Skip to content
FractalOps

Cloudflare Tunnel Runtime

Cloudflare Tunnel Runtime

Section titled “Cloudflare Tunnel Runtime”

The edge connector runs cloudflared with a remotely managed tunnel token. Cloudflare’s tunnel configuration API is the ingress authority; a local config.yml is not authoritative in token mode.

Ownership

Section titled “Ownership”
  • Cloudflare owns public hostnames and origin mappings.
  • OpenBao stores API and tunnel credentials.
  • Kubernetes GitOps owns cluster Services, Ingresses, and origin endpoints.
  • SSH endpoints remain DNS-only unless Cloudflare Spectrum is intentionally adopted.

Do not add a second local tunnel configuration generator or copy credentials into the repository.

Change flow

Section titled “Change flow”
  1. Add or change the Kubernetes Service/Ingress through the owning chart.
  2. Update the existing remote tunnel’s public-hostname route through the Cloudflare API or dashboard.
  3. Verify public DNS, origin health, and the intended Access policy.
  4. Record the Cloudflare configuration version and deployed Git revision.

For HTTP routes, set the origin Host header explicitly when the cluster gateway routes by hostname. Credential rotation updates OpenBao first, then restarts only the connector that consumes the rotated token.

Verification

Section titled “Verification”
Terminal window
curl -fsS https://<hostname>/.well-known/openid-configuration

Use an application-specific health or discovery endpoint. A healthy cloudflared process alone does not prove that the hostname exists in the remote tunnel configuration.