cloudflared: decommission the Cloudflare tunnel ingress #44

2026-06-26T10:12:51Z

k.renner commented

2026-06-26 10:12:51 +00:00

All 8 public hostnames have moved off the Cloudflare tunnel to the NetBird reverse proxy, so cloudflared routes nothing but a 404. This retires the component:

delete kubernetes/infrastructure/cloudflared/ (Deployment, ConfigMap, tunnel-credentials Secret, Kustomization) + drop it from infrastructure/kustomization.yaml (Flux prunes the workload)
remove the cloudflared image-automation policy + README row
drop the cloudflared-to-ingress-only CiliumNetworkPolicy
scrub stale cloudflared comments (netbird-ingress, k8s-gateway, default-deny note)

Cloudflare is still used for DNS (external-dns-cloudflare) and cert-manager DNS-01 — only the tunnel is retired. The Cloudflare-side tunnel (Zero Trust) can be deleted separately.

⚠️ Merge last — only after every per-service proxy cutover is live and verified. cloudflared already serves no routes, so this just removes the dormant workload (11 files, −184 lines).

🤖 Generated with Claude Code

All 8 public hostnames have moved off the Cloudflare tunnel to the NetBird reverse proxy, so cloudflared routes nothing but a 404. This retires the component: - delete `kubernetes/infrastructure/cloudflared/` (Deployment, ConfigMap, tunnel-credentials Secret, Kustomization) + drop it from `infrastructure/kustomization.yaml` (Flux prunes the workload) - remove the cloudflared image-automation policy + README row - drop the `cloudflared-to-ingress-only` CiliumNetworkPolicy - scrub stale `cloudflared` comments (netbird-ingress, k8s-gateway, default-deny note) **Cloudflare is still used for DNS** (external-dns-cloudflare) and cert-manager DNS-01 — only the *tunnel* is retired. The Cloudflare-side tunnel (Zero Trust) can be deleted separately. ⚠️ **Merge last** — only after every per-service proxy cutover is live and verified. cloudflared already serves no routes, so this just removes the dormant workload (11 files, −184 lines). 🤖 Generated with Claude Code

k.renner added 1 commit 2026-06-26 10:12:51 +00:00

cloudflared: decommission the Cloudflare tunnel ingress d30084162e

All 8 public hostnames have moved off the tunnel to the NetBird reverse
proxy, so cloudflared routes nothing but a 404. Remove the component
entirely:

- delete kubernetes/infrastructure/cloudflared/ (Deployment, ConfigMap,
  tunnel-credentials Secret, Kustomization) + drop it from
  infrastructure/kustomization.yaml (Flux prunes the workload)
- remove the cloudflared image-automation policy + README row
- drop the cloudflared-to-ingress-only CiliumNetworkPolicy
- scrub stale "cloudflared" comments (netbird-ingress, k8s-gateway,
  ingress-default-deny external-entry note)

Cloudflare is still used for DNS (external-dns-cloudflare) and
cert-manager DNS-01 — only the tunnel is retired. The Cloudflare-side
tunnel itself (Zero Trust) can be deleted separately.

MERGE LAST — only after every per-service proxy cutover is live and
verified; cloudflared already serves no routes, so this just removes the
dormant workload.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit 65e45d3c69 into master

2026-06-26 10:13:33 +00:00

k.renner referenced this issue from a commit

2026-06-26 10:13:34 +00:00

Merge pull request 'cloudflared: decommission the Cloudflare tunnel ingress' (#44) from decommission-cloudflared into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#44