🚀 Wave Autoscale 3.2.2: SSO, Realtime Smart Sizing, and Wave Diagnosis

Author: Hwansoo Kim (opens in a new tab)
Date: May 21, 2026

TL;DR

• Realtime Smart Sizing. Recommendations now apply automatically via Kubernetes in-place pod resize (1.27+) or manifest patch — no pod restarts, no rollouts. VPA-style hysteresis keeps churn out of production.
• OIDC Single Sign-On. The Web Console federates to Okta, Microsoft Entra ID, Google Workspace, and Keycloak. The local admin survives as a break-glass path; no shared password.
• Wave Insights is now Wave Diagnosis. Same data, reorganized around the questions an SRE actually asks during an incident — Failures, Waste, Capacity. Old URLs redirect.

🎯 Realtime Smart Sizing — recommendation to action, automatically

The Kubernetes-native alternative is VPA. VPA historically applied recommendations by evicting and restarting pods; its newer InPlaceOrRecreate update mode (beta in K8s 1.33, graduating with in-place pod resize in 1.35) calls the same /resize subresource Wave does, and falls back to evict-and-recreate when the node can't accommodate the change. So both projects can avoid restarts on a recent cluster — the differentiation moves upstream of the resize call: how the recommendation is chosen, when it actually applies, and what the operator sees. Wave Smart Sizing has driven the recommendation side for several releases; 3.2.2 wires up the apply path with the surrounding pipeline (per-container buffer / min / max, a 3-guard hysteresis check that catches large-container drift VPA misses, and an Apply History panel in the Web Console).

Each workload (Deployment, StatefulSet, DaemonSet, Argo Rollout, OpenShift DeploymentConfig) picks one of three Apply Modes:

• Off — recommend only, never touch the workload.
• In-Place Pod Resize — call the Kubernetes 1.27+ /resize subresource on running pods. No restart, no rollout, no downtime. (InPlacePodVerticalScaling feature gate; GA in 1.33.)
• Manifest Patch — patch the workload spec; new pods pick it up on next rollout. Safe everywhere.

Automatic application is opt-in per container — nothing changes in your cluster until you explicitly enable it.

Hysteresis that respects production noise

A 10-minute cycle producing slightly different recommendations every time would create unacceptable churn. Wave applies only when any of three guards trips:

The 10% priority guard matches the VPA Updater's --pod-update-threshold default — the industry-standard reference value. The absolute-value guards are our addition: they catch the case VPA misses, where a large container drifts by a small percentage but a meaningful absolute amount.

Caveats — read before turning auto-apply on

• In-Place is fire-and-forget per pod. If the kubelet rejects the resize for node-resource reasons, Wave skips that pod and retries on the next cycle. Use Manifest mode when you need a guaranteed reschedule.
• Manifest mode conflicts with Argo CD auto-sync. Argo will revert the patch as drift. Turn auto-sync off for workloads where Wave should own resource values — same restriction that already applies to Autopilot.
• Deployment auto-apply releases on Autopilot transition. Autopilot owns resource decisions for what it manages; Wave will not have two writers fighting for the same fields.

The full operations guide lives at /docs/wave-sizing/realtime-smart-sizing.

🔐 OIDC Single Sign-On

Kubernetes does not solve dashboard authentication. Console-style tools either ship without auth, depend on kubectl proxy plus your kubeconfig, or roll a single shared admin account. None of those passes a compliance review for a team. Wave Autoscale's Web Console had the single-shared-admin problem; 3.2.2 fixes it.

• Standards-based OIDC. Works with Okta, Microsoft Entra ID (Azure AD), Google Workspace, Keycloak, and other OIDC providers. Authorization Code with PKCE, configurable email claim, optional verified-email enforcement.
• Stateless. OIDC state, nonce, and PKCE verifier travel in a single AES-256-GCM-encrypted cookie. No external session store, no Redis.
• Pre-provisioned users. Admins create user rows with auth_source = sso and assign one of the existing roles (Viewer / Operator / Manager / Admin). First IdP login binds to the row by email.
• Local admin survives as break-glass. A toggle on the login screen keeps the legacy account available — so an IdP outage cannot lock you out of the cluster.

Setup is documented end-to-end at /docs/administration/sso-setup — env var table, claims mapping, IdP-specific gotchas (Entra ID personal accounts, Keycloak's preferred_username immutability), and troubleshooting. Plan on about 10 minutes per IdP for the first setup.

🔍 Wave Insights → Wave Diagnosis

The native Kubernetes story for "why is this workload broken right now" is kubectl describe, kubectl logs, and a chain of dashboards. The console is a third tab, opened after the obvious ones, and the operator already knows what they're looking for. Forecasting framing — "what might break" — sits in the way of that workflow.

3.2.2 reorganizes the area into three buckets, each answering one question:

Each page leads with a question and a severity-colored verdict that gives the answer up front. Underlying tables, charts, and metric collection are unchanged.

What this means for old links

The Diagnosis docs live under /docs/wave-diagnosis/*. Old documentation URLs continue to work via 301 redirects — bookmarks, Slack threads, and search-engine entries from the previous structure are not broken. The sub-grouping (Reliability / Performance / Cost Efficiency) is replaced by Failures / Waste / Capacity to match the console. API paths and query keys are untouched.