Skip to content

Commit 933a078

Browse files
nushkovgnushkovg
committed
feat: cloudflared 1.1.0
1 parent 91890b2 commit 933a078

File tree

6 files changed

+87
-45
lines changed

6 files changed

+87
-45
lines changed

‎charts/cloudflared/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ maintainers:
44
url: https://kubito.dev
55
apiVersion: v2
66
appVersion: 2023.10.0
7-
version: 1.0.5
7+
version: 1.1.0
88
description: Kubito Cloudflared (Argo Tunnel) Helm Chart
99
home: https://github.com/kubitodev/helm/tree/main/charts/cloudflared
1010
icon: https://kubito.dev/images/kubito.svg

‎charts/cloudflared/README.md

Lines changed: 23 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -53,16 +53,20 @@ The command removes all the Kubernetes components associated with the chart and
5353

5454
### Deployment parameters
5555

56-
| Name | Description | Value |
57-
| ------------------- | ---------------------------------------------------------------------------- | ------- |
58-
| `replicaCount` | The number of replicas to deploy. | `3` |
59-
| `tunnelID` | The Argo Tunnel ID you created. Check the configuration section for details. | `""` |
60-
| `auth.accountTag` | The Argo tunnel account tag. | `""` |
61-
| `auth.tunnelName` | The Argo tunnel name. | `""` |
62-
| `auth.tunnelSecret` | The Argo tunnel secret. | `""` |
63-
| `existingSecret` | The name of an existing secret containing the Argo tunnel settings. | `""` |
64-
| `warpRouting` | Whether to enable WARP traffic routing to local subnets. | `false` |
65-
| `ingress` | The ingress settings to apply. Check the configuration section for examples. | `[]` |
56+
| Name | Description | Value |
57+
| --------------------------- | ------------------------------------------------------------------------------------------------------------ | ------- |
58+
| `replicaCount` | The number of replicas to deploy. | `1` |
59+
| `managed.enabled` | Whether to enable Managed (CF Zero Trust Dashboard) tunnel configuration. Cannot coexist with the local one. | `true` |
60+
| `managed.token` | The connector token provided at the end of the CF Zero Trust tunnel creation. | `""` |
61+
| `managed.existingSecret` | The name of the existing secret containing the token. The secret key must be set to 'cf-tunnel-token'. | `""` |
62+
| `local.enabled` | Whether to enable Local (CLI) tunnel configuration. Cannot coexist with the managed one. | `false` |
63+
| `local.auth.tunnelID` | The Argo Tunnel ID you created. Check the configuration section for details. | `""` |
64+
| `local.auth.accountTag` | The Argo tunnel account tag. | `""` |
65+
| `local.auth.tunnelName` | The Argo tunnel name. | `""` |
66+
| `local.auth.tunnelSecret` | The Argo tunnel secret. | `""` |
67+
| `local.auth.existingSecret` | The name of an existing secret containing the Argo tunnel settings. | `""` |
68+
| `local.warpRouting` | Whether to enable WARP traffic routing to local subnets. | `false` |
69+
| `local.ingress` | The ingress settings to apply. Check the configuration section for examples. | `[]` |
6670

6771

6872
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
@@ -84,7 +88,13 @@ helm install example -f values.yaml kubitodev/example
8488
8589
## Configuration and installation details
8690

87-
### Getting the Argo Tunnel ID (required)
91+
### Managed Setup
92+
93+
- Go to the Cloudflare dashboard of your account and enable Zero Trust. Once there, in Access -> Tunnels you can create a tunnel and get the connector token.
94+
95+
### Local CLI Setup
96+
97+
#### Getting the Argo Tunnel ID
8898

8999
- Start by downloading and installing the lightweight Cloudflare Tunnel daemon, `cloudflared`. You can find it [here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation/).
90100

@@ -112,7 +122,7 @@ Now, when you want to create a new subdomain, just point it as a CNAME to the tu
112122

113123
For more information, check the [official guide](https://developers.cloudflare.com/cloudflare-one/tutorials/many-cfd-one-tunnel/).
114124

115-
### Setting up the Argo Tunnel ingress options with Traefik
125+
#### Setting up the Argo Tunnel ingress options with Traefik
116126

117127
To use the tunnel with Traefik, you need to configure the ingress settings. As cloudflared works with CNAMEs, you want to set a wildcard hostname for the service, and set the origin request setting to be the root domain that you are configuring this for. Also, you need to point the service to the secure port (443) of the Traefik load balancer service. Here is an example configuration:
118128

@@ -128,7 +138,7 @@ cloudflared:
128138
129139
## License
130140
131-
Copyright © 2022 Kubito
141+
Copyright © 2024 Kubito
132142
133143
Licensed under the Apache License, Version 2.0 (the "License");
134144
you may not use this file except in compliance with the License.

‎charts/cloudflared/templates/configmap.yaml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{- if .Values.local.enabled }}
12
apiVersion: v1
23
kind: ConfigMap
34
metadata:
@@ -6,8 +7,9 @@ metadata:
67
data:
78
config.yaml: |-
89
logDirectory: /var/log/cloudflared
9-
tunnel: {{ required "The Argo Tunnel ID is missing." .Values.tunnelID }}
10+
tunnel: {{ required "The Argo Tunnel ID is missing." .Values.local.auth.tunnelID }}
1011
credentials-file: /etc/cloudflared/tunnel-config.json
1112
warp-routing:
1213
enabled: {{ .Values.warpRouting }}
13-
ingress: {{ toYaml .Values.ingress | nindent 6 }}
14+
ingress: {{ toYaml .Values.local.ingress | nindent 6 }}
15+
{{- end }}

‎charts/cloudflared/templates/deployment.yaml

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,41 +12,63 @@ spec:
1212
metadata:
1313
labels:
1414
app: {{ .Release.Name }}
15+
{{- if .Values.local.enabled }}
1516
annotations:
16-
checksum/tunnel-id: {{ sha256sum .Values.tunnelID }}
17+
checksum/tunnel-id: {{ sha256sum .Values.local.auth.tunnelID }}
1718
checksum/ingress: {{ .Values.ingress | toJson | sha256sum }}
1819
checksum/auth: {{ .Values.auth | toJson | sha256sum }}
1920
checksum/warp-routing: {{ .Values.warpRouting | toJson | sha256sum }}
21+
{{- end }}
2022
spec:
2123
containers:
2224
- args:
2325
- tunnel
2426
- --no-autoupdate
27+
{{- if .Values.local.enabled }}
2528
- --config
2629
- /etc/cloudflared/config.yaml
2730
- run
31+
{{- else if .Values.managed.enabled }}
32+
- run
33+
- --token
34+
- $(CF_MANAGED_TUNNEL_TOKEN)
35+
{{- end }}
2836
name: {{ .Release.Name }}
2937
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
3038
imagePullPolicy: {{ .Values.image.imagePullPolicy }}
39+
{{- if .Values.managed.enabled }}
40+
env:
41+
- name: CF_MANAGED_TUNNEL_TOKEN
42+
{{- if .Values.managed.existingSecret }}
43+
valueFrom:
44+
secretKeyRef:
45+
name: {{ .Values.managed.existingSecret }}
46+
key: cf-tunnel-token
47+
{{- else }}
48+
value: {{ .Values.managed.token }}
49+
{{- end }}
50+
{{- end }}
51+
{{- if .Values.local.enabled }}
3152
volumeMounts:
3253
- mountPath: /etc/cloudflared/tunnel-config.json
3354
name: tunnel-secret-volume
3455
subPath: tunnel-config.json
3556
- mountPath: /etc/cloudflared/config.yaml
3657
name: cloudflared-config-volume
3758
subPath: config.yaml
38-
imagePullSecrets:
39-
- name: {{ default "tunnel-secret" .Values.existingSecret }}
59+
{{- end }}
4060
restartPolicy: Always
4161
terminationGracePeriodSeconds: 30
62+
{{- if .Values.local.enabled }}
4263
volumes:
4364
- name: tunnel-secret-volume
4465
secret:
4566
defaultMode: 420
4667
optional: false
47-
secretName: {{ default "tunnel-secret" .Values.existingSecret }}
68+
secretName: {{ default "tunnel-secret" .Values.local.auth.existingSecret }}
4869
- name: cloudflared-config-volume
4970
configMap:
5071
defaultMode: 420
5172
name: {{ .Release.Name }}
5273
optional: false
74+
{{- end }}

‎charts/cloudflared/templates/secret.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if not .Values.existingSecret -}}
1+
{{- if and .Values.local.enabled (not .Values.local.auth.existingSecret) }}
22
apiVersion: v1
33
kind: Secret
44
metadata:
@@ -7,9 +7,9 @@ type: Opaque
77
stringData:
88
tunnel-config.json: >
99
{
10-
"AccountTag": "{{ required "The Argo Tunnel Account Tag is missing." .Values.auth.accountTag }}",
11-
"TunnelSecret": "{{ required "The Argo Tunnel Secret is missing." .Values.auth.tunnelSecret }}",
12-
"TunnelID": "{{ required "The Argo Tunnel ID is missing." .Values.tunnelID }}",
13-
"TunnelName": "{{ required "The Argo Tunnel Name is missing." .Values.auth.tunnelName }}"
10+
"AccountTag": "{{ required "The Argo Tunnel Account Tag is missing." .Values.local.auth.accountTag }}",
11+
"TunnelSecret": "{{ required "The Argo Tunnel Secret is missing." .Values.local.auth.tunnelSecret }}",
12+
"TunnelID": "{{ required "The Argo Tunnel ID is missing." .Values.local.auth.tunnelID }}",
13+
"TunnelName": "{{ required "The Argo Tunnel Name is missing." .Values.local.auth.tunnelName }}"
1414
}
1515
{{- end }}

‎charts/cloudflared/values.yaml

Lines changed: 28 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -15,24 +15,32 @@ image:
1515

1616
## @param replicaCount The number of replicas to deploy.
1717
##
18-
replicaCount: 3
19-
## @param tunnelID The Argo Tunnel ID you created. Check the configuration section for details.
20-
##
21-
tunnelID: ""
22-
## @param auth.accountTag The Argo tunnel account tag.
23-
## @param auth.tunnelName The Argo tunnel name.
24-
## @param auth.tunnelSecret The Argo tunnel secret.
25-
##
26-
auth:
27-
accountTag: ""
28-
tunnelName: ""
29-
tunnelSecret: ""
30-
## @param existingSecret The name of an existing secret containing the Argo tunnel settings.
31-
##
32-
existingSecret: ""
33-
## @param warpRouting Whether to enable WARP traffic routing to local subnets.
34-
##
35-
warpRouting: false
36-
## @param ingress The ingress settings to apply. Check the configuration section for examples.
18+
replicaCount: 1
19+
20+
## @param managed.enabled Whether to enable Managed (CF Zero Trust Dashboard) tunnel configuration. Cannot coexist with the local one.
21+
## @param managed.token The connector token provided at the end of the CF Zero Trust tunnel creation.
22+
## @param managed.existingSecret The name of the existing secret containing the token. The secret key must be set to 'cf-tunnel-token'.
23+
managed:
24+
enabled: true
25+
token: ""
26+
existingSecret: ""
27+
28+
## @param local.enabled Whether to enable Local (CLI) tunnel configuration. Cannot coexist with the managed one.
29+
## @param local.auth.tunnelID The Argo Tunnel ID you created. Check the configuration section for details.
30+
## @param local.auth.accountTag The Argo tunnel account tag.
31+
## @param local.auth.tunnelName The Argo tunnel name.
32+
## @param local.auth.tunnelSecret The Argo tunnel secret.
33+
## @param local.auth.existingSecret The name of an existing secret containing the Argo tunnel settings.
34+
## @param local.warpRouting Whether to enable WARP traffic routing to local subnets.
35+
## @param local.ingress The ingress settings to apply. Check the configuration section for examples.
3736
##
38-
ingress: []
37+
local:
38+
enabled: false
39+
auth:
40+
tunnelID: ""
41+
accountTag: ""
42+
tunnelName: ""
43+
tunnelSecret: ""
44+
existingSecret: ""
45+
warpRouting: false
46+
ingress: []

0 commit comments

Comments
 (0)