Docs / Reference / Rules

ConfigurationRule

ConfigurationRule manages one configuration rule in a zone: settings, such as the SSL mode or the security level, changed for the requests its expression matches.

API version: kflare.dev/v1alpha1
Scope: Namespaced
Short name: cfconfig
Token permission: Zone · Config Rules · Edit

Example

Every field, with the sample's values. The live lines are the repository's sample, which applies as it is; the commented ones are the other fields, filled from other samples where one sets them. Some exclude each other, so check the rules before you uncomment several.

configurationrule.yaml

apiVersion: kflare.dev/v1alpha1
kind: ConfigurationRule
metadata:
  name: example-configurationrule
  namespace: default
spec:
  zoneRef:
    name: example-zone
  expression: starts_with(http.request.uri.path, "/admin/")
  description: Challenge more readily, and leave scripts alone, on the admin pages
  bic: true
  rocketLoader: false
  securityLevel: high
  ssl: strict
  # automaticHTTPSRewrites: true
  # contentConverter: true
  # disableRUM: true
  # disableZaraz: true
  # emailObfuscation: true
  # enabled: true
  # fonts: true
  # hotlinkProtection: true
  # opportunisticEncryption: true
  # polish: "off"  # one of: off, lossless, lossy, webp
  # priority: 1
  # redirectsForAITraining: true
  # requestBodyBuffering: none  # one of: none, standard, full
  # responseBodyBuffering: none  # one of: none, standard
  # serverSideExcludes: true
  # webmcpEnabled: true
  # webmcpPacks:
  #   - <webmcpPacks>

Spec

What you set, with the limits the API server enforces.

Field	Description
`automaticHTTPSRewrites` boolean	AutomaticHTTPSRewrites rewrites links to HTTP URLs in HTML responses to HTTPS.
`bic` boolean	BIC turns Browser Integrity Check on or off: it challenges requests whose headers spammers and bots commonly abuse.
`contentConverter` boolean	ContentConverter converts content, such as HTML to Markdown, for the clients that ask for it. Free plans may only turn it off.
`description` string	Description is shown with the rule in the Cloudflare dashboard. Limits: at most 4096 characters
`disableRUM` boolean	DisableRUM turns Real User Monitoring off. It takes only true. One of: `true`
`disableZaraz` boolean	DisableZaraz turns Zaraz off. It takes only true. One of: `true`
`emailObfuscation` boolean	EmailObfuscation hides the email addresses in HTML responses from bots.
`enabled` boolean	Enabled turns the rule on or off without deleting it. Default: `true`
`expression` stringrequired	Expression selects the requests the rule applies to, in Cloudflare's Rules language, for example `http.request.uri.path eq "/admin"`. Cloudflare validates it; the fields and operators it may use depend on the zone's plan. Limits: 1 to 4096 characters
`fonts` boolean	Fonts serves the page's Google Fonts from Cloudflare (Cloudflare Fonts).
`hotlinkProtection` boolean	HotlinkProtection stops other sites from embedding the zone's images.
`opportunisticEncryption` boolean	OpportunisticEncryption lets browsers fetch HTTP URLs over an encrypted connection.
`polish` string	Polish is how Cloudflare optimizes images: off, lossless, lossy or webp. Free plans may only turn it off; quote off in YAML, which would read it as a boolean. One of: `off`, `lossless`, `lossy`, `webp`
`priority` integer	Priority orders the rules kflare manages in a zone and phase: lower runs first, and rules with the same priority run in order of namespace and name. Rules created outside kflare keep their place. Limits: format `int32`
`redirectsForAITraining` boolean	RedirectsForAITraining redirects verified AI training crawlers to the canonical URLs the HTML response names. Free plans may only turn it off.
`requestBodyBuffering` string	RequestBodyBuffering is how much of a request's body Cloudflare buffers before the origin gets it: none, standard or full. One of: `none`, `standard`, `full`
`responseBodyBuffering` string	ResponseBodyBuffering is how much of a response's body Cloudflare buffers: none or standard. One of: `none`, `standard`
`rocketLoader` boolean	RocketLoader loads the page's JavaScript without blocking its rendering.
`securityLevel` string	SecurityLevel is how readily Cloudflare challenges visitors by their IP address's reputation, from essentially_off to under_attack. Free plans may not turn it off. One of: `off`, `essentially_off`, `low`, `medium`, `high`, `under_attack`
`serverSideExcludes` boolean	ServerSideExcludes hides the content an HTML response marks with SSE tags from suspicious visitors.
`ssl` string	SSL is how Cloudflare connects to the origin: off, flexible (HTTP), full (HTTPS, any certificate), strict (HTTPS, a valid certificate) or origin_pull. Free plans may not use origin_pull; quote off in YAML. One of: `off`, `flexible`, `full`, `strict`, `origin_pull`
`webmcpEnabled` boolean	WebmcpEnabled serves the WebMCP bridge script, which exposes the page's tools to browser AI agents.
`webmcpPacks` []string	WebmcpPacks are the WebMCP tool packs to turn on for the requests the rule matches, at most 100. They do not serve the bridge script itself. Unset, the packs stay as they are: kflare does not send an empty list, which would turn them all off. Limits: at most 100 items; 1 to 128 characters; matches `^[A-Za-z0-9._:/@-]+$`
`zoneRef` objectrequiredimmutable	ZoneRef references the Zone, in the same namespace, the rule belongs to. Immutable after creation.
`zoneRef.name` string	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names Default: `""`

Rules

Checked across fields when the resource is applied.

must set at least one of automaticHTTPSRewrites, bic, contentConverter, disableRUM, disableZaraz, emailObfuscation, fonts, hotlinkProtection, opportunisticEncryption, polish, redirectsForAITraining, requestBodyBuffering, responseBodyBuffering, rocketLoader, securityLevel, serverSideExcludes, ssl, webmcpEnabled and webmcpPacks

Status

What kflare reports. conditions holds the Ready condition, whose reason says why a resource isn't ready.

Field	Description
`cloudflareMetadata` object	CloudflareMetadata identifies the rule in Cloudflare.
`cloudflareMetadata.ref` string	Ref is the rule's ref, which kflare derives from the resource's kind, namespace and name. kflare finds the rule it manages by its ref.
`cloudflareMetadata.ruleID` string	RuleID is the rule's Cloudflare ID.
`cloudflareMetadata.rulesetID` string	RulesetID is the zone's entry point ruleset for the rule's phase.
`cloudflareMetadata.version` string	Version is the rule's version, which Cloudflare increments whenever the rule changes.
`cloudflareMetadata.zoneID` string	ZoneID is the Cloudflare zone the rule is in.
`conditions` []object	Conditions represent the latest available observations of the rule's state.

kubectl get

The columns kubectl get configurationrules prints.

Column	Source
PRIORITY	.spec.priority
RULE ID	.status.cloudflareMetadata.ruleID
READY	.status.conditions[?(@.type=="Ready")].status
AGE	.metadata.creationTimestamp

Samples

From the repository's config/samples, comments included.

cloudflare_v1alpha1_configurationrule.yaml

# Generated by kflare-gen from generator/generator.yaml. DO NOT EDIT.
#
# ConfigurationRule is the Schema for the configurationrules API.
# It manages one configuration rule in a zone: settings, such as the SSL
# mode or the security level, changed for the requests its expression
# matches.
apiVersion: kflare.dev/v1alpha1
kind: ConfigurationRule
metadata:
  name: example-configurationrule
  namespace: default
spec:
  zoneRef:
    name: example-zone
  expression: starts_with(http.request.uri.path, "/admin/")
  description: Challenge more readily, and leave scripts alone, on the admin pages
  bic: true
  rocketLoader: false
  securityLevel: high
  ssl: strict

On GitHub