Skip to content

Commit 701e532

Browse files
xnotoxnoto
committed
refactor: consolidate HTTP tunnels to operator-managed cluster-apps tunnel
- Remove per-app tunnel resources (argocd, grafana, uptime_kuma, awx) - Import cluster-apps tunnel created by cloudflare-operator - Update DNS CNAMEs to point to consolidated tunnel - Add lifecycle ignore_changes to prevent Terraform from modifying operator-managed tunnel - Simplify outputs to cluster_apps and warp tunnel IDs
1 parent b1e70f2 commit 701e532

4 files changed

Lines changed: 26 additions & 36 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,7 @@ No modules.
4141
| [cloudflare_zero_trust_access_group.admins](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_group) | resource |
4242
| [cloudflare_zero_trust_access_identity_provider.github](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_identity_provider) | resource |
4343
| [cloudflare_zero_trust_organization.main](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_organization) | resource |
44-
| [cloudflare_zero_trust_tunnel_cloudflared.argocd](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_tunnel_cloudflared) | resource |
45-
| [cloudflare_zero_trust_tunnel_cloudflared.awx](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_tunnel_cloudflared) | resource |
46-
| [cloudflare_zero_trust_tunnel_cloudflared.grafana](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_tunnel_cloudflared) | resource |
47-
| [cloudflare_zero_trust_tunnel_cloudflared.uptime_kuma](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_tunnel_cloudflared) | resource |
44+
| [cloudflare_zero_trust_tunnel_cloudflared.cluster_apps](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_tunnel_cloudflared) | resource |
4845
| [cloudflare_zero_trust_tunnel_cloudflared.warp](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_tunnel_cloudflared) | resource |
4946
| [cloudflare_zero_trust_tunnel_cloudflared_route.private_network](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_tunnel_cloudflared_route) | resource |
5047
| [cloudflare_zone_setting.brotli](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zone_setting) | resource |

‎cf-tunnels.tf‎

Lines changed: 22 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,68 +1,63 @@
11
# Cloudflare Tunnels for OpenShift workloads
22
# Tunnels connect cloudflared pods to Cloudflare edge network
33
#
4-
# Tunnel credentials are managed separately in kustomize-cluster via SOPS/KSOPS.
4+
# The cluster-apps tunnel is managed by cloudflare-operator in OpenShift.
5+
# Tunnel credentials are managed in kustomize-cluster via SOPS/KSOPS.
6+
# DNS records are managed here to point to the consolidated tunnel.
57

68
# =============================================================================
7-
# HTTP Tunnels (ingress-based)
9+
# Consolidated HTTP Tunnel (managed by cloudflare-operator)
810
# =============================================================================
911

10-
# ArgoCD tunnel
11-
resource "cloudflare_zero_trust_tunnel_cloudflared" "argocd" {
12+
# Consolidated tunnel for all HTTP workloads
13+
# Lifecycle managed by cloudflare-operator ClusterTunnel resource in OpenShift
14+
# Import: tofu import cloudflare_zero_trust_tunnel_cloudflared.cluster_apps 03f750691b4ad4d59aa4b7205adaa108/1ac3a39c-7d97-422e-88e5-1f82b6334bbb
15+
resource "cloudflare_zero_trust_tunnel_cloudflared" "cluster_apps" {
1216
account_id = local.account_id
13-
name = "argocd"
17+
name = "cluster-apps"
18+
19+
lifecycle {
20+
# Tunnel is managed by cloudflare-operator, prevent Terraform from modifying/deleting
21+
ignore_changes = all
22+
}
1423
}
1524

25+
# =============================================================================
26+
# DNS Records (pointing to consolidated tunnel)
27+
# =============================================================================
28+
1629
resource "cloudflare_dns_record" "argocd_tunnel" {
1730
zone_id = local.zone_id
1831
type = "CNAME"
1932
name = "argocd"
20-
content = "${cloudflare_zero_trust_tunnel_cloudflared.argocd.id}.cfargotunnel.com"
33+
content = "${cloudflare_zero_trust_tunnel_cloudflared.cluster_apps.id}.cfargotunnel.com"
2134
proxied = true
2235
ttl = 1
2336
}
2437

25-
# Grafana tunnel
26-
resource "cloudflare_zero_trust_tunnel_cloudflared" "grafana" {
27-
account_id = local.account_id
28-
name = "grafana"
29-
}
30-
3138
resource "cloudflare_dns_record" "grafana_tunnel" {
3239
zone_id = local.zone_id
3340
type = "CNAME"
3441
name = "grafana"
35-
content = "${cloudflare_zero_trust_tunnel_cloudflared.grafana.id}.cfargotunnel.com"
42+
content = "${cloudflare_zero_trust_tunnel_cloudflared.cluster_apps.id}.cfargotunnel.com"
3643
proxied = true
3744
ttl = 1
3845
}
3946

40-
# Uptime Kuma tunnel (status.makeitwork.cloud)
41-
resource "cloudflare_zero_trust_tunnel_cloudflared" "uptime_kuma" {
42-
account_id = local.account_id
43-
name = "uptime-kuma"
44-
}
45-
4647
resource "cloudflare_dns_record" "status_tunnel" {
4748
zone_id = local.zone_id
4849
type = "CNAME"
4950
name = "status"
50-
content = "${cloudflare_zero_trust_tunnel_cloudflared.uptime_kuma.id}.cfargotunnel.com"
51+
content = "${cloudflare_zero_trust_tunnel_cloudflared.cluster_apps.id}.cfargotunnel.com"
5152
proxied = true
5253
ttl = 1
5354
}
5455

55-
# AWX tunnel (ansible.makeitwork.cloud)
56-
resource "cloudflare_zero_trust_tunnel_cloudflared" "awx" {
57-
account_id = local.account_id
58-
name = "awx"
59-
}
60-
6156
resource "cloudflare_dns_record" "ansible_tunnel" {
6257
zone_id = local.zone_id
6358
type = "CNAME"
6459
name = "ansible"
65-
content = "${cloudflare_zero_trust_tunnel_cloudflared.awx.id}.cfargotunnel.com"
60+
content = "${cloudflare_zero_trust_tunnel_cloudflared.cluster_apps.id}.cfargotunnel.com"
6661
proxied = true
6762
ttl = 1
6863
}

‎main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ locals {
1010

1111
# Private networks (CIDR protected via SOPS)
1212
warp_private_network = data.sops_file.secret_vars.data["warp_private_network"]
13+
1314
}
1415

1516
data "cloudflare_zone" "makeitwork_cloud" {

‎outputs.tf‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,7 @@
55
output "tunnel_ids" {
66
description = "Cloudflare Tunnel IDs for reference in kustomize-cluster ConfigMaps"
77
value = {
8-
argocd = cloudflare_zero_trust_tunnel_cloudflared.argocd.id
9-
grafana = cloudflare_zero_trust_tunnel_cloudflared.grafana.id
10-
uptime_kuma = cloudflare_zero_trust_tunnel_cloudflared.uptime_kuma.id
11-
awx = cloudflare_zero_trust_tunnel_cloudflared.awx.id
12-
warp = cloudflare_zero_trust_tunnel_cloudflared.warp.id
8+
cluster_apps = cloudflare_zero_trust_tunnel_cloudflared.cluster_apps.id
9+
warp = cloudflare_zero_trust_tunnel_cloudflared.warp.id
1310
}
1411
}

0 commit comments

Comments
 (0)