kubernetes/apps/network/cloudflare-tunnel/app/helmrelease.yaml
1
---
2
# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/helm.toolkit.fluxcd.io/helmrelease_v2.json
3
apiVersion: helm.toolkit.fluxcd.io/v2
4
kind: HelmRelease
5
metadata:
6
name: cloudflare-tunnel
7
spec:
8
chartRef:
9
kind: OCIRepository
10
name: cloudflare-tunnel
11
interval: 1h
12
values:
13
controllers:
14
cloudflare-tunnel:
15
replicas: 2
16
strategy: RollingUpdate
17
annotations:
18
reloader.stakater.com/auto: "true"
19
containers:
20
app:
21
image:
22
repository: mirror.gcr.io/cloudflare/cloudflared
23
tag: 2026.8.3@sha256:51c9cefcb4569df44e1ad403ab1d3d8065aa8e84339bcfc6aee75502e1140339
24
env:
25
NO_AUTOUPDATE: true
26
TUNNEL_METRICS: 0.0.0.0:8080
27
TUNNEL_POST_QUANTUM: true
28
TUNNEL_TRANSPORT_PROTOCOL: quic
29
envFrom:
30
- secretRef:
31
name: "{{ .Release.Name }}-secret"
32
args:
33
- tunnel
34
- run
35
probes:
36
liveness: &probes
37
enabled: true
38
custom: true
39
spec:
40
httpGet:
41
path: /ready
42
port: &port 8080
43
initialDelaySeconds: 0
44
periodSeconds: 10
45
timeoutSeconds: 1
46
failureThreshold: 3
47
readiness: *probes
48
securityContext:
49
allowPrivilegeEscalation: false
50
readOnlyRootFilesystem: true
51
capabilities: { drop: ["ALL"] }
52
resources:
53
requests:
54
cpu: 10m
55
memory: 48Mi
56
limits:
57
memory: 96Mi
58
defaultPodOptions:
59
securityContext:
60
runAsNonRoot: true
61
runAsUser: 1000
62
runAsGroup: 1000
63
service:
64
app:
65
ports:
66
http:
67
port: *port
68
serviceMonitor:
69
app:
70
endpoints:
71
- port: http
72
configMaps:
73
config:
74
data:
75
config.yaml: |-
76
ingress:
77
- hostname: "*.janpuc.com"
78
originRequest:
79
http2Origin: true
80
originServerName: external.janpuc.com
81
service: https://envoy-external.{{ .Release.Namespace }}.svc.cluster.local:443
82
- service: http_status:404
83
persistence:
84
config-file:
85
type: configMap
86
identifier: config
87
globalMounts:
88
- path: /etc/cloudflared/config.yaml
89
subPath: config.yaml