🧑‍💻 Who’s using cloudflare-tunnel-ingress-controller?

[STRRL]

Hi everyone!

If you’re using cloudflare-tunnel-ingress-controller in your projects, whether in production or just for testing, feel free to share a comment below. I’d love to hear from you!

You can include:

• 🏷️ Name of your organization/project/personal setup (optional)
• 🌍 How you’re using it (optional)
• ⚙️ Your setup (optional)
• 💬 Any feedback, suggestions, or appreciation (optional too!)

This helps the community:

• Know how this tool is being used
• Share use cases, pain points, or cool hacks
• Encourage maintenance and future improvements

Thanks 🙏 and happy tunneling!

For example, that's my usecase 🤣

Name: Zhiqiang ZHOU @ STRRL Cloud (that's my awesome cloud, lol)
Use case: personal usage, expose jellyfin.strrl.cloud to the public
Setup: minikube inside a mac mini
Feedback: works well so far, it would be much better if there is a dashboard

Or, take our short community survey (about 2 minutes):

👉 https://forms.gle/GqZomrLdb1vzyVJDA

[GideonStowell]

@STRRL
I am using cloudflare tunnels to exposed business internal services to our employees without using a vpn. They can go to a to a public dns name and get access to private services.

Many of these public services run in our k8s cluster so I wanted to find an ingress controller to use so I didn't have to add the tunnel and forwarding address manually everytime we stood up a new service.

I just attempted to use this in a test environment and it mostly worked well except for one problem: I can't seem to share cloudflare tunnel across many services. In my existing configuration I have a single cloudflared deployment that has several public dns names associated with it. When i tried to add my new public hostname with this cloudflare ingress controller, it removed all existing entries and replaced them all with the single entry as defined in the cloudflare ingress config. I've been unable to a find an 'append' flag for this controller, but that would be my feature request if it does not exist.

The amazon load balancer controller can operate in this way too, you can create a "group" and have several ingresses all connect through the same load balancer, eliminating the need to have multiple load balancers.

Similarly I want to have a single cloudflare tunnel that can route many public hostnames through it

Environment info:
AWS EKS
Ecommerce Saas business
Helmfile

[ky-bd]

I am using cloudflare-tunnel-ingress-controller to expose my Kanidm instance running on my homelab. Here is the manifest. Most of my services are behind the Tailscale VPN, however it's not the case for the idm, since I would like to use OIDC to authenticate users to the VPN before they can connect to it.

Setup: Self-hosted K3s cluster on PVE VMs
Feedback: Add document about the annotations (at least, mention them in the README). I was about to suggest adding support for connecting to HTTPS backend (Kanidm does not accept plain HTTP connections), until I go through the source code and find that it's already implemented and could be set up with annotations.

Thank you for your awesome work!

[HrBingR]

🏷️ Name of my organization/project/personal setup (optional):

Entirely for personal use within a small k3s single-node setup.

🌍 How I'm using it (optional):

It's fantastic for automating the creation of cloudflared tunnels. Takes care of all of the routing for me, which fits my use-case perfectly as I used to have to do everything manually.

⚙️ My setup (optional):

I used to run a docker environment on an old mini-pc, but started struggling with it's 4GB RAM, resulting in a lot of swapping.

So I took it as a learning opportunity to get more into kubernetes and built a single-node K3S instance on more powerful hardware, making use of this ingress controller to expose relevant services to the internet.

For anything I want protected, I use Cloudflare Access which I've linked both to my Azure and Keycloak as my IDP/IAM providers with 2FA.

Currently I run and expose:

• Rancher, to manage my K3S instance graphically.
• A php-apache instance to serve one or two public websites.
• Audiobookshelf
• BookHaven
• IT-Tools
• Keycloak
• Navidrome
• Owncloud
• Syncthing
• Some nginx instances to serve one or two websites.
• A few redis and DB instances for the above.

It's a tiny setup especially compared to some but it serves me quite well.

💬 Any feedback, suggestions, or appreciation (optional too!):

Suggestion: Some ingress annotations to support protecting apps behind Cloudflare Access, IE an annotation for name, type of app (self-hosted etc), and policies that should be applied to said app.

That way this ingress controller would automate absolutely everything I personally use it for.

[itspacchu]

Use case: Personally using it for exposing my homelab things and my website using this.

( Works way better than my previous setup which included a hacky Service watchers and exposing nodeport through Nginx VPN mess lol. )

Setup: Dedicated Linux Box as a PC.

Feedback: No Issues yet works really well!
Is there a plan to support newly introduced Gateway API?

[jeremy-morren]

Use case: Ingress for on-premises k3s cluster. Removes need to setup firewall ports and TLS certificates.

[joelcox22]

Use case: in my homelab, just to expose my argocd /api/webhook route on a public URL so that I can make it accessible to receive webhook events from github to trigger the argocd sync process when my gitops repository has changes.

Feedback: Works great, it's good to be able to provide a path prefix that gets applied on the cloudflare side of things before requests reach my homelab, rather than just in the ingress controller. thanks for making this 👍🏻

I don't strictly need gateway API support, but everything else in my homelab uses gateway API, so gave a 👍🏻 to the issue asking if people want that.