wasm: use root stats scope for upstream filter stats

Upstream HTTP Wasm filter stats currently use the cluster stats scope,
while downstream HTTP Wasm filter stats use the server-wide root scope. This
causes upstream custom metrics to inherit the cluster prefix and Prometheus
cluster label, even though Wasm extension stats should be scoped consistently
across downstream and upstream filters.

Use the server-wide root stats scope for upstream HTTP Wasm filter stats and
keep the old cluster-scope behavior behind the
envoy.reloadable_features.upstream_wasm_filter_uses_root_scope runtime guard.
Setting the guard to false temporarily reverts to the previous behavior.

Signed-off-by: Yueshang zuo <zuoyueshang.zys@alibaba-inc.com>

Author: yueshangzuo

changelogs/current/minor_behavior_changes/wasm__upstream-http-wasm-stats-use-root-scope.rst

@@ -0,0 +1,9 @@
+Upstream HTTP Wasm filter stats now use the server-wide root stats scope instead of the
+cluster stats scope, matching downstream HTTP Wasm filter scoping. For a custom counter ``foo``
+in the ``wasmcustom`` namespace, admin ``/stats`` output changes from
+``cluster.<cluster_name>.wasmcustom.foo`` to ``wasmcustom.foo``. Prometheus output changes from
+``envoy_cluster_wasmcustom_foo{envoy_cluster_name="X"}`` to ``foo`` because the leading registered
+custom namespace is stripped by the Prometheus formatter. Plugins that need per-cluster
+differentiation should encode the cluster name into the metric name themselves. Can be reverted
+by setting runtime guard ``envoy.reloadable_features.upstream_wasm_filter_uses_root_scope`` to
+``false``.

source/common/runtime/runtime_features.cc

@@ -113,6 +113,7 @@ RUNTIME_GUARD(envoy_reloadable_features_tls_certificate_compression_brotli);
 RUNTIME_GUARD(envoy_reloadable_features_trace_refresh_after_route_refresh);
 RUNTIME_GUARD(envoy_reloadable_features_udp_set_do_not_fragment);
 RUNTIME_GUARD(envoy_reloadable_features_uhv_allow_malformed_url_encoding);
+RUNTIME_GUARD(envoy_reloadable_features_upstream_wasm_filter_uses_root_scope);
 RUNTIME_GUARD(envoy_reloadable_features_uri_template_match_on_asterisk);
 RUNTIME_GUARD(envoy_reloadable_features_use_migration_in_quiche);
 RUNTIME_GUARD(envoy_reloadable_features_use_response_decoder_handle);

source/extensions/filters/http/wasm/BUILD

@@ -19,6 +19,7 @@ envoy_cc_library(
         "//envoy/http:codes_interface",
         "//envoy/server:filter_config_interface",
         "//envoy/upstream:cluster_manager_interface",
+        "//source/common/runtime:runtime_lib",
         "//source/extensions/common/wasm:remote_async_datasource_lib",
         "//source/extensions/common/wasm:wasm_lib",
         "@envoy_api//envoy/extensions/filters/http/wasm/v3:pkg_cc_proto",

source/extensions/filters/http/wasm/wasm_filter.cc

@@ -1,10 +1,24 @@
 #include "source/extensions/filters/http/wasm/wasm_filter.h"
 
+#include "source/common/runtime/runtime_features.h"
+
 namespace Envoy {
 namespace Extensions {
 namespace HttpFilters {
 namespace Wasm {
 
+namespace {
+
+Stats::Scope& upstreamWasmStatsScope(Server::Configuration::UpstreamFactoryContext& context) {
+  if (Runtime::runtimeFeatureEnabled(
+          "envoy.reloadable_features.upstream_wasm_filter_uses_root_scope")) {
+    return context.serverFactoryContext().serverScope();
+  }
+  return context.scope();
+}
+
+} // namespace
+
 FilterConfig::FilterConfig(const envoy::extensions::filters::http::wasm::v3::Wasm& config,
                            Server::Configuration::FactoryContext& context)
     : Extensions::Common::Wasm::PluginConfig(
@@ -13,9 +27,10 @@ FilterConfig::FilterConfig(const envoy::extensions::filters::http::wasm::v3::Was
 
 FilterConfig::FilterConfig(const envoy::extensions::filters::http::wasm::v3::Wasm& config,
                            Server::Configuration::UpstreamFactoryContext& context)
-    : Extensions::Common::Wasm::PluginConfig(
-          config.config(), context.serverFactoryContext(), context.scope(), context.initManager(),
-          envoy::config::core::v3::TrafficDirection::OUTBOUND, nullptr, false) {}
+    : Extensions::Common::Wasm::PluginConfig(config.config(), context.serverFactoryContext(),
+                                             upstreamWasmStatsScope(context), context.initManager(),
+                                             envoy::config::core::v3::TrafficDirection::OUTBOUND,
+                                             nullptr, false) {}
 
 FilterConfig::FilterConfig(const envoy::extensions::filters::http::wasm::v3::Wasm& config,
                            Server::Configuration::ServerFactoryContext& context)

test/extensions/filters/http/wasm/BUILD

@@ -76,6 +76,7 @@ envoy_extension_cc_test(
         "//test/mocks/network:network_mocks",
         "//test/mocks/server:server_mocks",
         "//test/test_common:environment_lib",
+        "//test/test_common:test_runtime_lib",
         "@envoy_api//envoy/extensions/filters/http/wasm/v3:pkg_cc_proto",
     ],
 )

test/extensions/filters/http/wasm/config_test.cc

@@ -16,6 +16,7 @@
 #include "test/mocks/network/mocks.h"
 #include "test/mocks/server/mocks.h"
 #include "test/test_common/environment.h"
+#include "test/test_common/test_runtime.h"
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
@@ -120,6 +121,29 @@ class WasmFilterConfigTest
     return std::make_unique<FilterConfig>(proto_config, upstream_factory_context_);
   }
 
+  envoy::extensions::filters::http::wasm::v3::Wasm localWasmConfig(const std::string& name) {
+    const std::string yaml =
+        TestEnvironment::substitute(absl::StrCat(R"EOF(
+  config:
+    name: ")EOF",
+                                                 name, R"EOF("
+    vm_config:
+      vm_id: ")EOF",
+                                                 name, R"EOF("
+      runtime: "envoy.wasm.runtime.)EOF",
+                                                 std::get<0>(GetParam()), R"EOF("
+      configuration:
+         "@type": "type.googleapis.com/google.protobuf.StringValue"
+         value: "some configuration"
+      code:
+        local:
+          filename: "{{ test_rundir }}/test/extensions/filters/http/wasm/test_data/test_cpp.wasm"
+  )EOF"));
+    envoy::extensions::filters::http::wasm::v3::Wasm proto_config;
+    TestUtility::loadFromYaml(yaml, proto_config);
+    return proto_config;
+  }
+
   NiceMock<Network::MockListenerInfo> listener_info_;
   Stats::IsolatedStoreImpl stats_store_;
   Stats::Scope& stats_scope_{*stats_store_.rootScope()};
@@ -254,6 +278,53 @@ TEST_P(WasmFilterConfigTest, YamlLoadFromFileWasm) {
   EXPECT_TRUE(api_->customStatNamespaces().registered("wasmcustom"));
 }
 
+TEST_P(WasmFilterConfigTest, UpstreamWasmUsesServerScopeWhenRuntimeGuardEnabled) {
+  if (std::get<2>(GetParam())) {
+    GTEST_SKIP() << "Only applies to upstream Wasm filters.";
+  }
+
+  TestScopedRuntime scoped_runtime;
+  scoped_runtime.mergeValues(
+      {{"envoy.reloadable_features.upstream_wasm_filter_uses_root_scope", "true"}});
+  auto cluster_scope =
+      upstream_factory_context_.store_.rootScope()->createScope("cluster.test_cluster.");
+  ON_CALL(upstream_factory_context_, scope()).WillByDefault(ReturnRef(*cluster_scope));
+
+  const auto proto_config = localWasmConfig("upstream_wasm_root_scope");
+  EXPECT_CALL(init_watcher_, ready());
+  auto filter_config = getFilterConfig(proto_config);
+  initializeContextInitManager(init_watcher_);
+
+  const std::string full_stat_name =
+      absl::StrCat("wasm.envoy.wasm.runtime.", std::get<0>(GetParam()), ".created");
+  const auto counter = TestUtility::findCounter(
+      upstream_factory_context_.server_factory_context_.store_, full_stat_name);
+  ASSERT_NE(nullptr, counter);
+}
+
+TEST_P(WasmFilterConfigTest, UpstreamWasmUsesClusterScopeWhenRuntimeGuardDisabled) {
+  if (std::get<2>(GetParam())) {
+    GTEST_SKIP() << "Only applies to upstream Wasm filters.";
+  }
+
+  TestScopedRuntime scoped_runtime;
+  scoped_runtime.mergeValues(
+      {{"envoy.reloadable_features.upstream_wasm_filter_uses_root_scope", "false"}});
+  auto cluster_scope =
+      upstream_factory_context_.store_.rootScope()->createScope("cluster.test_cluster.");
+  ON_CALL(upstream_factory_context_, scope()).WillByDefault(ReturnRef(*cluster_scope));
+
+  const auto proto_config = localWasmConfig("upstream_wasm_cluster_scope");
+  EXPECT_CALL(init_watcher_, ready());
+  auto filter_config = getFilterConfig(proto_config);
+  initializeContextInitManager(init_watcher_);
+
+  const std::string full_stat_name = absl::StrCat("cluster.test_cluster.wasm.envoy.wasm.runtime.",
+                                                  std::get<0>(GetParam()), ".created");
+  const auto counter = TestUtility::findCounter(upstream_factory_context_.store_, full_stat_name);
+  ASSERT_NE(nullptr, counter);
+}
+
 TEST_P(WasmFilterConfigTest, DEPRECATED_FEATURE_TEST(YamlLoadFromFileWasmFailOpenOk)) {
   const std::string yaml = TestEnvironment::substitute(absl::StrCat(R"EOF(
   config: