Skip to content

Commit da6f083

Browse files
ranbelranbel
committed
add GKE, httpbin, and tunnel token steps
1 parent b970e0f commit da6f083

File tree

2 files changed

+167
-53
lines changed

2 files changed

+167
-53
lines changed

‎src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/remote-tunnel-permissions.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ To get the token for a remotely-managed tunnel:
1717
<TabItem label="Dashboard">
1818
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Networks** > **Tunnels**.
1919
2. Select a `cloudflared` tunnel and select **Edit**.
20-
3. Copy `cloudflared` installation command.
20+
3. Copy the `cloudflared` installation command.
2121
4. Paste the installation command into any text editor. The token value is of the form `eyJhIjoiNWFiNGU5Z...`
2222

2323
</TabItem>

‎src/content/docs/cloudflare-one/connections/connect-networks/deployment-guides/kubernetes.mdx‎

Lines changed: 166 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 6
66
---
77

8-
[Kubernetes](https://kubernetes.io/) is a container orchestration tool that helps deploy applications onto physical or virtual machines, scale the deployment to meet traffic demands, and push updates without downtime. The Kubernetes cluster, or environment, where the application instances are running is connected internally through a private network. You can install the `cloudflared` daemon inside of the Kubernetes cluster in order to connect applications inside of the cluster to Cloudflare.
8+
[Kubernetes](https://kubernetes.io/) is a container orchestration tool that is used to deploy applications onto physical or virtual machines, scale the deployment to meet traffic demands, and push updates without downtime. The Kubernetes cluster, or environment, where the application instances are running is connected internally through a private network. You can install the `cloudflared` daemon inside of the Kubernetes cluster in order to connect applications inside of the cluster to Cloudflare.
99

1010
This guide will cover how to expose a Kubernetes service to the public Internet using a [remotely-managed](/cloudflare-one/connections/connect-networks/get-started/tunnel-useful-terms/#remotely-managed-tunnel) Cloudflare Tunnel. For the purposes of this example, we will deploy a basic web application alongside `cloudflared` in Google Kubernetes Engine (GKE). The same principles apply to any other Kubernetes environment (such as `minikube`, `kubeadm`, or a cloud-based Kubernetes service) where `cloudflared` can connect to Cloudflare's network.
1111

@@ -17,7 +17,7 @@ If you are looking to set up a [locally-managed tunnel](/cloudflare-one/connecti
1717

1818
![Diagram showing how a user connects to Kubernetes services through Cloudflare Tunnel](~/assets/images/cloudflare-one/connections/connect-apps/kubernetes-tunnel.png)
1919

20-
As shown in the diagram, we recommend setting up `cloudflared` as an adjacent [deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) to the application deployments. Having a separate Kubernetes deployment for `cloudflared` allows you to scale `cloudflared` independently of the application. In the `cloudflared` deployment, you can spin up [multiple replicas](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/) running the same Cloudflare Tunnel -- there is no need to build a dedicated tunnel for each pod. Each `cloudflared` replica / pod can reach all Kubernetes services in the cluster.
20+
As shown in the diagram, we recommend setting up `cloudflared` as an adjacent [deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) to the application deployments. Having a separate Kubernetes deployment for `cloudflared` allows you to scale `cloudflared` independently of the application. In the `cloudflared` deployment, you can spin up [multiple replicas](/cloudflare-one/connections/connect-networks/configure-tunnels/tunnel-availability/) running the same Cloudflare Tunnel -- there is no need to build a dedicated tunnel for each `cloudflared` pod. Each `cloudflared` replica / pod can reach all Kubernetes services in the cluster.
2121

2222
:::note
2323
We do not recommend using `cloudflared` in autoscaling setups because downscaling (removing replicas) will break existing user connections to that replica. Additionally, `cloudflared` does not load balance across replicas; replicas are strictly for high availability. To load balance traffic to your nodes, you can use [Cloudflare Load Balancer](/load-balancing/private-network/) or a third-party load balancer.
@@ -27,75 +27,189 @@ Once the cluster is connected to Cloudflare, you can configure Cloudflare Tunnel
2727

2828
## Prerequisites
2929

30+
To complete the following procedure, you will need:
31+
- [A Google Cloud Project](https://cloud.google.com/resource-manager/docs/creating-managing-projects#creating_a_project)
32+
- [A zone on Cloudflare](/fundamentals/manage-domains/add-site/)
33+
3034
## 1. Create a GKE cluster
3135

36+
To create a new Kubernetes cluster in Google Cloud:
37+
38+
1. Open [Google Cloud](https://console.cloud.google.com/) and go to **Kubernetes Engine**.
39+
2. In **Clusters**, select **Create**.
40+
3. Name the cluster. In this example, we will name it `cloudflare-tunnel`.
41+
4. (Optional) Choose your desired region and other cluster specifications. For this example, we will use the default specifications.
42+
5. Select **Create**.
43+
6. To connect to the cluster:
44+
1. Select the three-dot menu.
45+
2. Select **Connect**.
46+
3. Select **Run in Cloud Shell** to open a terminal in the browser.
47+
4. Select **Authorize**.
48+
5. Press Enter to run the pre-populated `gcloud` command.
49+
6. (Recommended) In the Cloud Shell menu, select **Open Editor** to launch the built-in IDE.
50+
7. Run the following command to check the cluster status:
51+
```sh
52+
kubectl get all
53+
```
54+
```sh output
55+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
56+
service/kubernetes ClusterIP 34.118.224.1 <none> 443/TCP 15m
57+
```
58+
59+
## 2. Create pods for the web app
60+
61+
A pod represents an instance of a running process in the cluster. In this example, we will deploy the [httpbin](https://httpbin.org/) application with two pods and make the pods accessible inside the cluster at `httpbin-service:80`.
62+
63+
1. Create a folder for your Kubernetes manifest files:
64+
65+
```sh
66+
mkdir tunnel-example
67+
```
68+
69+
2. Change into the directory:
70+
71+
```sh
72+
cd tunnel-example
73+
```
3274

33-
- Install the [gcloud CLI](https://cloud.google.com/sdk/docs/install) and [kubectl CLI](https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-access-for-kubectl).
34-
- In the GCP console create a new Kubernetes cluster.
35-
- In order to connect to the cluster, select the three dots and then connect from the drop down.
36-
- Copy the command that appears and paste it into your local terminal.
75+
4. In the `tunnel-example` directory, create a new file called `httpbin.yaml`. This file defines the Kubernetes deployment for the httpbin app.
3776

77+
```yaml title="httpbin.yaml"
78+
apiVersion: apps/v1
79+
kind: Deployment
80+
metadata:
81+
name: httpbin-deployment
82+
namespace: default
83+
spec:
84+
replicas: 2
85+
selector:
86+
matchLabels:
87+
app: httpbin
88+
template:
89+
metadata:
90+
labels:
91+
app: httpbin
92+
spec:
93+
containers:
94+
- name: httpbin
95+
image: kennethreitz/httpbin:latest
96+
imagePullPolicy: IfNotPresent
97+
ports:
98+
- containerPort: 80
99+
```
38100

39-
## Create pods for the web app
101+
5. Create a new `httpbinsvc.yaml` file. This file defines a Kubernetes service that allows other apps in the cluster (such as `cloudflared`) to access the set of httpbin pods.
40102

103+
```yaml title="httpbinsvc.yaml"
104+
apiVersion: v1
105+
kind: Service
106+
metadata:
107+
name: httpbin-service
108+
namespace: default
109+
spec:
110+
type: LoadBalancer
111+
selector:
112+
app: httpbin
113+
ports:
114+
- port: 80
115+
targetPort: 80
116+
```
41117

118+
6. Use the following command to run the application inside the cluster:
42119

43-
A pod is the basic deployable object that Kubernetes creates. It represents an instance of a running process in the cluster. The following .yml file ( httpbin-app.yml) will create a pod that contains the httpbin application. It will create two replicas so as to prevent any downtime. The application will be accessible inside the cluster at web-service:80.
120+
```sh
121+
kubectl create -f httpbin.yaml -f httpbinsvc.yaml
122+
```
44123

45-
```yaml
46-
apiVersion: apps/v1
47-
kind: Deployment
48-
metadata:
49-
name: httpbin-deployment
50-
spec:
51-
selector:
52-
matchLabels:
53-
app: httpbin
54-
replicas: 2
55-
template:
56-
metadata:
57-
labels:
58-
app: httpbin
59-
spec:
60-
containers:
61-
- name: httpbin
62-
image: kennethreitz/httpbin:latest
63-
ports:
64-
- containerPort: 80
65-
---
66-
apiVersion: v1
67-
kind: Service
68-
metadata:
69-
name: web-service
70-
spec:
71-
selector:
72-
app: httpbin
73-
ports:
74-
- protocol: TCP
75-
port: 80
76-
```
124+
7. Check the status of your deployment:
77125

78-
Using the following command the application will begin to run inside the cluster.
126+
```sh
127+
kubectl get all
128+
```
79129

80-
```sh
81-
kubectl create -f httpbin-app.yml
82-
```
130+
```sh output
131+
NAME READY STATUS RESTARTS AGE
132+
pod/httpbin-deployment-bc6689c5d-b5ftk 1/1 Running 0 79s
133+
pod/httpbin-deployment-bc6689c5d-cbd9m 1/1 Running 0 79s
83134

84-
The pods' status can be seen through the console or using the kubectl get pod command.
135+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
136+
service/httpbin-service LoadBalancer 34.118.225.147 34.75.201.60 80:31967/TCP 79s
137+
service/kubernetes ClusterIP 34.118.224.1 <none> 443/TCP 24h
138+
139+
NAME READY UP-TO-DATE AVAILABLE AGE
140+
deployment.apps/httpbin-deployment 2/2 2 2 79s
85141

86-
```sh
87-
kubectl get pods
88-
```
142+
NAME DESIRED CURRENT READY AGE
143+
replicaset.apps/httpbin-deployment-bc6689c5d 2 2 2 79s
144+
```
89145

90-
## Create a tunnel
146+
## 3. Create a tunnel
91147

92-
Applications must be packaged into a containerized image, such as a Docker image, before you can run it in Kubernetes. Kubernetes uses the image to spin up multiple instances of the application.
148+
1. Open a new browser tab and log in to [Zero Trust](https://one.dash.cloudflare.com).
93149

94-
## Store the tunnel token
150+
2. Go to **Networks** > **Tunnels**.
95151

96-
## Create pods for cloudflared
152+
3. Select **Create a tunnel**.
153+
154+
4. Choose **Cloudflared** for the connector type and select **Next**.
155+
156+
5. Enter a name for your tunnel (for example, `gke`).
157+
158+
6. Select **Save tunnel**.
159+
160+
7. Under **Choose an environment**, select **Docker**.
161+
162+
Applications must be packaged into a containerized image before you can run it in Kubernetes. Therefore, we will use the `cloudflared` Docker container image to deploy the tunnel in Kubernetes.
163+
164+
8. Instead of running the installation command, copy just the token value rather than the whole command. The token value is of the form `eyJhIjoiNWFiNGU5Z...` You will need the token for the Kubernetes manifest file.
165+
166+
Leave this browser tab open while we finish up the Kubernetes deployment.
167+
168+
## 4. Store the tunnel token
169+
170+
Create a [Kubernetes secret](https://kubernetes.io/docs/concepts/configuration/secret/) that contains the tunnel token. The tunnel token must be encoded as a base64-encoded string before it can be stored in the secret. The encoding is not meant to protect the token from being read but to allow for the safe handling of binary data within Kubernetes.
97171

172+
1. Convert the tunnel token into base64 format:
98173

174+
```sh
175+
'eyJhIjoiNWFiNGU5Z...' | base64
176+
```
177+
178+
```sh output
179+
ZXlKa...NKOQo=
180+
```
181+
182+
2. In GKE Cloud Shell, create a `tunnel-token.yaml` file with the following content. Make sure to replace `<base64_tunnel_token>` with your base64-encoded token value (`ZXlKa...NKOQo=`).
183+
184+
```yaml title="tunnel-token.yaml"
185+
apiVersion: v1
186+
data:
187+
token: <base64_tunnel_token>
188+
kind: Secret
189+
metadata:
190+
name: tunnel-token
191+
namespace: default
192+
type: Opaque
193+
```
194+
195+
3. Create the secret:
196+
197+
```sh
198+
kubectl create -f tunnel-token.yaml
199+
```
200+
201+
4. Check the newly created secret:
202+
203+
```sh
204+
kubectl get secrets
205+
```
206+
207+
```sh output
208+
NAME TYPE DATA AGE
209+
tunnel-token Opaque 1 100s
210+
```
211+
212+
## Create pods for cloudflared
99213

100214
The tunnel can be created through the dashboard using [this guide](/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/). Instead of running the command to install a connector you will select docker as the environment and copy just the token rather than the whole command. Configure the tunnel to route to k8.example.com from the service [http://web-service:80](http://web-service:80). Create the cloudflared-deployment.yml file with the following content.
101215

0 commit comments

Comments
 (0)