Docs / Reference / Tunnels

TunnelConfiguration

TunnelConfiguration owns the complete ingress configuration of one remotely-managed Tunnel.

API version: kflare.dev/v1alpha1
Scope: Namespaced
Short name: cftunnelconfig
Token permission: Account · Cloudflare Tunnel · Edit

Example

Every field, with the sample's values. The live lines are the repository's sample, which applies as it is; the commented ones are the other fields, filled from other samples where one sets them. Some exclude each other, so check the rules before you uncomment several.

tunnelconfiguration.yaml

apiVersion: kflare.dev/v1alpha1
kind: TunnelConfiguration
metadata:
  name: example-tunnel-config
  namespace: default
spec:
  tunnelRef:
    name: example-tunnel
  ingress:
    - hostname: app.example.com
      service: http://my-app.default.svc.cluster.local:80
    - hostname: api.example.com
      path: ^/v1/
      service: https://my-api.default.svc.cluster.local:443
      originRequest:
        originServerName: api.example.com
    # - hostname: app.example.com
    #   service: http://my-app.default.svc.cluster.local:80
    #   path: ^/v1/
    #   originRequest:
    #     originServerName: api.example.com
    #     disableChunkedEncoding: true
    #     http2Origin: true
    #     httpHostHeader: <httpHostHeader>
    #     noTLSVerify: true
  defaultService: http_status:404

Spec

What you set, with the limits the API server enforces.

Field	Description
`defaultService` string	DefaultService handles requests that match no ingress rule. kflare appends it as the final catch-all rule that Cloudflare requires. Default: `http_status:404` Limits: at least 1 character
`ingress` []objectrequired	Ingress maps public hostnames to the services cloudflared forwards them to. Rules are matched in order; the first match wins. Limits: at least 1 item
`ingress[].hostname` stringrequired	Hostname to match, such as "app.example.com" or "*.example.com". Requests only reach the tunnel once the hostname has a proxied CNAME record pointing at <tunnelID>.cfargotunnel.com. Limits: at least 1 character
`ingress[].originRequest` object	OriginRequest tunes how cloudflared connects to the service.
`ingress[].originRequest.disableChunkedEncoding` boolean	DisableChunkedEncoding turns off chunked transfer encoding, which some WSGI servers need.
`ingress[].originRequest.http2Origin` boolean	HTTP2Origin makes cloudflared connect to the origin over HTTP/2.
`ingress[].originRequest.httpHostHeader` string	HTTPHostHeader overrides the Host header sent to the origin.
`ingress[].originRequest.noTLSVerify` boolean	NoTLSVerify disables verification of the origin's TLS certificate.
`ingress[].originRequest.originServerName` string	OriginServerName is the hostname expected on the origin's TLS certificate.
`ingress[].path` string	Path is a regular expression matched against the request path.
`ingress[].service` stringrequired	Service is where cloudflared sends matching requests, for example "http://my-service.my-namespace:80", "tcp://db:5432" or "http_status:404". Limits: at least 1 character
`tunnelRef` objectrequiredimmutable	TunnelRef references the Tunnel, in the same namespace, whose ingress rules this resource manages. Immutable after creation.
`tunnelRef.name` string	Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names Default: `""`

Status

What kflare reports. conditions holds the Ready condition, whose reason says why a resource isn't ready.

Field	Description
`cloudflareMetadata` object	CloudflareMetadata holds identifiers returned by the Cloudflare API.
`cloudflareMetadata.tunnelID` string	TunnelID is the Cloudflare tunnel this configuration was last written to.
`cloudflareMetadata.version` integer	Version is the configuration version Cloudflare reported after the last sync. cloudflared picks up each new version automatically.
`conditions` []object	Conditions represent the latest available observations of the tunnel configuration state.

kubectl get

The columns kubectl get tunnelconfigurations prints.

Column	Source
TUNNEL	.spec.tunnelRef.name
VERSION	.status.cloudflareMetadata.version
READY	.status.conditions[?(@.type=="Ready")].status
AGE	.metadata.creationTimestamp

Samples

From the repository's config/samples, comments included.

cloudflare_v1alpha1_tunnelconfiguration.yaml

apiVersion: kflare.dev/v1alpha1
kind: TunnelConfiguration
metadata:
  name: example-tunnel-config
  namespace: default
spec:
  # The Tunnel (same namespace) whose ingress rules this resource owns.
  tunnelRef:
    name: example-tunnel
  # Each hostname also needs a DNS record that points at the tunnel: a
  # DNSRecord with tunnelRef (see cloudflare_v1alpha1_dnsrecord_tunnel.yaml).
  ingress:
    - hostname: app.example.com
      service: http://my-app.default.svc.cluster.local:80
    - hostname: api.example.com
      path: ^/v1/
      service: https://my-api.default.svc.cluster.local:443
      originRequest:
        originServerName: api.example.com
  # Requests that match no rule. Defaults to http_status:404.
  defaultService: http_status:404

On GitHub