如何通过Terraform为特定GCE实例绑定对应GCP监控告警策略

你之前通过实例元数据绑定告警策略的方法无效——GCP监控不会识别自定义的policy-1-id这类元数据字段，google-monitoring-enabled仅用于开启实例的监控数据采集，和告警策略的作用范围无关。

要实现policy-1仅作用于instance-1、policy-2仅作用于instance-2，有两种可靠方式：

方法1：直接在告警策略中指定实例名称 #

修改Terraform中google_monitoring_alert_policy资源的过滤规则，通过resource.label.instance_name锁定目标实例：

policy-1 配置示例 #

resource "google_monitoring_alert_policy" "policy-1" {
  display_name = "policy-1"
  combiner     = "OR"

  conditions {
    display_name = "[instance-1] CPU使用率过高"
    condition_threshold {
      # 过滤规则限定仅作用于instance-1
      filter = "metric.type=\"compute.googleapis.com/instance/cpu/utilization\" AND resource.type=\"gce_instance\" AND resource.label.instance_name=\"instance-1\""
      threshold_value = 0.8
      duration        = "60s"
      comparison      = "COMPARISON_GT"
    }
  }

  # 绑定你的通知渠道（根据现有配置调整）
  notification_channels = [google_monitoring_notification_channel.email.id]
}

policy-2 配置示例 #

只需把过滤规则中的instance_name替换为instance-2：

resource "google_monitoring_alert_policy" "policy-2" {
  display_name = "policy-2"
  combiner     = "OR"

  conditions {
    display_name = "[instance-2] 内存使用率过高"
    condition_threshold {
      filter = "metric.type=\"compute.googleapis.com/instance/memory/utilization\" AND resource.type=\"gce_instance\" AND resource.label.instance_name=\"instance-2\""
      threshold_value = 0.9
      duration        = "60s"
      comparison      = "COMPARISON_GT"
    }
  }

  notification_channels = [google_monitoring_notification_channel.email.id]
}

方法2：通过实例标签批量绑定（更灵活） #

如果后续需要给多个实例绑定同一策略，推荐用标签管理：

步骤1：给GCE实例添加标签 #

resource "google_compute_instance" "instance-1" {
  name         = "instance-1"
  machine_type = "e2-micro"
  zone         = "us-central1-a"

  # 添加标签标识对应告警策略
  labels = {
    alert-policy = "policy-1"
  }

  # 其他实例配置（磁盘、网络等）...
}

resource "google_compute_instance" "instance-2" {
  name         = "instance-2"
  machine_type = "e2-micro"
  zone         = "us-central1-a"

  labels = {
    alert-policy = "policy-2"
  }

  # 其他实例配置...
}

步骤2：修改告警策略过滤标签 #

# policy-1 仅作用于带alert-policy=policy-1标签的实例
resource "google_monitoring_alert_policy" "policy-1" {
  display_name = "policy-1"
  combiner     = "OR"

  conditions {
    display_name = "CPU使用率过高"
    condition_threshold {
      filter = "metric.type=\"compute.googleapis.com/instance/cpu/utilization\" AND resource.type=\"gce_instance\" AND resource.label.alert-policy=\"policy-1\""
      threshold_value = 0.8
      duration        = "60s"
      comparison      = "COMPARISON_GT"
    }
  }

  notification_channels = [google_monitoring_notification_channel.email.id]
}

# policy-2 仅作用于带alert-policy=policy-2标签的实例
resource "google_monitoring_alert_policy" "policy-2" {
  display_name = "policy-2"
  combiner     = "OR"

  conditions {
    display_name = "内存使用率过高"
    condition_threshold {
      filter = "metric.type=\"compute.googleapis.com/instance/memory/utilization\" AND resource.type=\"gce_instance\" AND resource.label.alert-policy=\"policy-2\""
      threshold_value = 0.9
      duration        = "60s"
      comparison      = "COMPARISON_GT"
    }
  }

  notification_channels = [google_monitoring_notification_channel.email.id]
}

验证修改 #

执行terraform apply更新资源后，触发告警测试（比如给instance-1加压），只会收到对应策略的告警邮件，不会再出现交叉触发的情况。

内容的提问来源于stack exchange，提问作者Thomas Wening