envoy: Unable to get new style (websocket) upgrades work

Description:

I was trying to get websockets to work with the new style upgrade support as detailed at https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/websocket#new-style-upgrade-support

Well, the old style support works when I use use_websocket field, but the new style does not.

I am getting 403 return codes like such -

$ wscat --connect localhost:10000/
error: Unexpected server response: 403

The right connection looks like -

$ wscat --connect echo.websocket.org
connected (press CTRL+C to quit)
> Test
< Test

Config for repro:

admin:
  access_log_path: /tmp/admin_access.log
  address:
    socket_address: { address: 0.0.0.0, port_value: 9901 }
static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address: { address: 0.0.0.0, port_value: 10000 }
    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        config:
          upgrade_configs:
          - upgrade_type: websocket
          stat_prefix: ingress_http
          codec_type: AUTO
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: ["*"]
              routes:
              - match: { prefix: "/" }
                route: { host_rewrite: echo.websocket.org, cluster: websocket_cluster }
          http_filters:
          - name: envoy.router
  clusters:
  - name: websocket_cluster
    type: LOGICAL_DNS
    dns_lookup_family: V4_ONLY
    connect_timeout: 10s
    lb_policy: ROUND_ROBIN
    hosts: [{ socket_address: { address: echo.websocket.org, port_value: 80 }}]

I am running this config in the latest envoy container image - envoyproxy/envoy:latest