Docs / Reference / Security

ManagedRuleset

ManagedRuleset deploys a Cloudflare managed ruleset to a zone, as an execute rule in its http_request_firewall_managed phase; the expression selects the requests the ruleset inspects, and "true" selects every request. Cloudflare deploys its Free Managed Ruleset to Free zones by default, but only while the zone has no rules of its own in the phase: as soon as any rule is there, only what the rules deploy runs. To turn a managed ruleset off, keep its ManagedRuleset and set enabled to false.

API version: kflare.dev/v1alpha1
Scope: Namespaced
Short name: cfmanaged
Token permission: Zone · Zone WAF · Edit

Example

Every field, with the sample's values. The live lines are the repository's sample, which applies as it is; the commented ones are the other fields, filled from other samples where one sets them. Some exclude each other, so check the rules before you uncomment several.

managedruleset.yaml

apiVersion: kflare.dev/v1alpha1
kind: ManagedRuleset
metadata:
  name: example-managedruleset
  namespace: default
spec:
  zoneRef:
    name: example-zone
  expression: "true"
  description: Free Managed Ruleset, the WordPress rules only logging
  id: 77454fe2d30c4220b5701f6fdfb893ba
  overrides:
    categories:
      - category: wordpress
        action: log
      # - category: wordpress
      #   action: log  # one of: block, challenge, js_challenge, managed_challenge, log
      #   enabled: true
    rules:
      - id: 7dfd111a6bad4b86bf3522cce6c5792f
        enabled: false
      # - id: 7dfd111a6bad4b86bf3522cce6c5792f
      #   enabled: false
      #   action: block  # one of: block, challenge, js_challenge, managed_challenge, log
    # action: block  # one of: block, challenge, js_challenge, managed_challenge, log
    # enabled: true
  # enabled: true
  # priority: 1

Spec

What you set, with the limits the API server enforces.

Field	Description
`description` string	Description is shown with the rule in the Cloudflare dashboard. Limits: at most 4096 characters
`enabled` boolean	Enabled turns the rule on or off without deleting it. Default: `true`
`expression` stringrequired	Expression selects the requests the rule applies to, in Cloudflare's Rules language, for example `http.request.uri.path eq "/admin"`. Cloudflare validates it; the fields and operators it may use depend on the zone's plan. Limits: 1 to 4096 characters
`id` stringrequired	ID is the managed ruleset to deploy. Free plans can deploy the Cloudflare Free Managed Ruleset, 77454fe2d30c4220b5701f6fdfb893ba; higher plans also the Cloudflare Managed Ruleset, efb7b8c949ac4650a09736fc376e9aee, and the OWASP Core Ruleset, 4814384a9e5d4991b9815dcfc25d2f1f. Cloudflare always runs the ruleset's latest version. A zone can deploy a ruleset only once. Limits: matches `^[0-9a-f]{32}$`
`overrides` object	Overrides change what the ruleset's rules do. An override for a rule takes precedence over one for a category the rule is tagged with, which takes precedence over the overrides for the whole ruleset. Rule: must set at least one of action, categories, enabled and rules
`overrides.action` string	Action replaces the action of every rule of the ruleset. One of: `block`, `challenge`, `js_challenge`, `managed_challenge`, `log`
`overrides.categories` []object	Categories override the rules tagged with a category, such as wordpress or log4j, each listed once. Cloudflare refuses a category none of the ruleset's rules has (20235). Limits: at least 1 item Rule: must set at least 2 of category, action and enabled
`overrides.categories[].action` string	Action replaces the action of the category's rules. One of: `block`, `challenge`, `js_challenge`, `managed_challenge`, `log`
`overrides.categories[].category` stringrequired	The name of the category to override. Limits: at least 1 character
`overrides.categories[].enabled` boolean	Whether to enable execution of rules in the category.
`overrides.enabled` boolean	Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
`overrides.rules` []object	Rules override single rules of the ruleset, by ID, each listed once. Limits: at least 1 item Rule: must set at least 2 of id, action and enabled
`overrides.rules[].action` string	Action replaces the rule's action. One of: `block`, `challenge`, `js_challenge`, `managed_challenge`, `log`
`overrides.rules[].enabled` boolean	Whether to enable execution of the rule.
`overrides.rules[].id` stringrequired	The ID of the rule to override. Limits: matches `^[0-9a-f]{32}$`
`priority` integer	Priority orders the rules kflare manages in a zone and phase: lower runs first, and rules with the same priority run in order of namespace and name. Rules created outside kflare keep their place. Limits: format `int32`
`zoneRef` objectrequiredimmutable	ZoneRef references the Zone, in the same namespace, the rule belongs to. Immutable after creation.
`zoneRef.name` string	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names Default: `""`

Status

What kflare reports. conditions holds the Ready condition, whose reason says why a resource isn't ready.

Field	Description
`cloudflareMetadata` object	CloudflareMetadata identifies the rule in Cloudflare.
`cloudflareMetadata.ref` string	Ref is the rule's ref, which kflare derives from the resource's kind, namespace and name. kflare finds the rule it manages by its ref.
`cloudflareMetadata.ruleID` string	RuleID is the rule's Cloudflare ID.
`cloudflareMetadata.rulesetID` string	RulesetID is the zone's entry point ruleset for the rule's phase.
`cloudflareMetadata.version` string	Version is the rule's version, which Cloudflare increments whenever the rule changes.
`cloudflareMetadata.zoneID` string	ZoneID is the Cloudflare zone the rule is in.
`conditions` []object	Conditions represent the latest available observations of the rule's state.

kubectl get

The columns kubectl get managedrulesets prints.

Column	Source
RULESET	.spec.id
PRIORITY	.spec.priority
RULE ID	.status.cloudflareMetadata.ruleID
READY	.status.conditions[?(@.type=="Ready")].status
AGE	.metadata.creationTimestamp

Samples

From the repository's config/samples, comments included.

cloudflare_v1alpha1_managedruleset.yaml

# Generated by kflare-gen from generator/generator.yaml. DO NOT EDIT.
#
# ManagedRuleset is the Schema for the managedrulesets API.
# It deploys a Cloudflare managed ruleset to a zone, as an execute rule in
# its http_request_firewall_managed phase; the expression selects the
# requests the ruleset inspects, and "true" selects every request.
# Cloudflare deploys its Free Managed Ruleset to Free zones by default, but
# only while the zone has no rules of its own in the phase: as soon as any
# rule is there, only what the rules deploy runs. To turn a managed ruleset
# off, keep its ManagedRuleset and set enabled to false.
apiVersion: kflare.dev/v1alpha1
kind: ManagedRuleset
metadata:
  name: example-managedruleset
  namespace: default
spec:
  zoneRef:
    name: example-zone
  expression: "true"
  description: Free Managed Ruleset, the WordPress rules only logging
  id: 77454fe2d30c4220b5701f6fdfb893ba
  overrides:
    categories:
    - category: wordpress
      action: log
    rules:
    - id: 7dfd111a6bad4b86bf3522cce6c5792f
      enabled: false

On GitHub