I am trying to apply a global HTTP retry policy to all internal traffic in my Istio service mesh. All of my pods have the Istio sidecar proxy injected.

I tried using an EnvoyFilter with the following configuration:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: global-retry
  namespace: istio-system
spec:
  configPatches:
  - applyTo: HTTP_ROUTE
    match:
      context: SIDECAR_OUTBOUND
      routeConfiguration:
        vhost:
          name: "*:80"  # Matches all virtual hosts on port 80, you can add more ports if needed
    patch:
      operation: MERGE
      value:
        route:
          retry_policy:
            retry_on: "5xx,connect-failure,refused-stream"
            num_retries: 3
            per_try_timeout: 2s

However, the retry policy does not seem to be applied as expected. The retries are not triggered on failures for the internal traffic between services.

Is there something wrong with the EnvoyFilter configuration?
Should I be using a different approach to apply a global retry policy for all outbound traffic in the service mesh?
Is there a better way to achieve this using VirtualService, DestinationRule, sidecar/istio config, or another Istio resource?