Docs / Reference / Tunnels

Tunnel

Tunnel represents a remotely-managed Cloudflare Tunnel and the Secret holding the token a cloudflared connector needs to run it.

API version: kflare.dev/v1alpha1
Scope: Namespaced
Short name: cftunnel
Token permission: Account · Cloudflare Tunnel · Edit

Example

Every field, with the sample's values. The live lines are the repository's sample, which applies as it is; the commented ones are the other fields, filled from other samples where one sets them. Some exclude each other, so check the rules before you uncomment several.

tunnel.yaml

apiVersion: kflare.dev/v1alpha1
kind: Tunnel
metadata:
  name: example-tunnel
  namespace: default
  annotations:
    kflare.dev/deletion-policy: retain
spec:
  accountRef:
    name: my-account
  name: example-tunnel
  credentialsSecretRef:
    name: example-tunnel-token

Spec

What you set, with the limits the API server enforces.

Field	Description
`accountRef` objectrequiredimmutable	AccountRef references the CloudflareAccount that owns the tunnel. Immutable after creation.
`accountRef.name` string	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names Default: `""`
`credentialsSecretRef` objectrequired	CredentialsSecretRef names the Secret, in the Tunnel's namespace, that receives the tunnel token under the TUNNEL_TOKEN key. kflare creates the Secret and owns it, so it is deleted together with the Tunnel. An existing Secret that kflare does not own is never overwritten.
`credentialsSecretRef.name` stringrequired	Name of the Secret, in the same namespace as the Tunnel. Limits: 1 to 253 characters; matches `^[a-z0-9]([-a-z0-9][a-z0-9])?(\.[a-z0-9]([-a-z0-9][a-z0-9])?)*$`
`name` stringrequired	Name is the tunnel's name in Cloudflare. Changing it renames the tunnel in place. Limits: at least 1 character

Status

What kflare reports. conditions holds the Ready condition, whose reason says why a resource isn't ready.

Field	Description
`cloudflareMetadata` object	CloudflareMetadata holds identifiers and metadata returned by the Cloudflare API.
`cloudflareMetadata.status` string	Status is the tunnel health reported by Cloudflare at the last reconcile (inactive, degraded, healthy, or down).
`cloudflareMetadata.tunnelID` string	TunnelID is the Cloudflare tunnel identifier (a UUID).
`conditions` []object	Conditions represent the latest available observations of the tunnel state.
`credentialsSecretName` string	CredentialsSecretName is the Secret the token was last written to. When spec.credentialsSecretRef changes, kflare deletes this Secret after writing the new one.

kubectl get

The columns kubectl get tunnels prints.

Column	Source
TUNNEL	.spec.name
TUNNEL ID	.status.cloudflareMetadata.tunnelID
CF STATUS	.status.cloudflareMetadata.status
READY	.status.conditions[?(@.type=="Ready")].status
AGE	.metadata.creationTimestamp

Samples

From the repository's config/samples, comments included.

cloudflare_v1alpha1_tunnel.yaml

# Generated by kflare-gen from generator/generator.yaml. DO NOT EDIT.
#
# Tunnel is the Schema for the tunnels API.
# It represents a remotely-managed Cloudflare Tunnel and the Secret holding
# the token a cloudflared connector needs to run it.
apiVersion: kflare.dev/v1alpha1
kind: Tunnel
metadata:
  name: example-tunnel
  namespace: default
  annotations:
    # The retain policy keeps the tunnel in Cloudflare when this resource is
    # deleted. Without it, deleting the resource deletes the tunnel.
    kflare.dev/deletion-policy: retain
spec:
  accountRef:
    name: my-account
  # Name is the tunnel's name in Cloudflare. Changing it renames the
  # tunnel in place.
  name: example-tunnel
  credentialsSecretRef:
    name: example-tunnel-token

On GitHub