KFlared v0.0.9

This release adds private Cloudflare Tunnel routing for Kubernetes Services and supports deployments with a single cloudflared connector.

Highlights

• Introduces CloudflareTunnelPrivateRoute for routing a Service ClusterIP privately to enrolled Cloudflare One clients.
• Adds private-route reconciliation, status conditions, cleanup behavior, validation, samples, and RBAC support.
• Allows providers used only for private routes to omit allowed DNS zones.
• Supports a single cloudflared connector without requiring a disruption budget.
• Updates chart and application metadata for this release.

Commits

• ce2f9c6 feat: add private Cloudflare Tunnel routes for Services
• ad84a42 fix: satisfy lint checks for private routes
• b87378b feat: allow single cloudflared connector without disruption budget
• 2e2e08e test: satisfy single connector CI lint checks
• 3da2e13 test: fix finalization resource assertion after PDB removal
• b7e2c5c feat: bump chart version to 0.0.9 and app version to 0.0.9

Full changelog

Compare v0.0.8...v0.0.9

KFlared chart v0.0.9

This release adds private Cloudflare network routes for Kubernetes Services and supports providers dedicated to private routes without published hostnames.

Highlights

• Introduces the CloudflareTunnelPrivateRoute resource for routing Service IPv4 addresses through Cloudflare Tunnel.
• Supports cross-namespace Service references and validates that the requested Service port exists.
• Allows a single cloudflared connector and removes disruption-budget management for single-connector deployments.
• Adds cleanup controls for private routes, including Delete and Retain policies.
• Updates permissions, schemas, and helper roles for private-route resources.

Commits

• ce2f9c6 feat: add private Cloudflare Tunnel routes for Services
• b87378b feat: allow single cloudflared connector without disruption budget
• b7e2c5c feat: bump chart version to 0.0.9 and app version to 0.0.9

Full changelog

Compare chart-v0.0.8...chart-v0.0.9

KFlared v0.0.8

This release adds per-binding control over ExternalDNS automation for Cloudflare tunnel bindings. DNS automation remains enabled by default, while bindings can opt out and remain ready with externally managed DNS targets.

Highlights

• Added the dnsAutomationEnabled binding field, defaulting to true.
• Disabled automation removes binding-owned DNSEndpoint resources without changing tunnel ingress or connector resources.
• Opted-out bindings report DNS automation as intentionally disabled, clear managed DNS status, and can become ready without managed public DNS.
• Updated binding status and documentation to distinguish programmed tunnel hostnames from managed DNS records.
• Raised the application and chart release values to 0.0.8.

Commits

• 225d6ad feat(binding): make DNS automation optional
• 68f6879 test(binding): satisfy DNS opt-out linters
• 1675ff2 feat: bump chart version to 0.0.8 and app version to 0.0.8

Full changelog

Compare v0.0.7...v0.0.8

KFlared chart v0.0.8

This release makes DNS automation optional for Cloudflare Tunnel bindings.

Highlights

• Added a DNS automation setting, enabled by default, for controlling creation of ExternalDNS records for accepted HTTPRoute hostnames.
• Updated the Helm chart and application release metadata.

Commits

• 225d6ad feat(binding): make DNS automation optional
• 1675ff2 feat: bump chart version to 0.0.8 and app version to 0.0.8

Full changelog

Compare chart-v0.0.7...chart-v0.0.8

KFlared v0.0.7

This release ensures managed tunnel DNS records are marked for Cloudflare proxying and repairs existing records when their proxy metadata is incorrect.

Highlights

• Managed DNS endpoints now include Cloudflare proxy metadata.
• Reconciliation restores proxying when existing DNS records are unproxied.
• DNS endpoint behavior is covered by expanded controller tests.

Commits

• abf8054 fix(controller): proxy managed tunnel DNS records
• d222a0a test(controller): extract DNS endpoint helpers
• 93567bd feat: bump app version to 0.0.7

Full changelog

Compare v0.0.6...v0.0.7

KFlared v0.0.6

This release adds optional chart-managed Cloudflare providers and improves connector health monitoring.

Highlights

• Charts can optionally create a cluster-scoped provider with configurable account, DNS zones, credentials, and namespace access.
• Connector readiness continues to require an active tunnel connection, while liveness now uses a separate health check.
• Installation guidance and deployment configuration cover enabling and safely removing chart-managed providers.

Commits

• 7780bfb feat(chart): optionally create Cloudflare provider
• 4b2d7a8 fix(controller): separate connector liveness from readiness
• bbc34a6 feat: bump app version to 0.0.6

Full changelog

Compare v0.0.5...v0.0.6

KFlared chart v0.0.7

This release adds optional creation of a cluster-scoped Cloudflare provider through the Helm chart, with configurable credentials, DNS zones, provider naming, and namespace binding selection.

Highlights

• Provider creation is disabled by default and derives the controller reference from the configured controller class.
• Credential Secret names default to the chart’s External Secrets target, supporting both managed and manually created Secrets.
• Configuration validation requires an account identifier, token key, and at least one allowed DNS zone when enabled.
• Namespace selectors can restrict bindings or intentionally allow bindings from every namespace.
• Provider deletion can remain blocked while referenced tunnel bindings exist.

Commits

• 7780bfb feat(chart): optionally create Cloudflare provider
• 78b3b55 feat: bump chart version to 0.0.7

Full changelog

Compare chart-v0.0.6...chart-v0.0.7

KFlared v0.0.5

This release allows Cloudflare tunnel origins to use Services in another namespace when authorized by a matching Gateway API ReferenceGrant, with validation and fail-closed reconciliation.

Highlights

• Added per-binding origin Service namespace selection, defaulting to the binding namespace.
• Cross-namespace origins require an appropriate ReferenceGrant; revocation deprograms tunnel ingress and removes managed DNS.
• Only internal ClusterIP origin Services are accepted; headless, ExternalName, NodePort, and LoadBalancer Services are rejected.
• Renamed the binding field from gatewayServiceRef to originServiceRef, requiring manifest migration.
• Added validation, reconciliation coverage, documentation, and configuration samples for cross-namespace origins.

Commits

• cc10592 feat(controller): support cross-namespace tunnel origins
• 05b7270 feat: bump chart version to 0.0.6 and app version to 0.0.5

Full changelog

Compare v0.0.4...v0.0.5

KFlared chart v0.0.6

This release enables tunnel origins to reference services in another namespace. The origin service reference is now explicitly named and accepts an optional namespace, defaulting to the CloudflareTunnelBinding namespace when omitted.

Highlights

• Cross-namespace tunnel origin service references are supported.
• Origin service references now include an optional namespace field.
• Required resource validation uses the renamed origin service reference.

Commits

• cc10592 feat(controller): support cross-namespace tunnel origins
• 05b7270 feat: bump chart version to 0.0.6 and app version to 0.0.5

Full changelog

Compare chart-v0.0.5...chart-v0.0.6

KFlared v0.0.4

This release adds controller-class partitioning, requiring managers and owned resources to use matching, immutable classes. It also expands controller permissions to update provider and binding resources for finalizer management.

Highlights

• Managers now require a non-empty controller class and reconcile only matching providers and bindings.
• Provider and binding resources require an immutable controller field, with class-specific leader election to support multiple installations.
• Helm deployments require an explicit controller class, while the bundled manager configuration uses kflared.
• Existing resources can be backfilled after CRD upgrades before the new manager is started.
• Controller permissions now allow updates to provider and binding resources for finalizer handling.

Commits

• 31ab813 fix(chart): allow Helm global values
• d529a9c fix(rbac): allow controllers to manage finalizers
• 546ad90 feat(controller): require controller class partitioning
• ef5775d fix(chart): default controller class
• eedb81e fix(test): wait for CRD schema propagation
• 294a0dd feat: bump chart version to 0.0.5 and app version to 0.0.4

Full changelog

Compare v0.0.3...v0.0.4