---
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMAuth
metadata:
  name: main
  namespace: victoriametrics
spec:
  image:
    tag: v1.155.0
  replicaCount: 2
  podDisruptionBudget:
    minAvailable: 1
  affinity:
    podAntiAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        - labelSelector:
            matchLabels:
              app.kubernetes.io/instance: main
              app.kubernetes.io/name: vmauth
          topologyKey: kubernetes.io/hostname
  useStrictSecurity: true
  userNamespaceSelector:
    matchLabels:
      kubernetes.io/metadata.name: victoriametrics
  userSelector:
    matchLabels:
      app.kubernetes.io/part-of: victoriametrics
    matchExpressions:
      - key: app.kubernetes.io/component
        operator: In
        values:
          - ingest-auth
          - query-auth
  resources:
    requests:
      cpu: 2m
      memory: 64Mi
    limits:
      memory: 512Mi
---
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMUser
metadata:
  name: query
  namespace: victoriametrics
  labels:
    app.kubernetes.io/component: query-auth
    app.kubernetes.io/part-of: victoriametrics
spec:
  name: query
  tokenRef:
    name: vmauth-query-token
    key: token
  targetRefs:
    - static:
        url: http://vmselect-main.victoriametrics.svc.cluster.local:8481/select/0
      paths:
        - /prometheus/.*
---
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMUser
metadata:
  name: logs-query
  namespace: victoriametrics
  labels:
    app.kubernetes.io/component: query-auth
    app.kubernetes.io/part-of: victoriametrics
spec:
  name: logs-query
  tokenRef:
    name: vmauth-logs-query-token
    key: token
  targetRefs:
    - static:
        url: http://vlselect-main.victorialogs.svc.cluster.local:9471
      paths:
        - /select/logsql/.*
        - /select/tenant_ids
---
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMUser
metadata:
  name: relay-ingest
  namespace: victoriametrics
  labels:
    app.kubernetes.io/component: ingest-auth
    app.kubernetes.io/part-of: victoriametrics
spec:
  name: relay-ingest
  tokenRef:
    name: vmauth-relay-ingest-token
    key: token
  targetRefs:
    - static:
        url: http://vlinsert-main.victorialogs.svc.cluster.local:9481
      paths:
        - /insert/native.*