skills.rest
kettleofketchup
kettleofketchupCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

cloudflare

Expose Kubernetes services via Cloudflare Tunnel with dual-route access control.

Updated Apr 3, 2026
Search Tags:#kubernetes#cloudflare#access-control#traefik#service-tokens#dns-management#cloudflare-tunnel
One-click install
npx skills add https://github.com/kettleofketchup/KettleOfSkills --skill cloudflare-kettleofketchup
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cloudflare
Source: https://github.com/kettleofketchup/KettleOfSkills/tree/main/plugins/cloudflare/skills/cloudflare
Command: npx skills add https://github.com/kettleofketchup/KettleOfSkills --skill cloudflare-kettleofketchup

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Manually exposing Kubernetes services to the internet requires opening inbound cluster ports, configuring disjointed access controls for human users and machine services, and managing tunnel connections and DNS records by hand, which is error-prone and creates unnecessary security risks.

Core Features & Use Cases

  • Cloudflare Tunnel Deployment: Set up high-availability cloudflared deployments on Kubernetes to expose services without any inbound ports open on the cluster, using outbound-only connections.
  • Dual-Route Access Control: Configure Traefik IngressRoutes to route human user traffic through Authentik forwardAuth for identity verification, while allowing machine services to authenticate via Cloudflare Access Service Tokens, with clear separation between the two traffic paths.
  • DNS and Access Policy Management: Automate creation of Cloudflare DNS CNAME records for tunnel hostnames, set up Access applications and service token policies, and troubleshoot common issues like misconfigured access decisions or tunnel connectivity failures.
  • Use Case: For a homelab Kubernetes cluster running services like Grafana and Foundry VTT, use this skill to expose Grafana to your team via Authentik login while allowing internal game services to authenticate with service tokens, all without exposing any inbound ports on your home network.

Quick Start

Use the cloudflare skill to configure a dual-route IngressRoute for your Grafana service that routes human users to Authentik forwardAuth and machine services via Cloudflare Access Service Tokens, then create the required Cloudflare DNS CNAME record to expose it via tunnel.

Frequently Asked Questions about cloudflare

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I expose Kubernetes services to the internet without opening inbound ports?▼

You can expose Kubernetes services securely using Cloudflare Tunnel, which creates outbound-only connections from your cluster to Cloudflare's network, eliminating the need to open inbound ports on your firewall.

How does Traefik dual-route routing work with Cloudflare Access Service Tokens?▼

Traefik dual-route routing separates traffic by routing human users through Authentik forwardAuth for identity verification, while machine services authenticate directly via Cloudflare Access Service Tokens using JWT headers.

Can I automate Cloudflare DNS CNAME record creation for Kubernetes tunnel hostnames?▼

Yes, you can automate the creation and lifecycle management of Cloudflare DNS CNAME records for tunnel hostnames, ensuring Cloudflare-proxied hostnames stay synchronized with your exposed services.

What's the best way to configure per-service access policies for a Kubernetes homelab?▼

For a Kubernetes homelab, configure per-service access policies by setting up Cloudflare Access applications and service token policies, allowing tools like Grafana to require Authentik login for humans and service tokens for machines.

Why are my Cloudflare Access decisions misconfigured or failing to route traffic correctly?▼

Misconfigured Cloudflare Access decisions often stem from incorrect service token policy setup or misrouted Traefik IngressRoutes, which can be troubleshooted by verifying JWT header-based traffic routing and access application configuration.

Do I need Authentik to use Cloudflare Tunnel with Kubernetes for human identity verification?▼

Authentik forwardAuth is used in this setup to verify human user identity through Traefik IngressRoutes, while Cloudflare Access Service Tokens handle machine authentication, providing clear separation between the two traffic paths.

Related Skills

Explore More Software Engineering Skills→
kettleofketchupkettleofketchup

authentik

Deploy and manage Authentik identity provider on Kubernetes clusters.

Community
Advanced
mrudmrud

zrok

Expose local services over secure self-hosted tunnels with public and private sharing.

Community
Advanced
ViktorBarzinViktorBarzin
5

traefik-udp-cross-namespace

Configure Traefik v3 Helm deployments to expose UDP entrypoints and allow cross-namespace IngressRouteUDP references.

Community
Advanced
gilesknapgilesknap
32

cloudflare

Expose K3s services via Cloudflare Tunnel and Access policies.

Community
Advanced