Documentation
kflare documentation
For kflare v0.4.1, released November 1, 2026. The reference is built from that release's CRDs and samples, and the guides from its repository, so every field and rule here is one the API server knows.
- QuickstartPut a Service on the internet through a Cloudflare Tunnel, in four steps.
- Deploying kflareInstall with Helm, Argo CD or Flux, the token, configuration, monitoring, upgrades.
- ArchitectureHow kflare finds, owns, corrects and deletes Cloudflare objects, and its limits.
Resource reference
Each page has an example with every field, the field reference, the rules the API server checks, what the resource reports in its status, and the repository's samples.
Accounts
DNS
Tunnels
Workers and storage
WorkerScriptA Worker, from inline code or a ConfigMap, with its bindingsToken: Account · Workers Scripts · EditWorkerRouteA route from a URL pattern to a WorkerToken: Zone · Workers Routes · EditKVNamespaceA Workers KV namespaceToken: Account · Workers KV Storage · EditR2BucketAn R2 bucket; kflare never deletes its objectsToken: Account · Workers R2 Storage · EditD1DatabaseA D1 databaseToken: Account · D1 · Edit
Security
WAFCustomRuleOne WAF custom rule in a zoneToken: Zone · Zone WAF · EditRateLimitRuleOne rate limiting rule in a zoneToken: Zone · Zone WAF · EditManagedRulesetA managed ruleset deployed to a zone, with overridesToken: Zone · Zone WAF · EditIPListAn IP list that rule expressions use as$nameToken: Account · Account Rule Lists · Edit
Rules
TransformRuleOne URL rewrite or header transform ruleToken: Zone · Transform Rules · EditRedirectRuleOne single redirectToken: Zone · Single Redirect · EditCacheRuleOne cache ruleToken: Zone · Cache Rules · EditConfigurationRuleOne configuration rule: SSL mode, security level and moreToken: Zone · Config Rules · EditOriginRuleOne origin rule: the origin's destination portToken: Zone · Origin Rules · Edit
Zone settings
Annotations
Every kind reads these. kflare sets kflare.dev/adopted itself, to "true", on a resource that adopted its Cloudflare object.
| Annotation | What it does |
|---|---|
kflare.dev/adoption-policyadopt | adopt-or-create | Lets a resource take over a Cloudflare object kflare did not create: adopt uses an existing one and never creates, adopt-or-create creates one when there is none. Without it, a resource only creates, and reports an existing object as AlreadyExists. |
kflare.dev/deletion-policyretain | delete | What deleting the resource does to its Cloudflare object: retain keeps it, delete deletes it, even one kflare adopted. Without it, an adopted object is kept, and one kflare created follows the chart's defaultDeletionPolicy, which is delete. |
kflare.dev/paused"true" | kflare leaves the resource alone until the annotation is removed: it makes no Cloudflare call for it, and does not finish deleting it. |