Terraform deploy Cloudflare Tunnel on K8s

gistfile1.txt

resource "random_password" "tunnel_secret" {
  count  = local.is_mgnt_env ? 1 : 0
  length = 64
}

# Creates a new locally-managed tunnel for the GCP VM.
resource "cloudflare_tunnel" "auto_tunnel" {
  count      = local.is_mgnt_env ? 1 : 0
  account_id = var.CF_ACCOUNT_ID
  name       = "Terraform MGNT Tunnel"
  secret     = base64sha256(random_password.tunnel_secret[0].result)
}

resource "cloudflare_record" "harbor_registry" {
  count   = local.is_mgnt_env ? 1 : 0
  zone_id = var.CF_ZONE_ID
  name    = "registry"
  value   = cloudflare_tunnel.auto_tunnel[0].cname
  type    = "CNAME"
  proxied = true
}

## Begin deploy on k8s
resource "kubernetes_namespace" "cloudflared" {
  count = local.is_mgnt_env ? 1 : 0
  metadata {
    name        = "cloudflared"
    annotations = {}
    labels      = {}
  }
}

resource "kubernetes_config_map" "cloudflared" {
  count = local.is_mgnt_env ? 1 : 0
  metadata {
    name      = "cloudflared"
    namespace = kubernetes_namespace.cloudflared[0].metadata[0].name
  }

  data = {
    "config.yaml" = <<EOT
tunnel: ${cloudflare_tunnel.auto_tunnel[0].id}
credentials-file: /etc/cloudflared/creds/credentials.json
metrics: 0.0.0.0:2000
no-autoupdate: true
ingress:
  - hostname: example.domain.com
    path: /
    service: service-name
  - service: http_status:404
EOT
  }
  depends_on = [cloudflare_tunnel.auto_tunnel]
}

resource "kubernetes_secret" "cloudflared" {
  count = local.is_mgnt_env ? 1 : 0
  metadata {
    name      = "cloudflared"
    namespace = kubernetes_namespace.cloudflared[0].metadata[0].name
  }

  data = {
    "credentials.json" = jsonencode({
      "AccountTag"   = var.CF_ACCOUNT_ID,
      "TunnelID"     = cloudflare_tunnel.auto_tunnel[0].id,
      "TunnelName"   = cloudflare_tunnel.auto_tunnel[0].name,
      "TunnelSecret" = base64sha256(random_password.tunnel_secret[0].result)
    })
  }

  type = "kubernetes.io/secret"

  depends_on = [cloudflare_tunnel.auto_tunnel]
}


resource "kubernetes_deployment" "cloudflared" {
  count = local.is_mgnt_env ? 1 : 0
  metadata {
    name      = "cloudflared"
    namespace = kubernetes_namespace.cloudflared[0].metadata[0].name
  }

  spec {
    replicas = 2

    selector {
      match_labels = {
        app = "cloudflared"
      }
    }

    template {
      metadata {
        labels = {
          app = "cloudflared"
        }
      }

      spec {
        volume {
          name = "creds"
          secret {
            secret_name = "cloudflared"
          }
        }

        volume {
          name = "config"
          config_map {
            name = "cloudflared"
          }
        }

        container {
          image = "cloudflare/cloudflared:2023.10.0"
          name  = "cloudflared"
          args  = ["tunnel", "--config", "/etc/cloudflared/config/config.yaml", "run"]

          liveness_probe {
            http_get {
              path = "/ready"
              port = 2000
            }

            initial_delay_seconds = 1
            period_seconds        = 10
            failure_threshold     = 1
          }

          volume_mount {
            name       = "config"
            mount_path = "/etc/cloudflared/config"
            read_only  = true
          }

          volume_mount {
            name       = "creds"
            mount_path = "/etc/cloudflared/creds"
            read_only  = true
          }
        }
      }
    }
  }
  depends_on = [kubernetes_config_map.cloudflared, kubernetes_secret.cloudflared, kubernetes_namespace.cloudflared]
}