Wave Flow CRDs

These kinds configure Wave Flow in CRD Mode. Use WaveFlowPolicy for priority-based traffic protection, and WaveNetfunnelMapping + WaveNetfunnelConnection for NetFunnel integration.

WaveFlowPolicy

WaveFlowPolicy defines priority classes for incoming traffic and the traffic-protection behavior for each class. It targets one or more workloads by namespace and name; when under pressure, Wave enforces the configured shedding strategy per class.

Scope: cluster-scoped — no metadata.namespace required.

apiVersion: wavek8s.com/v1alpha1
kind: WaveFlowPolicy
metadata:
  name: checkout-priority-policy
spec:
  description: Priority policy for the checkout service.
  enabled: true
  priorityClasses:
    - name: CRITICAL
      shed: disabled  # never shed — revenue-critical traffic must always pass
      concurrencyLimit: 200
      matchRules:
        - headers:
            - name: x-tier
              value: premium
          paths:
            - prefix: /api/v1/checkout
          methods:
            - POST
            - PUT
    - name: IMPORTANT
      shed: auto
      matchRules:
        - headers:
            - name: x-tier
              value: standard
    - name: MODERATE
      shed: auto
    - name: BULK
      shed: force  # force = always reject — emergency block
  targets:
    - namespace: payment
      name: checkout-api

Spec fields

Notes

• Cluster-scoped — a single WaveFlowPolicy can target workloads across multiple namespaces via targets[].namespace.
• priorityClasses defaults to an empty list. A policy with no classes is valid but enforces nothing.
• Within a matchRule, headers and paths entries must all match (AND logic); methods matches on any listed value (OR logic — a request has exactly one HTTP method). Multiple matchRules within one priorityClasses entry use OR logic — a request matches the class if any rule fully matches.
• A target workload that does not exist yet succeeds at kubectl apply time. Wave reports TargetNotFound in .status.conditions and reconciles automatically when the workload appears.
• Pruning (removing targets or classes from the CR) is a hard delete — rows absent from the current CR are removed on the next reconcile, not soft-disabled.

WaveNetfunnelMapping

WaveNetfunnelMapping binds a workload to NetFunnel project/segment rules. It enables Wave to pass traffic-control signals to the NetFunnel service for the named workload, optionally mapping the workload to one or more NetFunnel project–segment pairs.

Scope: namespaced — must be created in the same namespace as the target workload.

apiVersion: wavek8s.com/v1alpha1
kind: WaveNetfunnelMapping
metadata:
  name: checkout-nf-mapping
  namespace: payment
spec:
  targetRef:
    kind: Deployment
    name: checkout-api
  nfMapping:
    - nfProjectId: nf-project-001
      nfSegmentId: nf-segment-001
      isSection: true
    - nfProjectId: nf-project-001
      nfSegmentId: nf-segment-002
  rule:
    nfEnabled: true
    ruleCpu: 70.5
    ruleMemory: 80.0
    ruleMaxReplicas: true
    cooldownPeriodSecs: 120

Spec fields

Notes

• Namespaced — create the CR in the same namespace as the target workload. targetRef.kind must be one of Deployment, Rollout (Argo Rollouts), or DeploymentConfig (OpenShift).
• A workload that does not exist yet succeeds at kubectl apply time. Wave reports TargetNotFound in .status.conditions and reconciles automatically when the workload appears.
• nfMapping is whole-replace on each reconcile — entries absent from the current CR are soft-deleted. Include every project–segment pair you want active.
• A missing WaveNetfunnelConnection does not block reconciliation of the mapping itself, but NetFunnel enforcement requires a working connection to take effect.
• Deleting the CR sets nfEnabled: false and removes the workload's mapping entries — the rule is disabled, not erased.

WaveNetfunnelConnection

WaveNetfunnelConnection connects Wave to the NetFunnel service. It provides the API endpoint, tenant/organization identifiers, and Secret references for credentials. All WaveNetfunnelMapping CRs in the cluster share this single connection.

Scope: cluster-scoped — no metadata.namespace required.

First, create the credentials Secret in the wave-autoscale namespace:

apiVersion: v1
kind: Secret
metadata:
  name: nf-credentials
  namespace: wave-autoscale
type: Opaque
stringData:
  clientId: <your-netfunnel-client-id>
  secretKey: <your-netfunnel-secret-key>

Then create the connection CR:

apiVersion: wavek8s.com/v1alpha1
kind: WaveNetfunnelConnection
metadata:
  name: nf-connection
spec:
  host: https://nf.example.com
  tenantId: my-tenant-id
  organizationId: my-org-id
  nfApiType: saas
  clientIdSecretRef:
    name: nf-credentials
    key: clientId
  secretKeySecretRef:
    name: nf-credentials
    key: secretKey
  enabled: true

Spec fields

Notes

• Cluster-scoped — one CR serves all WaveNetfunnelMapping CRs in the cluster.
• Credentials are never stored in the CR. Wave reads the Secret values at reconcile time from the wave-autoscale namespace. A missing or inaccessible Secret reports SecretNotFound in .status.conditions.
• Singleton: only one WaveNetfunnelConnection may be active per cluster. If a second CR is applied, it reports Conflicted in .status.conditions and is skipped. The first CR reconciled retains the active connection.