From 85e4c1d718dfcc36da84c4a86f13925be8686959 Mon Sep 17 00:00:00 2001
From: Joel Takvorian <jtakvori@redhat.com>
Date: Tue, 28 Oct 2025 12:28:40 +0100
Subject: [PATCH] Add flowmetrics sample for workload flow matrix

---
 .../samples/flowmetrics/workload-syn-in.yaml  | 34 +++++++++++++++++++
 .../samples/flowmetrics/workload-syn-out.yaml | 34 +++++++++++++++++++
 2 files changed, 68 insertions(+)
 create mode 100644 config/samples/flowmetrics/workload-syn-in.yaml
 create mode 100644 config/samples/flowmetrics/workload-syn-out.yaml

diff --git a/config/samples/flowmetrics/workload-syn-in.yaml b/config/samples/flowmetrics/workload-syn-in.yaml
new file mode 100644
index 000000000..42e70f1c4
--- /dev/null
+++ b/config/samples/flowmetrics/workload-syn-in.yaml
@@ -0,0 +1,34 @@
+# Workload flows matrix for TCP/SYN traffic, including destination port, with labels remapped for focusing on incoming traffic
+# More examples in https://github.com/netobserv/network-observability-operator/tree/main/config/samples/flowmetrics
+apiVersion: flows.netobserv.io/v1alpha1
+kind: FlowMetric
+metadata:
+  name: workload-syn-in
+  namespace: netobserv
+spec:
+  type: Counter
+  flatten: [Flags]
+  labels:
+  - SrcSubnetLabel
+  - SrcK8S_Namespace
+  - SrcK8S_OwnerName
+  - SrcK8S_OwnerType
+  - DstSubnetLabel
+  - DstK8S_Namespace
+  - DstK8S_OwnerName
+  - DstK8S_OwnerType
+  - DstPort
+  - Flags
+  filters:
+  - field: Flags
+    value: SYN
+  remap:
+    SrcK8S_Namespace: from_namespace
+    SrcK8S_OwnerName: from_workload
+    SrcK8S_OwnerType: from_kind
+    SrcSubnetLabel: from_subnet_label
+    DstK8S_Namespace: namespace
+    DstK8S_OwnerName: workload
+    DstK8S_OwnerType: kind
+    DstSubnetLabel: subnet_label
+    DstPort: port
diff --git a/config/samples/flowmetrics/workload-syn-out.yaml b/config/samples/flowmetrics/workload-syn-out.yaml
new file mode 100644
index 000000000..82e967c20
--- /dev/null
+++ b/config/samples/flowmetrics/workload-syn-out.yaml
@@ -0,0 +1,34 @@
+# Workload flows matrix for TCP/SYN traffic, including destination port, with labels remapped for focusing on outgoing traffic
+# More examples in https://github.com/netobserv/network-observability-operator/tree/main/config/samples/flowmetrics
+apiVersion: flows.netobserv.io/v1alpha1
+kind: FlowMetric
+metadata:
+  name: workload-syn-out
+  namespace: netobserv
+spec:
+  type: Counter
+  flatten: [Flags]
+  labels:
+  - SrcSubnetLabel
+  - SrcK8S_Namespace
+  - SrcK8S_OwnerName
+  - SrcK8S_OwnerType
+  - DstSubnetLabel
+  - DstK8S_Namespace
+  - DstK8S_OwnerName
+  - DstK8S_OwnerType
+  - DstPort
+  - Flags
+  filters:
+  - field: Flags
+    value: SYN
+  remap:
+    DstK8S_Namespace: to_namespace
+    DstK8S_OwnerName: to_workload
+    DstK8S_OwnerType: to_kind
+    DstSubnetLabel: to_subnet_label
+    SrcK8S_Namespace: namespace
+    SrcK8S_OwnerName: workload
+    SrcK8S_OwnerType: kind
+    SrcSubnetLabel: subnet_label
+    DstPort: port