STRRL/cloudflare-tunnel-ingress-controller
Cloudflare Tunnel Ingress Controller
Este proyecto es un controlador de Kubernetes que automatiza la gestión de recursos de red orientados al público y la conectividad de ingress segura. Funciona observando definiciones de recursos personalizados para reconciliar el estado deseado del tráfico de red con la configuración real de los servicios internos.
El controlador gestiona la conectividad de red estableciendo túneles de salida seguros, lo que elimina el requisito de puertos de firewall de entrada tradicionales o reenvío de puertos. Se integra directamente con interfaces de gestión de nube externas para automatizar el ciclo de vida de estos túneles y sincronizar registros de dominio, asegurando que los servicios internos permanezcan accesibles desde internet.
El sistema proporciona una gestión de tráfico integral y visibilidad operativa al rastrear cambios de configuración y rendimiento del sistema a través de interfaces de registro y métricas estándar. Admite patrones de acceso de confianza cero (zero-trust) manteniendo conexiones seguras desde dentro del clúster a un gateway externo.
Features
- Cloudflare Tunnels - Automates the lifecycle of secure outbound tunnels to edge networks, eliminating the need for public IP addresses or port forwarding.
- Declarative Infrastructure Reconciliation - Continuously monitors and enforces the desired network state by reconciling cluster resource definitions with external infrastructure.
- Ingress Controllers - Acts as a network traffic manager that maps cluster services to public domains without opening inbound firewall ports.
- Kubernetes Controllers - Implements a control loop that observes cluster resource states and reconciles them to maintain network connectivity.
- Automated DNS Record Synchronization - Automatically synchronizes cluster resource states with external DNS provider records to keep services reachable.
- Declarative Infrastructure Provisioning - Automates the creation and updates of cloud network resources using declarative configuration files during the deployment lifecycle.
- Kubernetes Application Exposers - Exposes internal cluster services to the public web securely without requiring inbound firewall ports.
- Connection Lifecycle Managers - Automates the lifecycle of network tunnels and domain records to ensure persistent service reachability.
- Multiplexed - Multiplexes multiple network connections over a single secure outbound tunnel to bypass inbound firewall restrictions.
- Traffic Tunneling - Directs incoming requests to internal services via secure outbound tunnels, bypassing traditional inbound network exposure.
- Zero Trust Access - Enables secure access to private services through outbound tunnels, supporting zero-trust connectivity patterns.
