When Envoy matches a route, it uses the following procedure:
The HTTP request’s host or :authority header is matched to a virtual host.
Each route entry in the virtual host is checked, in order. If there is a match, the route is used and no further route checks are made.
Independently, each virtual cluster in the virtual host is checked, in order. If there is a match, the virtual cluster is used and no further virtual cluster checks are made.