> Where would one take a machine to dynamically reconfigure envoy? How would one configure it?

When I worked in this area a while back - Ingess Controllers and Ingress / a custom type we made because Ingress was too limited.

We didn't use nginx because it would drop requests and mess up connections during certain config reloads. With a custom controller, Envoy never dropped a connection or request we didn't explicitly tell it to (excepting network reliability of course). For context a slow day for us was many billions of requests.