provider-cloudflare v0.14.0

v0.14.0 Release Notes

Release Date: January 5, 2026
Repository: provider-cloudflare
Docker Image: ghcr.io/rossigee/provider-cloudflare:v0.14.0

---

Overview

v0.14.0 includes new functionality for Zero Trust security, remote access, and device management.

Also, various other updates including updating Golang to 1.25.5.

---

New Features

1. Zero Trust Access (AccessApplication)

Manage Cloudflare Zero Trust access applications with full authentication policy support.

API: access.cloudflare.m.crossplane.io/v1beta1

Resource: AccessApplication

Capabilities:

• Create and manage Zero Trust access applications
• Configure authentication policies and IdP integrations
• Set session duration and security policies
• Support for self-hosted and SaaS applications
• CORS header configuration
• Custom branding and logos
• Application policy management

Example:

apiVersion: access.cloudflare.m.crossplane.io/v1beta1
kind: AccessApplication
metadata:
  name: admin-dashboard
  namespace: default
spec:
  forProvider:
    accountId: "your-account-id"
    name: "Admin Dashboard"
    domain: "admin.example.com"
    type: "self_hosted"
    sessionDuration: "24h"
    allowedIdps: ["your-idp-id"]
    skipInterstitial: false
  providerConfigRef:
    name: default

Documentation: See examples/access/ directory for complete usage examples.

---

2. Cloudflare Tunnel (Tunnel)

Manage Cloudflare Tunnel (Argo) connections for secure remote access to internal resources.

API: tunnel.cloudflare.m.crossplane.io/v1beta1

Resource: Tunnel

Capabilities:

• Create and manage Cloudflare Tunnel connections
• Configure tunnel secrets and authentication
• Support for local and remote tunnel configuration
• Metadata and tagging support
• Full lifecycle management (create, update, delete)
• Secure secret generation and rotation

Example:

apiVersion: tunnel.cloudflare.m.crossplane.io/v1beta1
kind: Tunnel
metadata:
  name: office-tunnel
  namespace: default
spec:
  forProvider:
    accountId: "your-account-id"
    name: "Office Tunnel"
    tunnelSecret: "base64-encoded-secret"
    configSrc: "local"
    metadata:
      environment: "production"
      location: "office"
  providerConfigRef:
    name: default

Documentation: See examples/tunnel/ directory for complete usage examples.

---

3. Device Posture Rules (DevicePostureRule)

Enforce device security compliance with Cloudflare Device Posture rules.

API: device.cloudflare.m.crossplane.io/v1beta1

Resource: DevicePostureRule

Capabilities:

• Define device posture requirements (OS version, compliance status, etc.)
• Enforce security policies for endpoint devices
• Schedule periodic compliance checks
• Configure expiration and escalation policies
• Support multiple device platforms (Windows, macOS, Linux)
• Flexible matching criteria for device characteristics

Example:

apiVersion: device.cloudflare.m.crossplane.io/v1beta1
kind: DevicePostureRule
metadata:
  name: corporate-device-rule
  namespace: default
spec:
  forProvider:
    accountId: "your-account-id"
    name: "Corporate Devices"
    type: "os_version"
    description: "Ensure devices are running approved OS versions"
    schedule: "5m"
    expiration: "24h"
    input:
      os: "windows"
      operator: ">="
      version: "10.0.19043"
    match:
      platform: "windows"
  providerConfigRef:
    name: default

Documentation: See examples/device/ directory for complete usage examples.

---

📈 Improvements

Dependency Updates

• Go: Updated from 1.25.3 → 1.25.5 (bug fixes and security patches)
• golangci-lint: Updated from 2.5.0 → 2.7.2 (improved linting rules)

Documentation Enhancements

• ✅ Updated README with enterprise feature descriptions
• ✅ Added supported APIs section highlighting new resources
• ✅ Enhanced installation and configuration guides
• ✅ Comprehensive usage examples for all new features

CI/CD Pipeline

• ✅ Updated workflow versions to match latest tooling
• ✅ Improved build consistency across all platforms
• ✅ Enhanced security scanning in release pipeline

No breaking changes - All existing resources remain fully compatible