77 lines
2.3 KiB
YAML
77 lines
2.3 KiB
YAML
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: cloudflared
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: cloudflared
|
|
replicas: 0
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: cloudflared
|
|
spec:
|
|
nodeName: k3s-control
|
|
containers:
|
|
- name: cloudflared
|
|
image: cloudflare/cloudflared:2022.8.2-arm64
|
|
args:
|
|
- tunnel
|
|
# Points cloudflared to the config file, which configures what
|
|
# cloudflared will actually do. This file is created by a ConfigMap
|
|
# below.
|
|
- --config
|
|
- /etc/cloudflared/config/config.yaml
|
|
- run
|
|
livenessProbe:
|
|
httpGet:
|
|
# Cloudflared has a /ready endpoint which returns 200 if and only if
|
|
# it has an active connection to the edge.
|
|
path: /ready
|
|
port: 2000
|
|
failureThreshold: 1
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/cloudflared/config
|
|
readOnly: true
|
|
# Each tunnel has an associated "credentials file" which authorizes machines
|
|
# to run the tunnel. cloudflared will read this file from its local filesystem,
|
|
# and it'll be stored in a k8s secret.
|
|
- name: creds
|
|
mountPath: /etc/cloudflared/creds
|
|
readOnly: true
|
|
volumes:
|
|
- name: creds
|
|
secret:
|
|
secretName: tunnel-credentials
|
|
- name: config
|
|
configMap:
|
|
name: cloudflared
|
|
items:
|
|
- key: config.yaml
|
|
path: config.yaml
|
|
---
|
|
# This ConfigMap is just a way to define the cloudflared config.yaml file in k8s.
|
|
# It's useful to define it in k8s, rather than as a stand-alone .yaml file, because
|
|
# this lets you use various k8s templating solutions (e.g. Helm charts) to
|
|
# parameterize your config, instead of just using string literals.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cloudflared
|
|
data:
|
|
config.yaml: |
|
|
tunnel: mc-invites
|
|
credentials-file: /etc/cloudflared/creds/credentials.json
|
|
metrics: 0.0.0.0:2000
|
|
no-autoupdate: true
|
|
ingress:
|
|
- hostname: tunnel.gmem.ca
|
|
service: http://hue:80
|
|
# This rule matches any traffic which didn't match a previous rule, and responds with HTTP 404.
|
|
- service: http_status:404
|