Docs / Reference / Security

IPList

IPList manages a custom IP list in a Cloudflare account. Rule expressions in the account's zones refer to it as $<name>, for example ip.src in $office_ips.

API version: kflare.dev/v1alpha1
Scope: Namespaced
Short name: cfiplist
Token permission: Account · Account Rule Lists · Edit

Example

Every field, with the sample's values. The live lines are the repository's sample, which applies as it is; the commented ones are the other fields, filled from other samples where one sets them. Some exclude each other, so check the rules before you uncomment several.

iplist.yaml

apiVersion: kflare.dev/v1alpha1
kind: IPList
metadata:
  name: example-iplist
  namespace: default
  annotations:
    kflare.dev/deletion-policy: retain
spec:
  accountRef:
    name: my-account
  name: example_ips
  description: Addresses of example.com's offices.
  items:
    - comment: Head office
      ip: 192.0.2.1
    - comment: Branch office
      ip: 198.51.100.0/24
    - ip: 2001:db8::/48

Spec

What you set, with the limits the API server enforces.

Field	Description
`accountRef` objectrequiredimmutable	AccountRef references the CloudflareAccount that owns the IP list. Immutable after creation.
`accountRef.name` string	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names Default: `""`
`description` string	Description is shown with the list in the Cloudflare dashboard. Limits: at most 500 characters
`items` []object	Items are the addresses and ranges in the list. kflare replaces the list's items whenever they differ from these.
`items[].comment` string	Comment describes the item in the Cloudflare dashboard. Limits: at most 500 characters
`items[].ip` stringrequired	IP is an IPv4 or IPv6 address, or a CIDR range without host bits set: /8 to /32 for IPv4, /12 to /128 for IPv6. Cloudflare refuses IPv4-mapped IPv6 addresses. Limits: at most 49 characters; matches `^[0-9a-fA-F:.]+(/[0-9]{1,3})?$`
`name` stringrequiredimmutable	Name is the list's name, unique in the account among lists of every kind: lowercase letters, digits and underscores, at most 50 characters. Immutable, because Cloudflare cannot rename a list. Limits: matches `^[a-z0-9_]{1,50}$`

Status

What kflare reports. conditions holds the Ready condition, whose reason says why a resource isn't ready.

Field	Description
`cloudflareMetadata` object	CloudflareMetadata holds identifiers returned by the Cloudflare API.
`cloudflareMetadata.listID` string	ListID is the Cloudflare list identifier.
`cloudflareMetadata.numItems` integer	NumItems is how many items the list held when it was last synced. Limits: format `int32`
`cloudflareMetadata.operationID` string	OperationID is Cloudflare's bulk operation replacing the list's items, while kflare waits for it to finish.
`conditions` []object	Conditions represent the latest available observations of the IP list state.

kubectl get

The columns kubectl get iplists prints.

Column	Source
NAME	.spec.name
LIST ID	.status.cloudflareMetadata.listID
ITEMS	.status.cloudflareMetadata.numItems
READY	.status.conditions[?(@.type=="Ready")].status
AGE	.metadata.creationTimestamp

Samples

From the repository's config/samples, comments included.

cloudflare_v1alpha1_iplist.yaml

# Generated by kflare-gen from generator/generator.yaml. DO NOT EDIT.
#
# IPList is the Schema for the iplists API.
# It manages a custom IP list in a Cloudflare account. Rule expressions in
# the account's zones refer to it as $<name>, for example
# `ip.src in $office_ips`.
apiVersion: kflare.dev/v1alpha1
kind: IPList
metadata:
  name: example-iplist
  namespace: default
  annotations:
    # The retain policy keeps the IP list in Cloudflare when this resource is
    # deleted. Without it, deleting the resource deletes the IP list.
    kflare.dev/deletion-policy: retain
spec:
  accountRef:
    name: my-account
  # Name is the list's name, unique in the account among lists of every
  # kind: lowercase letters, digits and underscores, at most 50
  # characters. Immutable, because Cloudflare cannot rename a list.
  name: example_ips
  # Description is shown with the list in the Cloudflare dashboard.
  description: Addresses of example.com's offices.
  items:
  - comment: Head office
    ip: 192.0.2.1
  - comment: Branch office
    ip: 198.51.100.0/24
  - ip: 2001:db8::/48

On GitHub