apiVersion: logging.opsgy.com/v1beta1
kind: LokiRule
metadata:
  name: credentials-leak
  namespace: prod
spec:
  groups:
  - name: credentials_leak
    rules:
    - alert: http-credentials-leaked
      annotations:
        message: '{{ $labels.job }} is leaking http basic auth credentials.'
      expr: sum by (cluster, job, pod) (count_over_time({namespace="prod"} |~ "http(s?)://(\\w+):(\\w+)@" [5m]) > 0)
      for: 10m
      labels:
        severity: critical