Why does an Envoy listener route work locally but fail in production?

When deploying the same Envoy configuration that passes local integration tests, the listener fails to match a specific HTTP route in the production environment, returning a 404 response despite identical YAML files.

The setup uses a static listener with a route configuration that includes a prefix matcher on /api/ and a corresponding cluster. No dynamic discovery services are involved, and the Envoy binary version matches the one used locally.

Possible causes could involve differences in listener filters, runtime overrides, or subtle variations in the effective configuration after hot‑restart. Identifying the exact point where the route table diverges is unclear.

What factors might cause the route to be ignored only in prod? How can differences in filter chains or runtime settings affect matching? Which Envoy admin endpoints or logs help diagnose the mismatch?