Docs / Reference / DNS

DNSRecord

DNSRecord represents a DNS record within a Cloudflare-managed zone.

API version: kflare.dev/v1alpha1
Scope: Namespaced
Short name: cfrecord
Token permission: Zone · DNS · Edit

Example

Every field, with the sample's values. The live lines are the repository's sample, which applies as it is; the commented ones are the other fields, filled from other samples where one sets them. Some exclude each other, so check the rules before you uncomment several.

dnsrecord.yaml

apiVersion: kflare.dev/v1alpha1
kind: DNSRecord
metadata:
  name: example-dnsrecord
  namespace: default
  annotations:
    kflare.dev/deletion-policy: retain
spec:
  zoneRef:
    name: example-zone
  name: www.example.com
  type: A
  comment: The web server.
  content: 192.0.2.1
  # data:
  #   name: _http._tcp
  #   proto: _tcp
  #   service: _http
  #   target: app.example.com
  #   port: 8080
  #   weight: 1
  #   priority: 10
  # priority: 10
  # proxied: true
  # tags:
  #   - <tags>
  # ttl: 1
  # tunnelRef:
  #   name: example-tunnel

Spec

What you set, with the limits the API server enforces.

Field	Description
`comment` string	Comment is an optional free-text annotation for the record.
`content` string	Content is the DNS record content (e.g. an IP address for A records, a hostname for CNAME/MX). Set exactly one of content, data and tunnelRef: record types such as SRV, LOC and CAA use data instead. Limits: at least 1 character
`data` object (any fields)	Data holds structured record data for types that require it (SRV, LOC, CAA). The JSON structure must match the Cloudflare API schema for the given record type. Set exactly one of content, data and tunnelRef. Cloudflare derives the record content from it, so content drift is not corrected while data is set.
`name` stringrequiredimmutable	Name is the fully-qualified DNS record name (e.g. "www.example.com"). Immutable after creation. Limits: at least 1 character
`priority` integer	Priority is the record priority, used for MX, SRV and URI records. When unset, kflare leaves the priority Cloudflare chose unchanged.
`proxied` boolean	Proxied controls whether Cloudflare proxies traffic through its network for this record. Only applicable to A, AAAA, and CNAME records. Defaults to false (DNS only), or to true with a tunnelRef, which cannot be unproxied.
`tags` []string	Tags are optional labels attached to the record in Cloudflare.
`ttl` integer	TTL is the time-to-live in seconds: 1 for automatic (the default), or 30-86400. Cloudflare only accepts values below 60 on Enterprise zones, and a proxied record always has an automatic TTL. Limits: at least 1 and at most 86400 Rule: ttl must be 1 (automatic) or between 30 and 86400
`tunnelRef` object	TunnelRef points the record at a Tunnel in the same namespace: kflare sets its content to the tunnel's hostname, <tunnel ID>.cfargotunnel.com, and corrects it when the tunnel is recreated with a new ID. Only for CNAME records, which are then proxied: a tunnel carries traffic only through Cloudflare's proxy, and only for records in the tunnel's account, so the Tunnel must use the Zone's CloudflareAccount. The Tunnel waits for the records that point at it before it is deleted.
`tunnelRef.name` string	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names Default: `""`
`type` stringrequiredimmutable	Type is the DNS record type. Immutable after creation. One of: `A`, `AAAA`, `CNAME`, `MX`, `NS`, `OPENPGPKEY`, `PTR`, `TXT`, `CAA`, `CERT`, `DNSKEY`, `DS`, `HTTPS`, `LOC`, `NAPTR`, `SMIMEA`, `SRV`, `SSHFP`, `SVCB`, `TLSA`, `URI`
`zoneRef` objectrequiredimmutable	ZoneRef references the Zone, in the same namespace, the DNS record belongs to. Immutable after creation.
`zoneRef.name` string	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names Default: `""`

Rules

Checked across fields when the resource is applied.

set exactly one of content, data and tunnelRef
tunnelRef needs type CNAME
a record with a tunnelRef must be proxied: an unproxied one resolves to an address the internet cannot reach
a proxied record takes ttl 1 (automatic): Cloudflare ignores any other

Status

What kflare reports. conditions holds the Ready condition, whose reason says why a resource isn't ready.

Field	Description
`cloudflareMetadata` object	CloudflareMetadata holds identifiers and metadata returned by the Cloudflare API.
`cloudflareMetadata.proxiable` boolean	Proxiable indicates whether this record type supports Cloudflare proxying.
`cloudflareMetadata.recordID` string	RecordID is the Cloudflare DNS record identifier.
`cloudflareMetadata.zoneID` string	ZoneID is the Cloudflare zone the DNS record belongs to (denormalized from the Zone status).
`conditions` []object	Conditions represent the latest available observations of the DNS record state.

kubectl get

The columns kubectl get dnsrecords prints.

Column	Source
RECORD NAME	.spec.name
TYPE	.spec.type
CONTENT	.spec.content
RECORD ID	.status.cloudflareMetadata.recordID
READY	.status.conditions[?(@.type=="Ready")].status
AGE	.metadata.creationTimestamp

Samples

From the repository's config/samples, comments included.

cloudflare_v1alpha1_dnsrecord.yaml

# Generated by kflare-gen from generator/generator.yaml. DO NOT EDIT.
#
# DNSRecord is the Schema for the dnsrecords API.
# It represents a DNS record within a Cloudflare-managed zone.
apiVersion: kflare.dev/v1alpha1
kind: DNSRecord
metadata:
  name: example-dnsrecord
  namespace: default
  annotations:
    # The retain policy keeps the DNS record in Cloudflare when this resource is
    # deleted. Without it, deleting the resource deletes the DNS record.
    kflare.dev/deletion-policy: retain
spec:
  zoneRef:
    name: example-zone
  # Name is the fully-qualified DNS record name (e.g. "www.example.com").
  # Immutable after creation.
  name: www.example.com
  # Type is the DNS record type. Immutable after creation.
  type: A
  # Comment is an optional free-text annotation for the record.
  comment: The web server.
  # Content is the DNS record content (e.g. an IP address for A records,
  # a hostname for CNAME/MX). Set exactly one of content, data and
  # tunnelRef: record types such as SRV, LOC and CAA use data instead.
  content: 192.0.2.1

On GitHub

cloudflare_v1alpha1_dnsrecord_a.yaml

apiVersion: kflare.dev/v1alpha1
kind: DNSRecord
metadata:
  name: www-a-record
  namespace: default
  annotations:
    kflare.dev/deletion-policy: retain
spec:
  zoneRef:
    name: example-zone  # must reference an existing Zone CR in the same namespace
  name: www.example.com
  type: A
  content: "1.2.3.4"
  ttl: 1        # 1 = automatic TTL
  proxied: true

On GitHub

cloudflare_v1alpha1_dnsrecord_mx.yaml

apiVersion: kflare.dev/v1alpha1
kind: DNSRecord
metadata:
  name: mx-record
  namespace: default
  annotations:
    kflare.dev/deletion-policy: retain
spec:
  zoneRef:
    name: example-zone  # must reference an existing Zone CR in the same namespace
  name: example.com
  type: MX
  content: mail.example.com
  priority: 10
  ttl: 300

On GitHub

cloudflare_v1alpha1_dnsrecord_srv.yaml

apiVersion: kflare.dev/v1alpha1
kind: DNSRecord
metadata:
  name: srv-record
  namespace: default
  annotations:
    kflare.dev/deletion-policy: retain
spec:
  zoneRef:
    name: example-zone  # must reference an existing Zone CR in the same namespace
  name: _http._tcp.example.com
  type: SRV
  ttl: 300
  # SRV records use the data field instead of content.
  # The structure matches the Cloudflare API schema for SRV records.
  data:
    name: _http._tcp
    proto: _tcp
    service: _http
    target: app.example.com
    port: 8080
    weight: 1
    priority: 10

On GitHub

cloudflare_v1alpha1_dnsrecord_tunnel.yaml

apiVersion: kflare.dev/v1alpha1
kind: DNSRecord
metadata:
  name: app-tunnel-record
  namespace: default
spec:
  zoneRef:
    name: example-zone  # must reference an existing Zone CR in the same namespace
  name: app.example.com
  type: CNAME
  # Points the hostname at the Tunnel (same namespace): kflare writes a proxied
  # CNAME to <tunnel ID>.cfargotunnel.com, and follows the tunnel if it is
  # recreated with a new ID. The Tunnel must use the Zone's CloudflareAccount.
  # The TunnelConfiguration's ingress rule for app.example.com decides where
  # the traffic goes.
  tunnelRef:
    name: example-tunnel

On GitHub