update guide with traffic policy

docs/k8s/crds.md

@@ -27,6 +27,15 @@ _**Warning:**_ There are other CRDs not documented here that are used internally
 | `metadata`   | ObjectMeta            | Standard Kubernetes metadata                                   |
 | `modules`    | NgrokModuleSetModules | The set of modules for this custom resource definition         |
 
+### NgrokTrafficPolicy
+
+| Field        | Type            | Description                                            |
+| ------------ | --------------- | ------------------------------------------------------ |
+| `apiVersion` | string          | API version of the `NgrokTrafficPolicy`                |
+| `kind`       | string          | Kind of the custom resource definition                 |
+| `metadata`   | ObjectMeta      | Standard Kubernetes metadata                           |
+| `policy`     | json.RawMessage | See [policy configuration](/docs/http/traffic-policy/) |
+
 ### EndpointCompression
 
 | Field     | Type    | Description                                             |

docs/k8s/user-guide.mdx

@@ -465,6 +465,88 @@ spec:
                   number: <service-port>
 ```
 
+## Traffic Policy
+
+Traffic policies for inbound and outbound traffic can simplifify edge management.
+
+### Design
+
+`NgrokTrafficPolicy` objects can be defined with rules composed of expressions and actions that validate and filter traffic via the policy engine.
+
+```yaml
+kind: NgrokTrafficPolicy
+apiVersion: ngrok.k8s.ngrok.com/v1alpha1
+metadata:
+  name: traffic-policy-example
+spec:
+  policy:
+    inbound:
+      - name: "greetings"
+        expressions:
+          - "req.Method == 'GET'"
+          - "req.Path.startsWith('/greetings')"
+        actions:
+          - type: "custom_response"
+            config:
+              status_code: 200
+              content: Hello
+              headers:
+                content-type: text/plain
+```
+
+Learn more about the policy expressions and actions here:
+
+- [Policy Expressions](https://ngrok.com/docs/http/traffic-policy/expressions/)
+- [Policy Actions](https://ngrok.com/docs/http/traffic-policy/actions/)
+
+### Composition
+
+Traffic policies can be added to Ingress objects using annotations.
+
+```yaml
+---
+kind: NgrokTrafficPolicy
+apiVersion: ngrok.k8s.ngrok.com/v1alpha1
+metadata:
+  name: traffic-policy-test
+spec:
+  policy:
+    inbound:
+      - name: "deny_patch"
+        expressions:
+          - "req.Method == 'PATCH'"
+        actions:
+          - type: "deny"
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: example
+  annotations:
+    k8s.ngrok.com/traffic-policy: traffic-policy-test
+spec:
+  ingressClassName: ngrok
+  rules:
+    - host: <my-host>.ngrok.app
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: <service-name>
+                port:
+                  number: <service-port>
+```
+
+:::note
+Using both an `NgrokModuleSet` and an `NgrokTrafficPolicy` will result in an error.
+:::
+
+:::note
+Ingress is currently limited to a max of one traffic policy in your traffic policy annotation list.
+:::
+
 ## TCP and TLS Edges {#tcp-tls-edges}
 
 ngrok offers [TCP](https://ngrok.com/docs/tcp/) and