Cloudflare Tunnels

Este sera una serie de post sobre lo que tengo montado, espero que no sean muy largos.
Para quien no sepais que son los Clouflare tunnels

Pues bien, results que es posible tener un cloudflare tunnel directamente desde cluster the k8s
como service y que todas las consultas llegen a tu ingress y este redirija al servicio correcto.

Asi que vamos a ir paso a paso, explicando esto:

  1. Configuramos el servicio de clouflare (recordad cambiar lo que os pongo entre {})
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    ---
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: cloudflared
      namespace: cloudflared
    spec:
      selector:
        matchLabels:
          app: cloudflared
      replicas: 2 # You could also consider elastic scaling for this deployment
      template:
        metadata:
          labels:
            app: cloudflared
        spec:
          containers:
          - name: cloudflared
            image: cloudflare/cloudflared:2022.3.0
            args:
            - tunnel
            # Points cloudflared to the config file, which configures what
            # cloudflared will actually do. This file is created by a ConfigMap
            # below.
            - --config
            - /etc/cloudflared/config/config.yaml
            - run
            livenessProbe:
              httpGet:
                # Cloudflared has a /ready endpoint which returns 200 if and only if
                # it has an active connection to the edge.
                path: /ready
                port: 2000
              failureThreshold: 1
              initialDelaySeconds: 10
              periodSeconds: 10
            volumeMounts:
            - name: config
              mountPath: /etc/cloudflared/config
              readOnly: true
            # Each tunnel has an associated "credentials file" which authorizes machines
            # to run the tunnel. cloudflared will read this file from its local filesystem,
            # and it'll be stored in a k8s secret.
            - name: creds
              mountPath: /etc/cloudflared/creds
              readOnly: true
          volumes:
          - name: creds
            secret:
              secretName: tunnel-credentials
          - name: config
            configMap:
              name: cloudflared
              items:
              - key: config.yaml
                path: config.yaml
    ---
    # This ConfigMap is just a way to define the cloudflared config.yaml file in k8s.
    # It's useful to define it in k8s, rather than as a stand-alone .yaml file, because
    # this lets you use various k8s templating solutions (e.g. Helm charts) to
    # parameterize your config, instead of just using string literals.
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: cloudflared
    data:
      config.yaml: |
        # Name of the tunnel you want to run
        tunnel: {main-dc}
        credentials-file: /etc/cloudflared/creds/credentials.json
        # Serves the metrics server under /metrics and the readiness server under /ready
        metrics: 0.0.0.0:2000
        no-autoupdate: true
        ingress:
        {- hostname: 'run.level5.dev'
          service: http://traefik.traefik.svc.cluster.local:80
        - hostname: 'registry.level5.dev'
          service: http://traefik.traefik.svc.cluster.local:80
        - service: http_status:404}

Comments

⬆︎TOP