An open source Kubernetes controller

Connect your services
through Cloudflare.

Manage tunnels, DNS, and Access with Kubernetes resources. cfgate keeps your Cloudflare configuration in sync as your services change.

Get started Explore the project

Operator v0.2.0-alpha.7 Helm chart v1.6.0 Releases ↗ Project ↗

Saved release information · 2026-10-02

How cfgate works

You define the configuration; cfgate keeps it in sync.

01

Configure .

Describe tunnels, routes, and DNS records with Kubernetes resources alongside your service configuration.

Configuration you can version in Git
02

Secure .

Choose which routes require Cloudflare Access and attach policies to their applications. Public routes can stay public.

Access protection where you need it
03

Deploy .

cfgate runs the tunnel connectors and applies your Cloudflare configuration, then reconciles changes over time.

Ongoing configuration management

Access protection is opt-in. For strict authentication, enforce it at your origin too. Read the protection guide

From configuration to infrastructure

A route with a clear destination.

This HTTPRoute sends app.example.com to the web Service. cfgate translates it into tunnel ingress configuration.

route.yaml

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: web
spec:
  parentRefs:
    - name: public
  hostnames:
    - app.example.com
  rules:
    - backendRefs:
        - name: web
          port: 8080

app.example.com cloudflared web:8080

Route: The hostname and backend come from your HTTPRoute.
DNS: A CloudflareDNS resource publishes the hostname through your tunnel.
Optional Access: Add an Access application and policies, then explicitly require protection on the route. Public routes need no Access configuration.

Example fragment: assumes an existing cfgate Gateway named public, an attached tunnel, and a web Service in the same namespace. DNS is managed separately with CloudflareDNS.

Browse complete examples ↗ Access configuration guide ↗

Fits your Kubernetes workflow

Configuration in Git

Review Cloudflare configuration changes alongside your service manifests using your existing Git workflow.

Familiar building blocks

Use Gateway API routes, Kubernetes resources, and the deployment tools you already know.

Built in the open

Read the code, report an issue, or contribute under the Apache 2.0 license.

Getting started

Connect your first service.

Install the controller, add your Cloudflare credentials, and connect your first service. The quick start walks you through it.

Installation guide

Install with Helm

helm install cfgate oci://ghcr.io/cfgate/charts/cfgate \
  --namespace cfgate-system --create-namespace

Requires Kubernetes, Gateway API CRDs, and Cloudflare credentials. See the guide for supported versions and setup.

Help improve cfgate.

Share your experience, report a bug, or contribute a change. Feedback from real deployments helps guide the project.

Contribute Open an issue

Connect your services through Cloudflare.