Cloudflare Zero Trust Operator

A Kubernetes Operator for Cloudflare Zero Trust: Tunnels, Access, Gateway, Device, DNS, R2, and Rules Management

Documentation (English) » | 文档 (中文) »

Examples · Report Bug · Request Feature

Note: This project is currently in Alpha (v0.21.x). This is NOT an official Cloudflare product. It uses the Cloudflare API and cloudflared to automate Zero Trust configuration on Kubernetes.

This project is a fork of adyanth/cloudflare-operator with extended Zero Trust features and improvements.

Overview

The Cloudflare Zero Trust Operator provides Kubernetes-native management of Cloudflare Zero Trust resources. Built with kubebuilder and controller-runtime, it enables declarative configuration of tunnels, access policies, gateway rules, device settings, R2 storage, and zone rules through Custom Resource Definitions (CRDs).

Features

Architecture

flowchart TB
    subgraph Internet["Internet"]
        Users["Users / WARP Clients"]
    end

    subgraph Cloudflare["Cloudflare Edge"]
        Edge["Cloudflare Edge Network"]
        API["Cloudflare API"]
    end

    subgraph K8s["Kubernetes Cluster"]
        subgraph CRDs["Custom Resources"]
            Tunnel["Tunnel / ClusterTunnel"]
            TB["TunnelBinding"]
            VNet["VirtualNetwork"]
            Route["NetworkRoute"]
        end

        subgraph K8sNative["Kubernetes Native"]
            Ingress["Ingress"]
            Gateway["Gateway API"]
        end

        subgraph Operator["Cloudflare Operator"]
            Controller["Controller Manager"]
        end

        subgraph Managed["Managed Resources"]
            ConfigMap["ConfigMap"]
            Secret["Secret"]
            Deployment["cloudflared"]
        end

        subgraph App["Applications"]
            Service["Services"]
            Pod["Pods"]
        end
    end

    CRDs -.->|watches| Controller
    K8sNative -.->|watches| Controller
    Controller -->|creates| Managed
    Controller -->|API calls| API
    Managed -->|proxy| Service
    Service --> Pod
    Users -->|HTTPS/WARP| Edge
    Edge <-->|tunnel| Deployment

Quick Start

Prerequisites

• Kubernetes cluster v1.28+
• Cloudflare account with Zero Trust enabled
• Cloudflare API Token (Create Token)

Installation

# Install CRDs and operator
kubectl apply -f https://github.com/StringKe/cloudflare-operator/releases/latest/download/cloudflare-operator.crds.yaml
kubectl apply -f https://github.com/StringKe/cloudflare-operator/releases/latest/download/cloudflare-operator.yaml

# Verify installation
kubectl get pods -n cloudflare-operator-system

Create a Tunnel

# 1. Create API credentials secret
apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-credentials
type: Opaque
stringData:
  CLOUDFLARE_API_TOKEN: "<your-api-token>"
---
# 2. Create tunnel
apiVersion: networking.cloudflare-operator.io/v1alpha2
kind: Tunnel
metadata:
  name: my-tunnel
spec:
  newTunnel:
    name: k8s-tunnel
  cloudflare:
    accountId: "<your-account-id>"
    domain: example.com
    secret: cloudflare-credentials

Expose a Service

apiVersion: networking.cfargotunnel.com/v1alpha1
kind: TunnelBinding
metadata:
  name: web-binding
subjects:
  - kind: Service
    name: web-app
    spec:
      fqdn: app.example.com
      protocol: http
tunnelRef:
  kind: Tunnel
  name: my-tunnel

CRD Reference

Credentials & Configuration

Tunnel Management

Private Network Access

Access Control

Gateway & Security

Device Management

DNS & Connectivity

SSL/TLS & Certificates

R2 Storage

Rules Engine

Registrar (Enterprise)

Kubernetes Integration

Note: The operator also supports native Kubernetes Ingress and Gateway API (Gateway, HTTPRoute, TCPRoute, UDPRoute) resources when configured with the appropriate IngressClass or GatewayClass.

Examples

See the examples directory for comprehensive usage examples:

• Basic - Credentials, Tunnels, DNS, Service Binding
• Private Network - Virtual Networks, Routes, Private Services
• Zero Trust - Access Apps, Groups, Identity Providers
• Gateway - Gateway Rules, Lists
• Device - Device Policies, Posture Rules
• Scenarios - Complete real-world scenarios

Documentation

Documentation includes:

• Installation Guide
• API Token Permissions
• Complete CRD Reference
• Troubleshooting Guide
• Migration Guide (v1alpha1 → v1alpha2)

API Token Permissions

Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines.

Acknowledgements

This project is forked from adyanth/cloudflare-operator. We extend our gratitude to @adyanth and all original contributors for their excellent work on the initial implementation.

What's Different

This fork extends the original project with:

• Complete Zero Trust resource support (Access, Gateway, Device management)
• v1alpha2 API with improved resource management
• Native Kubernetes Ingress and Gateway API integration
• R2 Storage management (buckets, custom domains, notifications)
• Zone settings and rules engine (SSL/TLS, Cache, WAF, Transform/Redirect rules)
• Origin CA certificate integration
• Domain registration management (Enterprise)
• Enhanced error handling and status reporting
• Comprehensive documentation and examples

License

Apache License 2.0 - See LICENSE for details.