Querier: block query by hash

[dannykopping]

What this PR does / why we need it:
Using the query blocker can be unergonomic since queries can be long, require escaping, or hard to copy from logs. This change enables an operator to block queries by their hash.

Which issue(s) this PR fixes:
N/A

Special notes for your reviewer:
We should probably provide a tool for creating uint32 representations of 32-bit FNV-1 hashes; all the online tools I found produce a hex value. It's not strictly necessary though since we have the query_hash in the logs, but it would be nice.

Checklist

• Reviewed the CONTRIBUTING.md guide (required)
• Documentation added
• Tests updated
• CHANGELOG.md updated
• Changes that require user attention or interaction to upgrade are documented in docs/sources/upgrading/_index.md

[chaudum]

The query hash changes when the order of the labels in the matcher changes, right? At some point we should hash the AST of the query so that logically ident queries have the same hash.

[dannykopping]

The query hash changes when the order of the labels in the matcher changes, right? At some point we should hash the AST of the query so that logically ident queries have the same hash.

Yes, it's a hash of the query string - the contents of the string are not considered at all.

[owen-d]

❤️ lgtm

[JStickler]

[docs team] LGTM.

Just one question, how would a tenant know if their query had been blocked? I'm guessing that not every user will have access to the logs, some users might run a query in the UI and have no idea why it did not complete?

[dannykopping]

[docs team] LGTM.

Just one question, how would a tenant know if their query had been blocked? I'm guessing that not every user will have access to the logs, some users might run a query in the UI and have no idea why it did not complete?

They will currently get a simple error stating "query blocked by policy". They'll then likely make contact with support to ask why this is happening. We have to be a bit circumspect sometimes because a bad actor might be trying to disrupt the service, and we don't want to give away too much - but on the other hand we want to be user-friendly for the majority of folks who will see this who will not be bad actors.

Definitely a topic to discuss further, let's touch base on it tomorrow?
I'll merge this so long, and we can improve the user experience if necessary in another PR.

[JStickler]

They will currently get a simple error stating "query blocked by policy".

OK, good, there's at least some indication why the query didn't run as expected. That's mainly what I was looking for.