Docs / Reference / Rules

OriginRule

OriginRule manages one origin rule in a zone: the requests its expression matches reach the origin on another destination port.

API version: kflare.dev/v1alpha1
Scope: Namespaced
Short name: cforigin
Token permission: Zone · Origin Rules · Edit

Example

Every field, with the sample's values. The live lines are the repository's sample, which applies as it is; the commented ones are the other fields, filled from other samples where one sets them. Some exclude each other, so check the rules before you uncomment several.

originrule.yaml

apiVersion: kflare.dev/v1alpha1
kind: OriginRule
metadata:
  name: example-originrule
  namespace: default
spec:
  zoneRef:
    name: example-zone
  expression: starts_with(http.request.uri.path, "/api/")
  description: Send API requests to the origin's port 8443
  origin:
    port: 8443
  # enabled: true
  # priority: 1

Spec

What you set, with the limits the API server enforces.

Field	Description
`description` string	Description is shown with the rule in the Cloudflare dashboard. Limits: at most 4096 characters
`enabled` boolean	Enabled turns the rule on or off without deleting it. Default: `true`
`expression` stringrequired	Expression selects the requests the rule applies to, in Cloudflare's Rules language, for example `http.request.uri.path eq "/admin"`. Cloudflare validates it; the fields and operators it may use depend on the zone's plan. Limits: 1 to 4096 characters
`origin` objectrequired	Origin is where Cloudflare sends the requests the rule matches. Free plans may only change the destination port.
`origin.port` integerrequired	Port is the destination port Cloudflare connects to the origin on, from 1 to 65535, in place of the request's own. Limits: at least 1 and at most 65535; format `int64`
`priority` integer	Priority orders the rules kflare manages in a zone and phase: lower runs first, and rules with the same priority run in order of namespace and name. Rules created outside kflare keep their place. Limits: format `int32`
`zoneRef` objectrequiredimmutable	ZoneRef references the Zone, in the same namespace, the rule belongs to. Immutable after creation.
`zoneRef.name` string	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names Default: `""`

Status

What kflare reports. conditions holds the Ready condition, whose reason says why a resource isn't ready.

Field	Description
`cloudflareMetadata` object	CloudflareMetadata identifies the rule in Cloudflare.
`cloudflareMetadata.ref` string	Ref is the rule's ref, which kflare derives from the resource's kind, namespace and name. kflare finds the rule it manages by its ref.
`cloudflareMetadata.ruleID` string	RuleID is the rule's Cloudflare ID.
`cloudflareMetadata.rulesetID` string	RulesetID is the zone's entry point ruleset for the rule's phase.
`cloudflareMetadata.version` string	Version is the rule's version, which Cloudflare increments whenever the rule changes.
`cloudflareMetadata.zoneID` string	ZoneID is the Cloudflare zone the rule is in.
`conditions` []object	Conditions represent the latest available observations of the rule's state.

kubectl get

The columns kubectl get originrules prints.

Column	Source
PRIORITY	.spec.priority
RULE ID	.status.cloudflareMetadata.ruleID
READY	.status.conditions[?(@.type=="Ready")].status
AGE	.metadata.creationTimestamp

Samples

From the repository's config/samples, comments included.

cloudflare_v1alpha1_originrule.yaml

# Generated by kflare-gen from generator/generator.yaml. DO NOT EDIT.
#
# OriginRule is the Schema for the originrules API.
# It manages one origin rule in a zone: the requests its expression
# matches reach the origin on another destination port.
apiVersion: kflare.dev/v1alpha1
kind: OriginRule
metadata:
  name: example-originrule
  namespace: default
spec:
  zoneRef:
    name: example-zone
  expression: starts_with(http.request.uri.path, "/api/")
  description: Send API requests to the origin's port 8443
  origin:
    port: 8443

On GitHub