victoriametrics security policy

gistfile1.txt

resource "google_compute_security_policy" "victoriametrics" {
  name = "victoriametrics"

  rule {
    action   = "allow"
    priority = "1000"
    match {
      expr {
        # Querying from nat IP of the k8s cluster
        # https://github.com/VictoriaMetrics/VictoriaMetrics/tree/cluster#url-format
        expression = "request.path.matches('^/api/v1/query|^/api/v1/series|^/api/v1/label') && (inIpRange(origin.ip, 'x.x.x.x/32'))"
      }
    }
    description = "Allow querying api from nat IP of the k8s cluster"
  }

  rule {
    action   = "deny(404)"
    priority = "2147483647"
    match {
      versioned_expr = "SRC_IPS_V1"
      config {
        src_ip_ranges = ["*"]
      }
    }
    description = "default rule"
  }
}