Build a Cloudflare Stack

Cloudflare Tunnel lets you expose services running in your cluster to the internet without configuring public IPs, opening firewall ports, or managing TLS certificates.

AI Prompts

Use the AI Assistant (⌘+J) for guidance on building your Cloudflare Tunnel stack.

Why Cloudflare Tunnel?

Traditional Ingress	Cloudflare Tunnel
Requires public IP or LoadBalancer	Works behind NAT, no public IP needed
Open firewall ports (80, 443)	No inbound ports required
Manage TLS certificates yourself	Automatic TLS from Cloudflare
DDoS protection costs extra	DDoS protection included
Complex DNS configuration	Automatic DNS via Cloudflare

Cloudflare Tunnel is ideal for:

Clusters running on-premises or in private networks
Development and staging environments
Services that need Cloudflare’s security features
Teams that want zero-trust access controls

Prerequisites

Before you start:

A Cloudflare account with a domain added
A cluster imported into Ankra with the agent connected
The service you want to expose running in your cluster

Step 1: Create a Cloudflare Tunnel

Log into Cloudflare Dashboard

Go to dash.cloudflare.com and select your account.

Navigate to Zero Trust

Click Zero Trust in the sidebar, then Networks → Tunnels.

Create a Tunnel

Click Create a tunnel and select Cloudflared as the connector type.

Name Your Tunnel

Give it a descriptive name like my-cluster-tunnel or prod-services.

Copy the Tunnel Token

Cloudflare will show you a token. Copy it - you’ll need this for the Kubernetes deployment. The token looks like: eyJhIjoiNjM...

Skip the Connector Setup

Don’t install the connector yet. We’ll deploy it via Ankra instead. Click Next.

Configure Public Hostname

Add a public hostname for your service:

Subdomain: e.g., app or api
Domain: Select your Cloudflare domain
Service: http://your-service.namespace.svc.cluster.local:port You can add more hostnames later.

Save the Tunnel

Click Save tunnel. The tunnel will show as “Inactive” until we deploy the connector.

Step 2: Create the Stack in Ankra

Open Stack Builder

Navigate to your cluster → Stacks → Create Stack.

Name Your Stack

Name it cloudflare-tunnel or similar.

Add a Secret Manifest

Click + Add → Manifest and create a Secret for the tunnel token:

apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-tunnel-token
  namespace: cloudflare
type: Opaque
stringData:
  token: "YOUR_TUNNEL_TOKEN_HERE"

Replace YOUR_TUNNEL_TOKEN_HERE with the token from Cloudflare.

Encrypt your token with SOPS: If you have SOPS encryption enabled, add token to the Encrypted Keys section in the manifest editor. Your token will be encrypted before being pushed to Git and automatically decrypted during deployment.

Add a Namespace Manifest

Click + Add → Manifest for the namespace:

apiVersion: v1
kind: Namespace
metadata:
  name: cloudflare

Add the Cloudflared Deployment

Click + Add → Manifest for the tunnel connector:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: cloudflared
  namespace: cloudflare
spec:
  replicas: 2
  selector:
    matchLabels:
      app: cloudflared
  template:
    metadata:
      labels:
        app: cloudflared
    spec:
      containers:
        - name: cloudflared
          image: cloudflare/cloudflared:latest
          args:
            - tunnel
            - --no-autoupdate
            - run
            - --token
            - $(TUNNEL_TOKEN)
          env:
            - name: TUNNEL_TOKEN
              valueFrom:
                secretKeyRef:
                  name: cloudflare-tunnel-token
                  key: token
          resources:
            requests:
              memory: 64Mi
              cpu: 10m
            limits:
              memory: 128Mi
              cpu: 100m
          livenessProbe:
            httpGet:
              path: /ready
              port: 2000
            initialDelaySeconds: 10
            periodSeconds: 10

Connect Dependencies

In the Stack Builder canvas, connect:

Namespace → Secret → Deployment

This ensures resources deploy in the correct order.

Step 3: Deploy and Verify

Save and Deploy

Click Save, then Deploy. Watch the deployment in Operations.

Check Cloudflare Dashboard

Go back to the Cloudflare Zero Trust dashboard. Your tunnel should now show as Healthy.

Test Your Service

Navigate to your configured hostname (e.g., https://app.yourdomain.com). Your service should be accessible.

Configuring Routes

You configure which services are exposed in the Cloudflare dashboard, not in Kubernetes.

Adding a New Route

Go to Zero Trust → Networks → Tunnels
Click your tunnel → Configure
Go to Public Hostname tab
Click Add a public hostname
Configure:
- Subdomain: The subdomain to use
- Domain: Your Cloudflare domain
- Service: The internal Kubernetes service URL

Service URL Format

For Kubernetes services, use this format:

http://SERVICE_NAME.NAMESPACE.svc.cluster.local:PORT

Examples:

http://nginx.default.svc.cluster.local:80
http://api-server.backend.svc.cluster.local:3000
http://grafana.monitoring.svc.cluster.local:3000

Multiple Services

One tunnel can expose multiple services. Add multiple public hostnames in Cloudflare:

Hostname	Service
`app.example.com`	`http://frontend.default.svc.cluster.local:80`
`api.example.com`	`http://backend.default.svc.cluster.local:3000`
`grafana.example.com`	`http://grafana.monitoring.svc.cluster.local:3000`

High Availability

The example deployment runs 2 replicas for redundancy. For production:

spec:
  replicas: 3
  template:
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: cloudflared
                topologyKey: kubernetes.io/hostname

This spreads replicas across different nodes.

Encrypting Secrets with SOPS

If you’re using GitOps to store your Stack configuration, you should encrypt the tunnel token with SOPS to avoid committing secrets in plaintext.

Enable SOPS Encryption

Initialize SOPS at Organisation Level

Go to Organisation Settings → Encryption and click Initialize Encryption. This generates an AGE key pair for your organisation.

Enable SOPS on Your Cluster

Navigate to your cluster → Settings → Encryption and toggle on Enable SOPS Decryption. This deploys the decryption key to ArgoCD.

Mark the Token for Encryption

When editing the Secret manifest in the Stack Builder, expand the Encrypted Keys (SOPS) section and add token as an encrypted key.

How It Works

When you save the Stack, Ankra encrypts the token field using your organisation’s AGE public key
The encrypted manifest is stored in your Git repository (if GitOps is enabled)
When ArgoCD deploys the Stack, helm-secrets automatically decrypts the value using the private key stored in the cluster
Your tunnel token never appears in plaintext in Git

Example Encrypted Manifest

After encryption, the Secret looks like this in Git:

apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-tunnel-token
  namespace: cloudflare
type: Opaque
stringData:
  token: ENC[AES256_GCM,data:...,iv:...,tag:...,type:str]
sops:
  age:
    - recipient: age1...
      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
        ...
        -----END AGE ENCRYPTED FILE-----
  encrypted_regex: ^(token)$
  version: 3.9.4

The ENC[...] value is the encrypted token. The sops metadata block contains the encryption parameters.

Learn more about SOPS encryption in the SOPS Encryption guide.

Access Controls

Cloudflare Tunnel integrates with Cloudflare Access for zero-trust security:

Go to Zero Trust → Access → Applications
Click Add an application
Select Self-hosted
Configure the application URL (your tunnel hostname)
Add access policies (e.g., require SSO, specific emails, IP ranges)

This lets you protect internal services with identity-aware access without VPNs.

Troubleshooting

Tunnel Shows as Inactive

Check the cloudflared pods are running:
kubectl get pods -n cloudflare

Check the logs for errors:

kubectl logs -n cloudflare -l app=cloudflared

Verify the token in the secret is correct

502 Bad Gateway

The tunnel is working but can’t reach the backend service:

Verify the service URL in Cloudflare is correct

Check the service exists and has endpoints:

kubectl get svc,endpoints -n YOUR_NAMESPACE

Test connectivity from cloudflared pod:

kubectl exec -n cloudflare -it deploy/cloudflared -- wget -qO- http://SERVICE.NAMESPACE.svc.cluster.local:PORT

Connection Timeouts

Check if the service is responding slowly
Increase timeout in Cloudflare tunnel settings
Verify there are no NetworkPolicies blocking traffic

DNS Not Resolving

DNS propagation can take a few minutes
Verify the hostname is configured in the Cloudflare dashboard
Check that your domain’s nameservers point to Cloudflare

AI Prompts

Press ⌘+J to open the AI Assistant and use these prompts:

Basic Cloudflare Tunnel Stack

Create a stack to deploy Cloudflare Tunnel. I have a tunnel
token ready. Deploy cloudflared with 2 replicas in a
cloudflare namespace.

Expose an Existing Service

I have a service called api-server in the default namespace
on port 8080. Help me set up Cloudflare Tunnel to expose it.

Production Tunnel Setup

Create a production-ready Cloudflare Tunnel deployment with:
- 3 replicas spread across nodes
- Resource limits
- Health checks
- Pod disruption budget

Troubleshoot Tunnel Issues

My Cloudflare Tunnel shows as inactive in the dashboard.
Help me troubleshoot why the cloudflared pods aren't
connecting.

The AI provides recommendations for your Stack. Just describe your tunnel setup and which services you want to expose, then build based on the guidance.

Next Steps

SOPS Encryption

Encrypt secrets in your Stacks before pushing to Git.

Cloudflare Access

Add zero-trust access controls to your services.

Stack Builder

Learn more about building and managing Stacks.

GitOps Sync

Store your tunnel configuration in Git.

Monitoring Stack

Expose Grafana via Cloudflare Tunnel.

Get Started

Concepts

Provision & Import

Operate & Secure

Deliver

Platform

AI

Kubernetes Resources

Reference

Integrations

AI Prompts

Why Cloudflare Tunnel?

Prerequisites

Step 1: Create a Cloudflare Tunnel

Step 2: Create the Stack in Ankra

Step 3: Deploy and Verify

Configuring Routes

Adding a New Route

Service URL Format

Multiple Services

High Availability

Encrypting Secrets with SOPS

Enable SOPS Encryption

How It Works

Example Encrypted Manifest

Access Controls

Troubleshooting

AI Prompts

Next Steps

SOPS Encryption

Cloudflare Access

Stack Builder

GitOps Sync

Monitoring Stack

AI Prompts

​Why Cloudflare Tunnel?

​Prerequisites

​Step 1: Create a Cloudflare Tunnel

​Step 2: Create the Stack in Ankra

​Step 3: Deploy and Verify

​Configuring Routes

​Adding a New Route

​Service URL Format

​Multiple Services

​High Availability

​Encrypting Secrets with SOPS

​Enable SOPS Encryption

​How It Works

​Example Encrypted Manifest

​Access Controls

​Troubleshooting

​AI Prompts

​Next Steps

SOPS Encryption

Cloudflare Access

Stack Builder

GitOps Sync

Monitoring Stack

Why Cloudflare Tunnel?

Prerequisites

Step 1: Create a Cloudflare Tunnel

Step 2: Create the Stack in Ankra

Step 3: Deploy and Verify

Configuring Routes

Adding a New Route

Service URL Format

Multiple Services

High Availability

Encrypting Secrets with SOPS

Enable SOPS Encryption

How It Works

Example Encrypted Manifest

Access Controls

Troubleshooting

AI Prompts

Next Steps