cloudflare-operator on contineroo.ch

Core Concepts

Mon, 01 Jan 0001 00:00:00 +0000

Architecture

cloudflare-operator uses the Kubernetes API as the source of truth for Cloudflare DNS records. Desired state is stored in custom resources and can also be derived from Kubernetes Ingress and Gateway API route objects.

flowchart TB
  hostSources["Kubernetes API · hostname sources<br/>Ingress · HTTPRoute · TLSRoute · GRPCRoute"]
  hostController["DNS host controllers<br/>Ingress always on · Gateway API opt-in + CRD discovery"]
  generated["Kubernetes API · generated DNSRecord<br/>one owner-controlled object per hostname"]
  dnsController["DNSRecord controller<br/>resolve refs · create · update · delete"]
  cloudflare["Cloudflare DNS API"]

  hostSources --> hostController --> generated --> dnsController --> cloudflare

  manual["Kubernetes API<br/>manual / GitOps DNSRecord"] --> dnsController

  scope["Kubernetes API<br/>Secret → Account · Zone"] --> scopeController["Account + Zone controllers<br/>credentials · identity · optional pruning"]
  scopeController --> cloudflare
  scope -. "account + zone refs" .-> dnsController

  ip["Kubernetes API · IP"] --> ipController["IP controller<br/>static or periodically fetched content"]
  ipController <--> ipSources["External IPv4 / IPv6 sources"]
  ip -. "optional content ref" .-> dnsController

  manual ~~~ scope
  scope ~~~ ip

  classDef resource fill:#eef4ff,stroke:#4777b7,color:#172033
  classDef controller fill:#e7f0ff,stroke:#2563eb,color:#172033,stroke-width:2px
  classDef external fill:#fff0df,stroke:#f48120,color:#172033,stroke-width:2px
  class hostSources,generated,manual,scope,ip resource
  class scopeController,ipController,hostController,dnsController controller
  class cloudflare,ipSources external

The Account and Zone controllers establish the Cloudflare scope, while the IP controller maintains reusable static or dynamic content. The Ingress controller and the opt-in Gateway API controllers translate hostnames and annotations into owner-controlled DNSRecord objects. The DNSRecord controller then resolves the referenced Account, Zone, and IP resources before applying the record to Cloudflare.

Get Started

Mon, 01 Jan 0001 00:00:00 +0000

This tutorial shows you how to get started with using cloudflare-operator and create a sample DNS record.

Before you begin

The following prerequisites are required to complete this tutorial:

A Kubernetes cluster with cloudflare-operator installed (follow the installation guide)
A Cloudflare account

Create Cloudflare API token

The token can be created by following this guide.

The following permissions are required:

Zone:Zone:Read
Zone:DNS:Edit

Configure the following Zone resources:

Include:All zones

or, if you want to limit the zones to which the token has access:

Installation

Mon, 01 Jan 0001 00:00:00 +0000

This guide walks you through installing cloudflare-operator.

Prerequisites

Install Helm 3
Kubernetes cluster

Install cloudflare-operator

Helm repository

Add the cloudflare-operator Helm chart repository:

helm repo add containeroo https://charts.containeroo.ch

Update the Helm chart repository:

helm repo update

Custom Resource Definitions

As per the Helm best practices, cloudflare-operator Helm chart doesn’t ship with CRDs.

To install the latest CRDs, run the following command:

kubectl apply -f https://github.com/containeroo/cloudflare-operator/releases/latest/download/crds.yaml

If you want to install a specific version of CRDs, run the following command:

API Reference

Mon, 01 Jan 0001 00:00:00 +0000

Packages

cloudflare-operator.io/v1

cloudflare-operator.io/v1

Package v1 contains API schema definitions for the cloudflare-operator.io v1 API group.

Resource Types

Account

Account is the Schema for the accounts API

Field	Description	Default	Validation
`apiVersion` string	`cloudflare-operator.io/v1`
`kind` string	`Account`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` AccountSpec
`status` AccountStatus

AccountRef

Appears in: