ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/cloudflare-tunnel/deployment.yaml

@@ -0,0 +1,98 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cloudflared
+  namespace: cloudflare-tunnel
+  labels:
+    app.kubernetes.io/name: cloudflared
+    app.kubernetes.io/instance: cloudflare-tunnel
+    app.kubernetes.io/component: connector
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: cloudflared
+      app.kubernetes.io/instance: cloudflare-tunnel
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: cloudflared
+        app.kubernetes.io/instance: cloudflare-tunnel
+        app.kubernetes.io/component: connector
+    spec:
+      serviceAccountName: cloudflared
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: cloudflared
+                  app.kubernetes.io/instance: cloudflare-tunnel
+              topologyKey: kubernetes.io/hostname
+      containers:
+        - name: cloudflared
+          image: docker.io/cloudflare/cloudflared:2026.10.4@sha256:c6c7ae1d5dfdcb094ad344ed68ccffc26635c9c6be80965664c33baf064b0515
+          imagePullPolicy: IfNotPresent
+          args:
+            - tunnel
+            - --no-autoupdate
+            - --loglevel
+            - info
+            - --metrics
+            - 0.0.0.0:2000
+            - run
+            - --token-file
+            - /etc/cloudflared/token
+          ports:
+            - name: metrics
+              containerPort: 2000
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              memory: 128Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: metrics
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /ready
+              port: metrics
+            failureThreshold: 3
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          volumeMounts:
+            - name: connector-token
+              mountPath: /etc/cloudflared
+              readOnly: true
+      volumes:
+        - name: connector-token
+          secret:
+            secretName: cloudflare-tunnel-connector
+            items:
+              - key: token
+                path: token

vendor/platform/cloudflare-tunnel/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - service-accounts.yaml
+  - vso.yaml
+  - deployment.yaml
+  - poddisruptionbudget.yaml
+  - network-policies.yaml

vendor/platform/cloudflare-tunnel/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cloudflare-tunnel

vendor/platform/cloudflare-tunnel/network-policies.yaml

@@ -0,0 +1,122 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: cloudflared
+  namespace: cloudflare-tunnel
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: cloudflared
+      app.kubernetes.io/instance: cloudflare-tunnel
+  ingress:
+    - fromEntities:
+        - host
+      toPorts:
+        - ports:
+            - port: "2000"
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*.argotunnel.com"
+              - matchPattern: "*.*.argotunnel.com"
+              - matchName: api.cloudflare.com
+              - matchName: tier-o-canary.tier-o-canary.svc.cluster.local
+              - matchName: mta-sts.mta-sts.svc.cluster.local
+              - matchName: forge-code-facade.forgejo-public.svc.cluster.local
+              - matchName: cluster-health-api.cluster-health.svc.cluster.local
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: cluster-health
+            app.kubernetes.io/name: cluster-health-api
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: tier-o-canary
+            app.kubernetes.io/name: tier-o-canary
+            app.kubernetes.io/instance: tier-o-canary
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: mta-sts
+            app.kubernetes.io/name: mta-sts
+            app.kubernetes.io/instance: mta-sts
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: forgejo-public
+            app.kubernetes.io/name: envoy
+            app.kubernetes.io/instance: forge-code-facade
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    - toFQDNs:
+        - matchName: region1.v2.argotunnel.com
+        - matchName: region2.v2.argotunnel.com
+      toPorts:
+        - ports:
+            - port: "7844"
+              protocol: TCP
+            - port: "7844"
+              protocol: UDP
+    - toFQDNs:
+        - matchName: api.cloudflare.com
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-egress-cloudflared-probes
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: cloudflare-tunnel
+            app.kubernetes.io/name: cloudflared
+            app.kubernetes.io/instance: cloudflare-tunnel
+      toPorts:
+        - ports:
+            - port: "2000"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-ingress-cloudflared-probe-replies
+spec:
+  nodeSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: cloudflare-tunnel
+            app.kubernetes.io/name: cloudflared
+            app.kubernetes.io/instance: cloudflare-tunnel
+      toPorts:
+        - ports:
+            - port: "32768"
+              endPort: 60999
+              protocol: TCP

vendor/platform/cloudflare-tunnel/poddisruptionbudget.yaml

@@ -0,0 +1,11 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: cloudflared
+  namespace: cloudflare-tunnel
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: cloudflared
+      app.kubernetes.io/instance: cloudflare-tunnel

vendor/platform/cloudflare-tunnel/service-accounts.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cloudflare-tunnel-vso
+  namespace: cloudflare-tunnel
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cloudflared
+  namespace: cloudflare-tunnel
+automountServiceAccountToken: false

vendor/platform/cloudflare-tunnel/vso.yaml

@@ -0,0 +1,37 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: cloudflare-tunnel
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: cloudflare-tunnel-vso
+    serviceAccount: cloudflare-tunnel-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: cloudflare-tunnel-connector
+  namespace: cloudflare-tunnel
+spec:
+  type: kv-v2
+  mount: secret
+  path: cloudflare/tunnel-connector
+  destination:
+    name: cloudflare-tunnel-connector
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        token:
+          text: '{{ get .Secrets "token" }}'
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: cloudflared
+  vaultAuthRef: default