeded) {
 }
 
 ConfigHelper::HttpModifierFunction overrideConfig(const std::string& json_config) {
-  ProtobufWkt::Struct pfc;
-  TestUtility::loadFromJson(json_config, pfc);
+  envoy::config::filter::http::buffer::v2::BufferPerRoute buffer_per_route;
+  TestUtility::loadFromJson(json_config, buffer_per_route);
 
   return
-      [pfc](
+      [buffer_per_route](
           envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& cfg) {
         auto* config = cfg.mutable_route_config()
                            ->mutable_virtual_hosts()
                            ->Mutable(0)
-                           ->mutable_per_filter_config();
+                           ->mutable_typed_per_filter_config();
 
-        (*config)["envoy.buffer"] = pfc;
+        (*config)["envoy.buffer"].PackFrom(buffer_per_route);
       };
 }
 
diff --git a/test/extensions/filters/http/csrf/csrf_filter_integration_test.cc b/test/extensions/filters/http/csrf/csrf_filter_integration_test.cc
index 940be250bf1de..5caf55d444552 100644
--- a/test/extensions/filters/http/csrf/csrf_filter_integration_test.cc
+++ b/test/extensions/filters/http/csrf/csrf_filter_integration_test.cc
@@ -4,7 +4,8 @@ namespace Envoy {
 namespace {
 const std::string CSRF_ENABLED_CONFIG = R"EOF(
 name: envoy.csrf
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.csrf.v2.CsrfPolicy
   filter_enabled:
     default_value:
       numerator: 100
@@ -17,7 +18,8 @@ name: envoy.csrf
 
 const std::string CSRF_FILTER_ENABLED_CONFIG = R"EOF(
 name: envoy.csrf
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.csrf.v2.CsrfPolicy
   filter_enabled:
     default_value:
       numerator: 100
@@ -26,7 +28,8 @@ name: envoy.csrf
 
 const std::string CSRF_SHADOW_ENABLED_CONFIG = R"EOF(
 name: envoy.csrf
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.csrf.v2.CsrfPolicy
   filter_enabled:
     default_value:
       numerator: 0
@@ -39,7 +42,8 @@ name: envoy.csrf
 
 const std::string CSRF_DISABLED_CONFIG = R"EOF(
 name: envoy.csrf
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.csrf.v2.CsrfPolicy
   filter_enabled:
     default_value:
       numerator: 0
diff --git a/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_integration_test.cc b/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_integration_test.cc
index 812c015bd677a..b731a091a4051 100644
--- a/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_integration_test.cc
+++ b/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_integration_test.cc
@@ -31,7 +31,8 @@ class ProxyFilterIntegrationTest : public testing::TestWithParam<Network::Addres
 
     const std::string filter = fmt::format(R"EOF(
 name: envoy.filters.http.dynamic_forward_proxy
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.dynamic_forward_proxy.v2alpha.FilterConfig
   dns_cache_config:
     name: foo
     dns_lookup_family: {}
diff --git a/test/extensions/filters/http/fault/fault_filter_integration_test.cc b/test/extensions/filters/http/fault/fault_filter_integration_test.cc
index e4527d30a41a9..d60e36bb8f322 100644
--- a/test/extensions/filters/http/fault/fault_filter_integration_test.cc
+++ b/test/extensions/filters/http/fault/fault_filter_integration_test.cc
@@ -19,7 +19,8 @@ class FaultIntegrationTest : public Event::TestUsingSimulatedTime,
   const std::string upstream_rate_limit_config_ =
       R"EOF(
 name: envoy.fault
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.fault.v2.HTTPFault
   response_rate_limit:
     fixed_limit:
       limit_kbps: 1
@@ -30,7 +31,8 @@ name: envoy.fault
   const std::string header_fault_config_ =
       R"EOF(
 name: envoy.fault
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.fault.v2.HTTPFault
   delay:
     header_delay: {}
     percentage:
@@ -54,7 +56,8 @@ TEST_P(FaultIntegrationTestAllProtocols, NoFault) {
   const std::string filter_config =
       R"EOF(
 name: envoy.fault
-config: {}
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.fault.v2.HTTPFault
 )EOF";
 
   initializeFilter(filter_config);
diff --git a/test/extensions/filters/http/grpc_http1_reverse_bridge/reverse_bridge_integration_test.cc b/test/extensions/filters/http/grpc_http1_reverse_bridge/reverse_bridge_integration_test.cc
index 38783b7ec2376..d07ea7128f5d7 100644
--- a/test/extensions/filters/http/grpc_http1_reverse_bridge/reverse_bridge_integration_test.cc
+++ b/test/extensions/filters/http/grpc_http1_reverse_bridge/reverse_bridge_integration_test.cc
@@ -30,7 +30,8 @@ class ReverseBridgeIntegrationTest : public testing::TestWithParam<Network::Addr
     const std::string filter =
         R"EOF(
 name: envoy.filters.http.grpc_http1_reverse_bridge
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.grpc_http1_reverse_bridge.v2alpha1.FilterConfig
   content_type: application/x-protobuf
   withhold_grpc_frames: true
             )EOF";
diff --git a/test/extensions/filters/http/grpc_json_transcoder/grpc_json_transcoder_integration_test.cc b/test/extensions/filters/http/grpc_json_transcoder/grpc_json_transcoder_integration_test.cc
index ee1d1a5fb84ce..801a3a7c62586 100644
--- a/test/extensions/filters/http/grpc_json_transcoder/grpc_json_transcoder_integration_test.cc
+++ b/test/extensions/filters/http/grpc_json_transcoder/grpc_json_transcoder_integration_test.cc
@@ -37,7 +37,8 @@ class GrpcJsonTranscoderIntegrationTest
     const std::string filter =
         R"EOF(
             name: envoy.grpc_json_transcoder
-            config:
+            typed_config:
+              "@type": type.googleapis.com/envoy.config.filter.http.transcoder.v2.GrpcJsonTranscoder
               proto_descriptor : "{}"
               services : "bookstore.Bookstore"
             )EOF";
@@ -334,7 +335,8 @@ TEST_P(GrpcJsonTranscoderIntegrationTest, UnaryGetError1) {
   const std::string filter =
       R"EOF(
             name: envoy.grpc_json_transcoder
-            config:
+            typed_config:
+              "@type": type.googleapis.com/envoy.config.filter.http.transcoder.v2.GrpcJsonTranscoder
               proto_descriptor : "{}"
               services : "bookstore.Bookstore"
               ignore_unknown_query_parameters : true
@@ -357,7 +359,8 @@ TEST_P(GrpcJsonTranscoderIntegrationTest, UnaryErrorConvertedToJson) {
   const std::string filter =
       R"EOF(
             name: envoy.grpc_json_transcoder
-            config:
+            typed_config:
+              "@type": type.googleapis.com/envoy.config.filter.http.transcoder.v2.GrpcJsonTranscoder
               proto_descriptor: "{}"
               services: "bookstore.Bookstore"
               convert_grpc_status: true
@@ -381,7 +384,8 @@ TEST_P(GrpcJsonTranscoderIntegrationTest, UnaryErrorInTrailerConvertedToJson) {
   const std::string filter =
       R"EOF(
             name: envoy.grpc_json_transcoder
-            config:
+            typed_config:
+              "@type": type.googleapis.com/envoy.config.filter.http.transcoder.v2.GrpcJsonTranscoder
               proto_descriptor: "{}"
               services: "bookstore.Bookstore"
               convert_grpc_status: true
@@ -405,7 +409,8 @@ TEST_P(GrpcJsonTranscoderIntegrationTest, StreamingErrorConvertedToJson) {
   const std::string filter =
       R"EOF(
             name: envoy.grpc_json_transcoder
-            config:
+            typed_config:
+              "@type": type.googleapis.com/envoy.config.filter.http.transcoder.v2.GrpcJsonTranscoder
               proto_descriptor: "{}"
               services: "bookstore.Bookstore"
               convert_grpc_status: true
diff --git a/test/extensions/filters/http/gzip/gzip_filter_integration_test.cc b/test/extensions/filters/http/gzip/gzip_filter_integration_test.cc
index 29635fc7f852d..424356e2dc92b 100644
--- a/test/extensions/filters/http/gzip/gzip_filter_integration_test.cc
+++ b/test/extensions/filters/http/gzip/gzip_filter_integration_test.cc
@@ -67,7 +67,8 @@ class GzipIntegrationTest : public testing::TestWithParam<Network::Address::IpVe
 
   const std::string full_config{R"EOF(
       name: envoy.gzip
-      config:
+      typed_config:
+        "@type": type.googleapis.com/envoy.config.filter.http.gzip.v2.Gzip
         memory_level: 3
         window_bits: 10
         compression_level: best
diff --git a/test/extensions/filters/http/jwt_authn/filter_integration_test.cc b/test/extensions/filters/http/jwt_authn/filter_integration_test.cc
index 02d9f886ec073..cf2d6a1c27a58 100644
--- a/test/extensions/filters/http/jwt_authn/filter_integration_test.cc
+++ b/test/extensions/filters/http/jwt_authn/filter_integration_test.cc
@@ -73,7 +73,7 @@ std::string getAuthFilterConfig(const std::string& config_str, bool use_local_jw
 
   HttpFilter filter;
   filter.set_name(HttpFilterNames::get().JwtAuthn);
-  TestUtility::jsonConvert(proto_config, *filter.mutable_config());
+  filter.mutable_typed_config()->PackFrom(proto_config);
   return MessageUtil::getJsonStringFromMessage(filter);
 }
 
diff --git a/test/extensions/filters/http/lua/lua_integration_test.cc b/test/extensions/filters/http/lua/lua_integration_test.cc
index db599dee13029..36f30b08702ed 100644
--- a/test/extensions/filters/http/lua/lua_integration_test.cc
+++ b/test/extensions/filters/http/lua/lua_integration_test.cc
@@ -101,7 +101,8 @@ TEST_P(LuaIntegrationTest, RequestAndResponse) {
   const std::string FILTER_AND_CODE =
       R"EOF(
 name: envoy.lua
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.lua.v2.Lua
   inline_code: |
     function envoy_on_request(request_handle)
       request_handle:logTrace("log test")
@@ -220,7 +221,8 @@ TEST_P(LuaIntegrationTest, UpstreamHttpCall) {
   const std::string FILTER_AND_CODE =
       R"EOF(
 name: envoy.lua
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.lua.v2.Lua
   inline_code: |
     function envoy_on_request(request_handle)
       local headers, body = request_handle:httpCall(
@@ -277,7 +279,8 @@ TEST_P(LuaIntegrationTest, UpstreamCallAndRespond) {
   const std::string FILTER_AND_CODE =
       R"EOF(
 name: envoy.lua
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.lua.v2.Lua
   inline_code: |
     function envoy_on_request(request_handle)
       local headers, body = request_handle:httpCall(
@@ -326,7 +329,8 @@ TEST_P(LuaIntegrationTest, ChangeRoute) {
   const std::string FILTER_AND_CODE =
       R"EOF(
 name: envoy.lua
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.lua.v2.Lua
   inline_code: |
     function envoy_on_request(request_handle)
       request_handle:headers():remove(":path")
@@ -359,7 +363,8 @@ TEST_P(LuaIntegrationTest, SurviveMultipleCalls) {
   const std::string FILTER_AND_CODE =
       R"EOF(
 name: envoy.lua
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.lua.v2.Lua
   inline_code: |
     function envoy_on_request(request_handle)
       request_handle:streamInfo():dynamicMetadata()
@@ -394,7 +399,8 @@ TEST_P(LuaIntegrationTest, SignatureVerification) {
   const std::string FILTER_AND_CODE =
       R"EOF(
 name: envoy.lua
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.lua.v2.Lua
   inline_code: |
     function string.fromhex(str)
       return (str:gsub('..', function (cc)
diff --git a/test/extensions/filters/http/rbac/rbac_filter_integration_test.cc b/test/extensions/filters/http/rbac/rbac_filter_integration_test.cc
index 5e47c7bf86a71..2bdbe6f83af43 100644
--- a/test/extensions/filters/http/rbac/rbac_filter_integration_test.cc
+++ b/test/extensions/filters/http/rbac/rbac_filter_integration_test.cc
@@ -1,3 +1,5 @@
+#include "envoy/config/filter/http/rbac/v2/rbac.pb.h"
+
 #include "common/protobuf/utility.h"
 
 #include "extensions/filters/http/well_known_names.h"
@@ -9,7 +11,8 @@ namespace {
 
 const std::string RBAC_CONFIG = R"EOF(
 name: envoy.filters.http.rbac
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.rbac.v2.RBAC
   rules:
     policies:
       foo:
@@ -21,7 +24,8 @@ name: envoy.filters.http.rbac
 
 const std::string RBAC_CONFIG_WITH_PREFIX_MATCH = R"EOF(
 name: envoy.filters.http.rbac
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.rbac.v2.RBAC
   rules:
     policies:
       foo:
@@ -158,15 +162,15 @@ TEST_P(RBACIntegrationTest, DeniedHeadReply) {
 TEST_P(RBACIntegrationTest, RouteOverride) {
   config_helper_.addConfigModifier(
       [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& cfg) {
-        ProtobufWkt::Struct pfc;
-        TestUtility::loadFromJson("{}", pfc);
+        envoy::config::filter::http::rbac::v2::RBACPerRoute per_route_config;
+        TestUtility::loadFromJson("{}", per_route_config);
 
         auto* config = cfg.mutable_route_config()
                            ->mutable_virtual_hosts()
                            ->Mutable(0)
-                           ->mutable_per_filter_config();
+                           ->mutable_typed_per_filter_config();
 
-        (*config)[Extensions::HttpFilters::HttpFilterNames::get().Rbac] = pfc;
+        (*config)[Extensions::HttpFilters::HttpFilterNames::get().Rbac].PackFrom(per_route_config);
       });
   config_helper_.addFilter(RBAC_CONFIG);
 
diff --git a/test/extensions/filters/http/tap/tap_filter_integration_test.cc b/test/extensions/filters/http/tap/tap_filter_integration_test.cc
index 347914fd53193..2e577e502bc8f 100644
--- a/test/extensions/filters/http/tap/tap_filter_integration_test.cc
+++ b/test/extensions/filters/http/tap/tap_filter_integration_test.cc
@@ -147,7 +147,8 @@ class TapIntegrationTest : public testing::TestWithParam<Network::Address::IpVer
   const std::string admin_filter_config_ =
       R"EOF(
 name: envoy.filters.http.tap
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.tap.v2alpha.Tap
   common_config:
     admin_config:
       config_id: test_config_id
@@ -166,7 +167,8 @@ TEST_P(TapIntegrationTest, StaticFilePerTap) {
   const std::string filter_config =
       R"EOF(
 name: envoy.filters.http.tap
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.tap.v2alpha.Tap
   common_config:
     static_config:
       match_config:
@@ -451,7 +453,8 @@ TEST_P(TapIntegrationTest, StaticFilePerTapStreaming) {
   const std::string filter_config =
       R"EOF(
 name: envoy.filters.http.tap
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.tap.v2alpha.Tap
   common_config:
     static_config:
       match_config:
@@ -495,7 +498,8 @@ TEST_P(TapIntegrationTest, StaticFilePerTapStreamingWithRequestBuffering) {
   const std::string filter_config =
       R"EOF(
 name: envoy.filters.http.tap
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.tap.v2alpha.Tap
   common_config:
     static_config:
       match_config:
diff --git a/test/extensions/filters/network/http_connection_manager/config_test.cc b/test/extensions/filters/network/http_connection_manager/config_test.cc
index c59bfa164fed6..efbe9d0207eae 100644
--- a/test/extensions/filters/network/http_connection_manager/config_test.cc
+++ b/test/extensions/filters/network/http_connection_manager/config_test.cc
@@ -846,7 +846,8 @@ stat_prefix: router
         cluster: cluster
 http_filters:
 - name: envoy.http_dynamo_filter
-  config: {}
+  typed_config:
+    "@type": type.googleapis.com/google.protobuf.Empty
 - name: envoy.router
   )EOF";
 
diff --git a/test/extensions/filters/network/rbac/integration_test.cc b/test/extensions/filters/network/rbac/integration_test.cc
index 076099e67f42f..11ffc418de92b 100644
--- a/test/extensions/filters/network/rbac/integration_test.cc
+++ b/test/extensions/filters/network/rbac/integration_test.cc
@@ -27,7 +27,8 @@ class RoleBasedAccessControlNetworkFilterIntegrationTest
     filter_chains:
       filters:
        -  name: envoy.filters.network.rbac
-          config:
+          typed_config:
+            "@type": type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
             stat_prefix: tcp.
             rules:
               policies:
@@ -69,7 +70,8 @@ INSTANTIATE_TEST_SUITE_P(IpVersions, RoleBasedAccessControlNetworkFilterIntegrat
 TEST_P(RoleBasedAccessControlNetworkFilterIntegrationTest, Allowed) {
   initializeFilter(R"EOF(
 name: envoy.filters.network.rbac
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
   stat_prefix: tcp.
   rules:
     policies:
@@ -101,7 +103,8 @@ name: envoy.filters.network.rbac
 TEST_P(RoleBasedAccessControlNetworkFilterIntegrationTest, Denied) {
   initializeFilter(R"EOF(
 name: envoy.filters.network.rbac
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.network.rbac.v2.RBAC
   stat_prefix: tcp.
   rules:
     policies:
diff --git a/test/extensions/filters/network/redis_proxy/redis_proxy_integration_test.cc b/test/extensions/filters/network/redis_proxy/redis_proxy_integration_test.cc
index 228135bef51f7..c1d99962458f8 100644
--- a/test/extensions/filters/network/redis_proxy/redis_proxy_integration_test.cc
+++ b/test/extensions/filters/network/redis_proxy/redis_proxy_integration_test.cc
@@ -53,7 +53,8 @@ const std::string CONFIG = R"EOF(
     filter_chains:
       filters:
         name: envoy.redis_proxy
-        config:
+        typed_config:
+          "@type": type.googleapis.com/envoy.config.filter.network.redis_proxy.v2.RedisProxy
           stat_prefix: redis_stats
           prefix_routes:
             catch_all_route:
@@ -142,7 +143,8 @@ const std::string CONFIG_WITH_ROUTES_BASE = R"EOF(
     filter_chains:
       filters:
         name: envoy.redis_proxy
-        config:
+        typed_config:
+          "@type": type.googleapis.com/envoy.config.filter.network.redis_proxy.v2.RedisProxy
           stat_prefix: redis_stats
           settings:
             op_timeout: 5s
@@ -198,8 +200,10 @@ const std::string CONFIG_WITH_ROUTES_AND_AUTH_PASSWORDS = R"EOF(
   clusters:
     - name: cluster_0
       type: STATIC
-      extension_protocol_options:
-        envoy.redis_proxy: { auth_password: { inline_string: cluster_0_password }}
+      typed_extension_protocol_options:
+        envoy.redis_proxy:
+          "@type": type.googleapis.com/envoy.config.filter.network.redis_proxy.v2.RedisProtocolOptions
+          auth_password: { inline_string: cluster_0_password }
       lb_policy: RANDOM
       load_assignment:
         cluster_name: cluster_0
@@ -213,8 +217,10 @@ const std::string CONFIG_WITH_ROUTES_AND_AUTH_PASSWORDS = R"EOF(
     - name: cluster_1
       type: STATIC
       lb_policy: RANDOM
-      extension_protocol_options:
-        envoy.redis_proxy: { auth_password: { inline_string: cluster_1_password }}
+      typed_extension_protocol_options:
+        envoy.redis_proxy:
+          "@type": type.googleapis.com/envoy.config.filter.network.redis_proxy.v2.RedisProtocolOptions
+          auth_password: { inline_string: cluster_1_password }
       load_assignment:
         cluster_name: cluster_1
         endpoints:
@@ -226,8 +232,10 @@ const std::string CONFIG_WITH_ROUTES_AND_AUTH_PASSWORDS = R"EOF(
                     port_value: 1
     - name: cluster_2
       type: STATIC
-      extension_protocol_options:
-        envoy.redis_proxy: { auth_password: { inline_string: cluster_2_password }}
+      typed_extension_protocol_options:
+        envoy.redis_proxy:
+          "@type": type.googleapis.com/envoy.config.filter.network.redis_proxy.v2.RedisProtocolOptions
+          auth_password: { inline_string: cluster_2_password }
       lb_policy: RANDOM
       load_assignment:
         cluster_name: cluster_2
@@ -247,7 +255,8 @@ const std::string CONFIG_WITH_ROUTES_AND_AUTH_PASSWORDS = R"EOF(
     filter_chains:
       filters:
         name: envoy.redis_proxy
-        config:
+        typed_config:
+          "@type": type.googleapis.com/envoy.config.filter.network.redis_proxy.v2.RedisProxy
           stat_prefix: redis_stats
           settings:
             op_timeout: 5s
diff --git a/test/extensions/filters/network/thrift_proxy/config_test.cc b/test/extensions/filters/network/thrift_proxy/config_test.cc
index d555bd6a1fac2..5c6749bd645c7 100644
--- a/test/extensions/filters/network/thrift_proxy/config_test.cc
+++ b/test/extensions/filters/network/thrift_proxy/config_test.cc
@@ -162,8 +162,10 @@ stat_prefix: ingress
   name: local_route
 thrift_filters:
   - name: envoy.filters.thrift.mock_filter
-    config:
-      key: value
+    typed_config:
+      "@type": type.googleapis.com/google.protobuf.Struct
+      value:
+        key: value
   - name: envoy.filters.thrift.router
 )EOF";
 
diff --git a/test/extensions/filters/network/thrift_proxy/integration_test.cc b/test/extensions/filters/network/thrift_proxy/integration_test.cc
index ec6db8fd08562..2e3f4dfe96b89 100644
--- a/test/extensions/filters/network/thrift_proxy/integration_test.cc
+++ b/test/extensions/filters/network/thrift_proxy/integration_test.cc
@@ -24,7 +24,8 @@ class ThriftConnManagerIntegrationTest
     filter_chains:
       filters:
         - name: envoy.filters.network.thrift_proxy
-          config:
+          typed_config:
+            "@type": type.googleapis.com/envoy.config.filter.network.thrift_proxy.v2alpha1.ThriftProxy
             stat_prefix: thrift_stats
             route_config:
               name: "routes"
diff --git a/test/extensions/filters/network/thrift_proxy/translation_integration_test.cc b/test/extensions/filters/network/thrift_proxy/translation_integration_test.cc
index f91869ac92a47..dcb0d796adf6a 100644
--- a/test/extensions/filters/network/thrift_proxy/translation_integration_test.cc
+++ b/test/extensions/filters/network/thrift_proxy/translation_integration_test.cc
@@ -27,7 +27,8 @@ class ThriftTranslationIntegrationTest
     filter_chains:
       filters:
         - name: envoy.filters.network.thrift_proxy
-          config:
+          typed_config:
+            "@type": type.googleapis.com/envoy.config.filter.network.thrift_proxy.v2alpha1.ThriftProxy
             stat_prefix: thrift_stats
             route_config:
               name: "routes"
@@ -52,14 +53,11 @@ class ThriftTranslationIntegrationTest
     proto_opts.set_transport(upstream_transport_proto);
     proto_opts.set_protocol(upstream_protocol_proto);
 
-    ProtobufWkt::Struct struct_opts;
-    TestUtility::jsonConvert(proto_opts, struct_opts);
-
     config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
       auto* opts = bootstrap.mutable_static_resources()
                        ->mutable_clusters(0)
-                       ->mutable_extension_protocol_options();
-      (*opts)[NetworkFilterNames::get().ThriftProxy] = struct_opts;
+                       ->mutable_typed_extension_protocol_options();
+      (*opts)[NetworkFilterNames::get().ThriftProxy].PackFrom(proto_opts);
     });
 
     // Invent some varying, but deterministic, values to add. We use the add method instead of
diff --git a/test/extensions/stats_sinks/metrics_service/metrics_service_integration_test.cc b/test/extensions/stats_sinks/metrics_service/metrics_service_integration_test.cc
index e193103473348..2281eadea9429 100644
--- a/test/extensions/stats_sinks/metrics_service/metrics_service_integration_test.cc
+++ b/test/extensions/stats_sinks/metrics_service/metrics_service_integration_test.cc
@@ -43,7 +43,7 @@ class MetricsServiceIntegrationTest : public Grpc::GrpcClientIntegrationParamTes
       envoy::config::metrics::v2::MetricsServiceConfig config;
       setGrpcService(*config.mutable_grpc_service(), "metrics_service",
                      fake_upstreams_.back()->localAddress());
-      TestUtility::jsonConvert(config, *metrics_sink->mutable_config());
+      metrics_sink->mutable_typed_config()->PackFrom(config);
       // Shrink reporting period down to 1s to make test not take forever.
       bootstrap.mutable_stats_flush_interval()->CopyFrom(
           Protobuf::util::TimeUtil::MillisecondsToDuration(100));
diff --git a/test/extensions/transport_sockets/alts/alts_integration_test.cc b/test/extensions/transport_sockets/alts/alts_integration_test.cc
index 14dbbfd8f3d43..23748aa098b81 100644
--- a/test/extensions/transport_sockets/alts/alts_integration_test.cc
+++ b/test/extensions/transport_sockets/alts/alts_integration_test.cc
@@ -51,7 +51,7 @@ class AltsIntegrationTestBase : public testing::TestWithParam<Network::Address::
         alts_config.add_peer_service_accounts(server_peer_identity_);
       }
       alts_config.set_handshaker_service(fakeHandshakerServerAddress(server_connect_handshaker_));
-      TestUtility::jsonConvert(alts_config, *transport_socket->mutable_config());
+      transport_socket->mutable_typed_config()->PackFrom(alts_config);
     });
     HttpIntegrationTest::initialize();
     registerTestServerPorts({"http"});
diff --git a/test/extensions/transport_sockets/tls/integration/ssl_integration_test.cc b/test/extensions/transport_sockets/tls/integration/ssl_integration_test.cc
index e4d7eb590bdda..c3d0960dc06c9 100644
--- a/test/extensions/transport_sockets/tls/integration/ssl_integration_test.cc
+++ b/test/extensions/transport_sockets/tls/integration/ssl_integration_test.cc
@@ -363,7 +363,7 @@ class SslTapIntegrationTest : public SslIntegrationTest {
     envoy::config::transport_socket::tap::v2alpha::Tap tap_config =
         createTapConfig(raw_transport_socket);
     tap_config.mutable_transport_socket()->MergeFrom(raw_transport_socket);
-    TestUtility::jsonConvert(tap_config, *transport_socket->mutable_config());
+    transport_socket->mutable_typed_config()->PackFrom(tap_config);
   }
 
   void setupDownstreamTap(envoy::config::bootstrap::v2::Bootstrap& bootstrap) {
@@ -378,7 +378,7 @@ class SslTapIntegrationTest : public SslIntegrationTest {
     envoy::config::transport_socket::tap::v2alpha::Tap tap_config =
         createTapConfig(ssl_transport_socket);
     tap_config.mutable_transport_socket()->MergeFrom(ssl_transport_socket);
-    TestUtility::jsonConvert(tap_config, *transport_socket->mutable_config());
+    transport_socket->mutable_typed_config()->PackFrom(tap_config);
   }
 
   envoy::config::transport_socket::tap::v2alpha::Tap
diff --git a/test/integration/ads_integration.cc b/test/integration/ads_integration.cc
index b50c228235ed5..0f6a6d2457cf8 100644
--- a/test/integration/ads_integration.cc
+++ b/test/integration/ads_integration.cc
@@ -87,7 +87,8 @@ envoy::api::v2::Listener AdsIntegrationTest::buildListener(const std::string& na
       filter_chains:
         filters:
         - name: envoy.http_connection_manager
-          config:
+          typed_config:
+            "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
             stat_prefix: {}
             codec_type: HTTP2
             rds:
@@ -110,7 +111,8 @@ envoy::api::v2::Listener AdsIntegrationTest::buildRedisListener(const std::strin
       filter_chains:
         filters:
         - name: envoy.redis_proxy
-          config:
+          typed_config:
+            "@type": type.googleapis.com/envoy.config.filter.network.redis_proxy.v2.RedisProxy
             settings: 
               op_timeout: 1s
             stat_prefix: {}
diff --git a/test/integration/aws_metadata_fetcher_integration_test.cc b/test/integration/aws_metadata_fetcher_integration_test.cc
index e542fce7f4e1f..b6d12375480bf 100644
--- a/test/integration/aws_metadata_fetcher_integration_test.cc
+++ b/test/integration/aws_metadata_fetcher_integration_test.cc
@@ -21,11 +21,13 @@ class AwsMetadataIntegrationTestBase : public ::testing::Test, public BaseIntegr
     filter_chains:
       filters:
         name: envoy.http_connection_manager
-        config:
+        typed_config:
+          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
           stat_prefix: metadata_test
           http_filters:
             - name: envoy.fault
-              config:
+              typed_config:
+                "@type": type.googleapis.com/envoy.config.filter.http.fault.v2.HTTPFault
                 delay:
                   fixed_delay:
                     seconds: {}
diff --git a/test/integration/dynamic_validation_integration_test.cc b/test/integration/dynamic_validation_integration_test.cc
index 28c0d6e52f6c1..87cc5e8cf48be 100644
--- a/test/integration/dynamic_validation_integration_test.cc
+++ b/test/integration/dynamic_validation_integration_test.cc
@@ -169,8 +169,8 @@ TEST_P(DynamicValidationIntegrationTest, RdsFailedBySubscription) {
   EXPECT_EQ(1, test_server_->counter("listener_manager.lds.update_success")->value());
   if (reject_unknown_dynamic_fields_) {
     EXPECT_EQ(0, test_server_->counter("http.router.rds.route_config_0.update_success")->value());
-    // FilesystemSubscriptionImpl will reject early at the ingestion level
-    EXPECT_EQ(1, test_server_->counter("http.router.rds.route_config_0.update_failure")->value());
+    // Unknown fields in the config result in the update_rejected counter incremented
+    EXPECT_EQ(1, test_server_->counter("http.router.rds.route_config_0.update_rejected")->value());
     EXPECT_EQ(0, test_server_->counter("server.dynamic_unknown_fields")->value());
   } else {
     EXPECT_EQ(1, test_server_->counter("http.router.rds.route_config_0.update_success")->value());
@@ -195,8 +195,8 @@ TEST_P(DynamicValidationIntegrationTest, EdsFailedBySubscription) {
   EXPECT_EQ(1, test_server_->counter("cluster_manager.cds.update_success")->value());
   if (reject_unknown_dynamic_fields_) {
     EXPECT_EQ(0, test_server_->counter("cluster.cluster_1.update_success")->value());
-    // FilesystemSubscriptionImpl will reject early at the ingestion level
-    EXPECT_EQ(1, test_server_->counter("cluster.cluster_1.update_failure")->value());
+    // Unknown fields in the config result in the update_rejected counter incremented
+    EXPECT_EQ(1, test_server_->counter("cluster.cluster_1.update_rejected")->value());
     EXPECT_EQ(0, test_server_->counter("server.dynamic_unknown_fields")->value());
   } else {
     EXPECT_EQ(1, test_server_->counter("cluster.cluster_1.update_success")->value());
diff --git a/test/integration/header_integration_test.cc b/test/integration/header_integration_test.cc
index 2fa40efd43ce3..a88a35a2e135c 100644
--- a/test/integration/header_integration_test.cc
+++ b/test/integration/header_integration_test.cc
@@ -268,7 +268,7 @@ class HeaderIntegrationTest
           TestUtility::loadFromYaml(http_connection_mgr_config, hcm);
           envoy::config::filter::http::router::v2::Router router_config;
           router_config.set_suppress_envoy_headers(routerSuppressEnvoyHeaders());
-          TestUtility::jsonConvert(router_config, *hcm.mutable_http_filters(0)->mutable_config());
+          hcm.mutable_http_filters(0)->mutable_typed_config()->PackFrom(router_config);
 
           const bool append = mode == HeaderMode::Append;
 
diff --git a/test/integration/http2_integration_test.cc b/test/integration/http2_integration_test.cc
index 80a40f52977f9..c52ae65656b93 100644
--- a/test/integration/http2_integration_test.cc
+++ b/test/integration/http2_integration_test.cc
@@ -68,7 +68,8 @@ TEST_P(Http2IntegrationTest, LargeRequestTrailersRejected) { testLargeRequestTra
 
 static std::string response_metadata_filter = R"EOF(
 name: response-metadata-filter
-config: {}
+typed_config:
+  "@type": type.googleapis.com/google.protobuf.Empty
 )EOF";
 
 // Verifies metadata can be sent at different locations of the responses.
@@ -483,7 +484,8 @@ TEST_P(Http2MetadataIntegrationTest, RequestMetadataReachSizeLimit) {
 
 static std::string request_metadata_filter = R"EOF(
 name: request-metadata-filter
-config: {}
+typed_config:
+  "@type": type.googleapis.com/google.protobuf.Empty
 )EOF";
 
 TEST_P(Http2MetadataIntegrationTest, ConsumeAndInsertRequestMetadata) {
@@ -592,7 +594,8 @@ TEST_P(Http2MetadataIntegrationTest, ConsumeAndInsertRequestMetadata) {
 
 static std::string decode_headers_only = R"EOF(
 name: decode-headers-only
-config: {}
+typed_config:
+  "@type": type.googleapis.com/google.protobuf.Empty
 )EOF";
 
 void Http2MetadataIntegrationTest::runHeaderOnlyTest(bool send_request_body, size_t body_size) {
@@ -699,7 +702,8 @@ void Http2MetadataIntegrationTest::testRequestMetadataWithStopAllFilter() {
 
 static std::string metadata_stop_all_filter = R"EOF(
 name: metadata-stop-all-filter
-config: {}
+typed_config:
+  "@type": type.googleapis.com/google.protobuf.Empty
 )EOF";
 
 TEST_P(Http2MetadataIntegrationTest, RequestMetadataWithStopAllFilterBeforeMetadataFilter) {
@@ -1141,7 +1145,8 @@ TEST_P(Http2IntegrationTest, DelayedCloseDisabled) {
 TEST_P(Http2IntegrationTest, PauseAndResume) {
   config_helper_.addFilter(R"EOF(
   name: stop-iteration-and-continue-filter
-  config: {}
+  typed_config:
+    "@type": type.googleapis.com/google.protobuf.Empty
   )EOF");
   initialize();
 
@@ -1170,7 +1175,8 @@ TEST_P(Http2IntegrationTest, PauseAndResume) {
 TEST_P(Http2IntegrationTest, PauseAndResumeHeadersOnly) {
   config_helper_.addFilter(R"EOF(
   name: stop-iteration-and-continue-filter
-  config: {}
+  typed_config:
+    "@type": type.googleapis.com/google.protobuf.Empty
   )EOF");
   initialize();
 
diff --git a/test/integration/http2_upstream_integration_test.cc b/test/integration/http2_upstream_integration_test.cc
index 86ce70921a207..86b238708ea3b 100644
--- a/test/integration/http2_upstream_integration_test.cc
+++ b/test/integration/http2_upstream_integration_test.cc
@@ -251,7 +251,8 @@ TEST_P(Http2UpstreamIntegrationTest, ManyLargeSimultaneousRequestWithBufferLimit
 TEST_P(Http2UpstreamIntegrationTest, ManyLargeSimultaneousRequestWithRandomBackup) {
   config_helper_.addFilter(R"EOF(
   name: random-pause-filter
-  config: {}
+  typed_config:
+    "@type": type.googleapis.com/google.protobuf.Empty
   )EOF");
 
   manySimultaneousRequests(1024 * 20, 1024 * 20);
@@ -323,12 +324,14 @@ TEST_P(Http2UpstreamIntegrationTest, HittingEncoderFilterLimitForGrpc) {
         // Configure just enough of an upstream access log to reference the upstream headers.
         const std::string yaml_string = R"EOF(
 name: envoy.router
-config:
+typed_config:
+  "@type": type.googleapis.com/envoy.config.filter.http.router.v2.Router
   upstream_log:
     name: envoy.file_access_log
     filter:
       not_health_check_filter: {}
-    config:
+    typed_config:
+      "@type": type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog
       path: /dev/null
   )EOF";
         const std::string json = Json::Factory::loadFromYamlString(yaml_string)->asJsonString();
@@ -338,7 +341,8 @@ name: envoy.router
   // As with ProtocolIntegrationTest.HittingEncoderFilterLimit use a filter
   // which buffers response data but in this case, make sure the sendLocalReply
   // is gRPC.
-  config_helper_.addFilter("{ name: envoy.http_dynamo_filter, config: {} }");
+  config_helper_.addFilter("{ name: envoy.http_dynamo_filter, typed_config: { \"@type\": "
+                           "type.googleapis.com/google.protobuf.Empty } }");
   config_helper_.setBufferLimits(1024, 1024);
   initialize();
 
diff --git a/test/integration/http_integration.cc b/test/integration/http_integration.cc
index eaa88e0b8bd27..310542194c8ab 100644
--- a/test/integration/http_integration.cc
+++ b/test/integration/http_integration.cc
@@ -848,7 +848,8 @@ void HttpIntegrationTest::testTwoRequests(bool network_backup) {
   if (network_backup) {
     config_helper_.addFilter(R"EOF(
   name: pause-filter
-  config: {}
+  typed_config:
+    "@type": type.googleapis.com/google.protobuf.Empty
   )EOF");
   }
   initialize();
diff --git a/test/integration/http_timeout_integration_test.h b/test/integration/http_timeout_integration_test.h
index 3c9aa733da119..5c73fcbfeef41 100644
--- a/test/integration/http_timeout_integration_test.h
+++ b/test/integration/http_timeout_integration_test.h
@@ -29,7 +29,9 @@ class HttpTimeoutIntegrationTest : public testing::TestWithParam<Network::Addres
                   hcm) {
             envoy::config::filter::http::router::v2::Router router_config;
             router_config.set_respect_expected_rq_timeout(respect_expected_rq_timeout);
-            TestUtility::jsonConvert(router_config, *hcm.mutable_http_filters(0)->mutable_config());
+            // TestUtility::jsonConvert(router_config,
+            // *hcm.mutable_http_filters(0)->mutable_config());
+            hcm.mutable_http_filters(0)->mutable_typed_config()->PackFrom(router_config);
           });
     }
 
diff --git a/test/integration/integration_test.cc b/test/integration/integration_test.cc
index 19d4aab45b341..96913bab8306c 100644
--- a/test/integration/integration_test.cc
+++ b/test/integration/integration_test.cc
@@ -290,7 +290,8 @@ TEST_P(IntegrationTest, UpstreamDisconnectWithTwoRequests) {
 // Test hitting the bridge filter with too many response bytes to buffer. Given
 // the headers are not proxied, the connection manager will send a local error reply.
 TEST_P(IntegrationTest, HittingGrpcFilterLimitBufferingHeaders) {
-  config_helper_.addFilter("{ name: envoy.grpc_http1_bridge, config: {} }");
+  config_helper_.addFilter("{ name: envoy.grpc_http1_bridge, typed_config: { \"@type\": "
+                           "type.googleapis.com/google.protobuf.Empty } }");
   config_helper_.setBufferLimits(1024, 1024);
 
   initialize();
@@ -752,7 +753,8 @@ TEST_P(IntegrationTest, ViaAppendWith100Continue) {
 TEST_P(IntegrationTest, TestDelayedConnectionTeardownOnGracefulClose) {
   // This test will trigger an early 413 Payload Too Large response due to buffer limits being
   // exceeded. The following filter is needed since the router filter will never trigger a 413.
-  config_helper_.addFilter("{ name: envoy.http_dynamo_filter, config: {} }");
+  config_helper_.addFilter("{ name: envoy.http_dynamo_filter, typed_config: { \"@type\": "
+                           "type.googleapis.com/google.protobuf.Empty } }");
   config_helper_.setBufferLimits(1024, 1024);
   initialize();
 
@@ -786,7 +788,8 @@ TEST_P(IntegrationTest, TestDelayedConnectionTeardownOnGracefulClose) {
 // Test configuration of the delayed close timeout on downstream HTTP/1.1 connections. A value of 0
 // disables delayed close processing.
 TEST_P(IntegrationTest, TestDelayedConnectionTeardownConfig) {
-  config_helper_.addFilter("{ name: envoy.http_dynamo_filter, config: {} }");
+  config_helper_.addFilter("{ name: envoy.http_dynamo_filter, typed_config: { \"@type\": "
+                           "type.googleapis.com/google.protobuf.Empty } }");
   config_helper_.setBufferLimits(1024, 1024);
   config_helper_.addConfigModifier(
       [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
@@ -822,7 +825,8 @@ TEST_P(IntegrationTest, TestDelayedConnectionTeardownConfig) {
 
 // Test that delay closed connections are eventually force closed when the timeout triggers.
 TEST_P(IntegrationTest, TestDelayedConnectionTeardownTimeoutTrigger) {
-  config_helper_.addFilter("{ name: envoy.http_dynamo_filter, config: {} }");
+  config_helper_.addFilter("{ name: envoy.http_dynamo_filter, typed_config: { \"@type\": "
+                           "type.googleapis.com/google.protobuf.Empty } }");
   config_helper_.setBufferLimits(1024, 1024);
   config_helper_.addConfigModifier(
       [](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm) {
@@ -856,7 +860,8 @@ TEST_P(IntegrationTest, TestDelayedConnectionTeardownTimeoutTrigger) {
 
 // Test that if the route cache is cleared, it doesn't cause problems.
 TEST_P(IntegrationTest, TestClearingRouteCacheFilter) {
-  config_helper_.addFilter("{ name: clear-route-cache, config: {} }");
+  config_helper_.addFilter("{ name: clear-route-cache, typed_config: { \"@type\": "
+                           "type.googleapis.com/google.protobuf.Empty } }");
   initialize();
   codec_client_ = makeHttpConnection(lookupPort("http"));
   sendRequestAndWaitForResponse(default_request_headers_, 0, default_response_headers_, 0);
@@ -893,7 +898,8 @@ TEST_P(IntegrationTest, NoConnectionPoolsFree) {
 }
 
 TEST_P(IntegrationTest, ProcessObjectHealthy) {
-  config_helper_.addFilter("{ name: process-context-filter, config: {} }");
+  config_helper_.addFilter("{ name: process-context-filter, typed_config: { \"@type\": "
+                           "type.googleapis.com/google.protobuf.Empty } }");
 
   ProcessObjectForFilter healthy_object(true);
   process_object_ = healthy_object;
@@ -913,7 +919,8 @@ TEST_P(IntegrationTest, ProcessObjectHealthy) {
 }
 
 TEST_P(IntegrationTest, ProcessObjectUnealthy) {
-  config_helper_.addFilter("{ name: process-context-filter, config: {} }");
+  config_helper_.addFilter("{ name: process-context-filter, typed_config: { \"@type\": "
+                           "type.googleapis.com/google.protobuf.Empty } }");
 
   ProcessObjectForFilter unhealthy_object(false);
   process_object_ = unhealthy_object;
diff --git a/test/integration/overload_integration_test.cc b/test/integration/overload_integration_test.cc
index f3084936c7025..acd24267ec9c0 100644
--- a/test/integration/overload_integration_test.cc
+++ b/test/integration/overload_integration_test.cc
@@ -18,7 +18,8 @@ class OverloadIntegrationTest : public HttpProtocolIntegrationTest {
           nanos: 1000000
         resource_monitors:
           - name: "envoy.resource_monitors.injected_resource"
-            config:
+            typed_config:
+              "@type": type.googleapis.com/envoy.config.resource_monitor.injected_resource.v2alpha.InjectedResourceConfig
               filename: "{}"
         actions:
           - name: "envoy.overload_actions.stop_accepting_requests"
diff --git a/test/integration/protocol_integration_test.cc b/test/integration/protocol_integration_test.cc
index 0691b8bb144e0..0cd72645f2438 100644
--- a/test/integration/protocol_integration_test.cc
+++ b/test/integration/protocol_integration_test.cc
@@ -146,7 +146,8 @@ TEST_P(ProtocolIntegrationTest, RouterRedirect) {
 TEST_P(ProtocolIntegrationTest, ComputedHealthCheck) {
   config_helper_.addFilter(R"EOF(
 name: envoy.health_check
-config:
+typed_config:
+    "@type": type.googleapis.com/envoy.config.filter.http.health_check.v2.HealthCheck
     pass_through_mode: false
     cluster_min_healthy_percentages:
         example_cluster_name: { value: 75 }
@@ -166,7 +167,8 @@ name: envoy.health_check
 TEST_P(ProtocolIntegrationTest, ModifyBuffer) {
   config_helper_.addFilter(R"EOF(
 name: envoy.health_check
-config:
+typed_config:
+    "@type": type.googleapis.com/envoy.config.filter.http.health_check.v2.HealthCheck
     pass_through_mode: false
     cluster_min_healthy_percentages:
         example_cluster_name: { value: 75 }
@@ -185,7 +187,8 @@ name: envoy.health_check
 TEST_P(ProtocolIntegrationTest, AddEncodedTrailers) {
   config_helper_.addFilter(R"EOF(
 name: add-trailers-filter
-config: {}
+typed_config:
+  "@type": type.googleapis.com/google.protobuf.Empty
 )EOF");
   initialize();
 
@@ -500,7 +503,8 @@ TEST_P(ProtocolIntegrationTest, RetryHittingRouteLimits) {
 // Test hitting the dynamo filter with too many request bytes to buffer. Ensure the connection
 // manager sends a 413.
 TEST_P(DownstreamProtocolIntegrationTest, HittingDecoderFilterLimit) {
-  config_helper_.addFilter("{ name: envoy.http_dynamo_filter, config: {} }");
+  config_helper_.addFilter("{ name: envoy.http_dynamo_filter, typed_config: { \"@type\": "
+                           "type.googleapis.com/google.protobuf.Empty } }");
   config_helper_.setBufferLimits(1024, 1024);
   initialize();
 
@@ -535,7 +539,8 @@ TEST_P(DownstreamProtocolIntegrationTest, HittingDecoderFilterLimit) {
 // are sent on early, the stream/connection will be reset.
 TEST_P(ProtocolIntegrationTest, HittingEncoderFilterLimit) {
   useAccessLog();
-  config_helper_.addFilter("{ name: envoy.http_dynamo_filter, config: {} }");
+  config_helper_.addFilter("{ name: envoy.http_dynamo_filter, typed_config: { \"@type\": "
+                           "type.googleapis.com/google.protobuf.Empty } }");
   config_helper_.setBufferLimits(1024, 1024);
   initialize();
 
diff --git a/test/integration/ratelimit_integration_test.cc b/test/integration/ratelimit_integration_test.cc
index d4b8aef58acea..a9a9cbca401a5 100644
--- a/test/integration/ratelimit_integration_test.cc
+++ b/test/integration/ratelimit_integration_test.cc
@@ -44,9 +44,7 @@ class RatelimitIntegrationTest : public Grpc::GrpcClientIntegrationParamTest,
 
       envoy::api::v2::listener::Filter ratelimit_filter;
       ratelimit_filter.set_name("envoy.rate_limit");
-      ProtobufWkt::Struct ratelimit_config = ProtobufWkt::Struct();
-      TestUtility::jsonConvert(proto_config_, ratelimit_config);
-      ratelimit_filter.mutable_config()->MergeFrom(ratelimit_config);
+      ratelimit_filter.mutable_typed_config()->PackFrom(proto_config_);
       config_helper_.addFilter(MessageUtil::getJsonStringFromMessage(ratelimit_filter));
     });
     config_helper_.addConfigModifier(
diff --git a/test/integration/tcp_proxy_integration_test.cc b/test/integration/tcp_proxy_integration_test.cc
index 060c24afdb406..5488cb820921c 100644
--- a/test/integration/tcp_proxy_integration_test.cc
+++ b/test/integration/tcp_proxy_integration_test.cc
@@ -235,10 +235,12 @@ TEST_P(TcpProxyIntegrationTest, AccessLog) {
   config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
     auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
     auto* filter_chain = listener->mutable_filter_chains(0);
-    auto* config_blob = filter_chain->mutable_filters(0)->mutable_config();
+    auto* config_blob = filter_chain->mutable_filters(0)->mutable_typed_config();
 
-    envoy::config::filter::network::tcp_proxy::v2::TcpProxy tcp_proxy_config;
-    TestUtility::jsonConvert(*config_blob, tcp_proxy_config);
+    ASSERT_TRUE(config_blob->Is<envoy::config::filter::network::tcp_proxy::v2::TcpProxy>());
+    auto tcp_proxy_config =
+        MessageUtil::anyConvert<envoy::config::filter::network::tcp_proxy::v2::TcpProxy>(
+            *config_blob);
 
     auto* access_log = tcp_proxy_config.add_access_log();
     access_log->set_name("envoy.file_access_log");
@@ -247,9 +249,8 @@ TEST_P(TcpProxyIntegrationTest, AccessLog) {
     access_log_config.set_format(
         "upstreamlocal=%UPSTREAM_LOCAL_ADDRESS% "
         "upstreamhost=%UPSTREAM_HOST% downstream=%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%\n");
-    TestUtility::jsonConvert(access_log_config, *access_log->mutable_config());
-
-    TestUtility::jsonConvert(tcp_proxy_config, *config_blob);
+    access_log->mutable_typed_config()->PackFrom(access_log_config);
+    config_blob->PackFrom(tcp_proxy_config);
   });
   initialize();
 
@@ -323,14 +324,16 @@ TEST_P(TcpProxyIntegrationTest, TestIdletimeoutWithNoData) {
   config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
     auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
     auto* filter_chain = listener->mutable_filter_chains(0);
-    auto* config_blob = filter_chain->mutable_filters(0)->mutable_config();
+    auto* config_blob = filter_chain->mutable_filters(0)->mutable_typed_config();
 
-    envoy::config::filter::network::tcp_proxy::v2::TcpProxy tcp_proxy_config;
-    TestUtility::jsonConvert(*config_blob, tcp_proxy_config);
+    ASSERT_TRUE(config_blob->Is<envoy::config::filter::network::tcp_proxy::v2::TcpProxy>());
+    auto tcp_proxy_config =
+        MessageUtil::anyConvert<envoy::config::filter::network::tcp_proxy::v2::TcpProxy>(
+            *config_blob);
     tcp_proxy_config.mutable_idle_timeout()->set_nanos(
         std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::milliseconds(100))
             .count());
-    TestUtility::jsonConvert(tcp_proxy_config, *config_blob);
+    config_blob->PackFrom(tcp_proxy_config);
   });
 
   initialize();
@@ -344,14 +347,16 @@ TEST_P(TcpProxyIntegrationTest, TestIdletimeoutWithLargeOutstandingData) {
   config_helper_.addConfigModifier([&](envoy::config::bootstrap::v2::Bootstrap& bootstrap) -> void {
     auto* listener = bootstrap.mutable_static_resources()->mutable_listeners(0);
     auto* filter_chain = listener->mutable_filter_chains(0);
-    auto* config_blob = filter_chain->mutable_filters(0)->mutable_config();
+    auto* config_blob = filter_chain->mutable_filters(0)->mutable_typed_config();
 
-    envoy::config::filter::network::tcp_proxy::v2::TcpProxy tcp_proxy_config;
-    TestUtility::jsonConvert(*config_blob, tcp_proxy_config);
+    ASSERT_TRUE(config_blob->Is<envoy::config::filter::network::tcp_proxy::v2::TcpProxy>());
+    auto tcp_proxy_config =
+        MessageUtil::anyConvert<envoy::config::filter::network::tcp_proxy::v2::TcpProxy>(
+            *config_blob);
     tcp_proxy_config.mutable_idle_timeout()->set_nanos(
         std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::milliseconds(500))
             .count());
-    TestUtility::jsonConvert(tcp_proxy_config, *config_blob);
+    config_blob->PackFrom(tcp_proxy_config);
   });
 
   initialize();
diff --git a/test/integration/transport_socket_match_integration_test.cc b/test/integration/transport_socket_match_integration_test.cc
index 94fed140eaa45..43448ea3ed7ac 100644
--- a/test/integration/transport_socket_match_integration_test.cc
+++ b/test/integration/transport_socket_match_integration_test.cc
@@ -34,7 +34,8 @@ name: "tls_socket"
   mtlsReady: "true"
 transport_socket:
   name: "tls"
-  config:
+  typed_config:
+    "@type": type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext
     common_tls_context:
       tls_certificates:
       - certificate_chain: { filename: "%s" }
diff --git a/test/integration/vhds_integration_test.cc b/test/integration/vhds_integration_test.cc
index 1276d5e8171d5..561cd99917d38 100644
--- a/test/integration/vhds_integration_test.cc
+++ b/test/integration/vhds_integration_test.cc
@@ -56,7 +56,8 @@ const char Config[] = R"EOF(
     filter_chains:
     - filters:
       - name: envoy.http_connection_manager
-        config:
+        typed_config:
+          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
           stat_prefix: config_test
           http_filters:
           - name: envoy.router
diff --git a/test/server/test_data/static_validation/network_filter_unknown_field.yaml b/test/server/test_data/static_validation/network_filter_unknown_field.yaml
index 35450ef00657d..79ec8943aced6 100644
--- a/test/server/test_data/static_validation/network_filter_unknown_field.yaml
+++ b/test/server/test_data/static_validation/network_filter_unknown_field.yaml
@@ -8,7 +8,8 @@ static_resources:
     filter_chains:
     - filters:
       - name: envoy.http_connection_manager
-        config:
+        typed_config:
+          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
           codec_type: HTTP2
           stat_prefix: blah
           route_config: {}
diff --git a/test/server/zipkin_tracing.yaml b/test/server/zipkin_tracing.yaml
index 8a525f77f1cfd..726c80c7e2201 100644
--- a/test/server/zipkin_tracing.yaml
+++ b/test/server/zipkin_tracing.yaml
@@ -5,7 +5,8 @@ static_resources:
 tracing:
   http:
     name: envoy.zipkin
-    config:
+    typed_config:
+      "@type": type.googleapis.com/envoy.config.trace.v2.ZipkinConfig
       collector_cluster: zipkin
       collector_endpoint: "/api/v1/spans"
       collector_endpoint_version: HTTP_JSON