apiVersion: apps/v1
kind: Deployment
metadata:
  name: cloudflared
  namespace: cloudflare-tunnel
  labels:
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/instance: cloudflare-tunnel
    app.kubernetes.io/component: connector
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: cloudflared
      app.kubernetes.io/instance: cloudflare-tunnel
  template:
    metadata:
      labels:
        app.kubernetes.io/name: cloudflared
        app.kubernetes.io/instance: cloudflare-tunnel
        app.kubernetes.io/component: connector
    spec:
      serviceAccountName: cloudflared
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 60
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: cloudflared
                  app.kubernetes.io/instance: cloudflare-tunnel
              topologyKey: kubernetes.io/hostname
      containers:
        - name: cloudflared
          image: docker.io/cloudflare/cloudflared:2026.10.4@sha256:c6c7ae1d5dfdcb094ad344ed68ccffc26635c9c6be80965664c33baf064b0515
          imagePullPolicy: IfNotPresent
          args:
            - tunnel
            - --no-autoupdate
            - --loglevel
            - info
            - --metrics
            - 0.0.0.0:2000
            - run
            - --token-file
            - /etc/cloudflared/token
          ports:
            - name: metrics
              containerPort: 2000
              protocol: TCP
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          readinessProbe:
            httpGet:
              path: /ready
              port: metrics
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /ready
              port: metrics
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 10
          volumeMounts:
            - name: connector-token
              mountPath: /etc/cloudflared
              readOnly: true
      volumes:
        - name: connector-token
          secret:
            secretName: cloudflare-tunnel-connector
            items:
              - key: token
                path: token