feat(cloudflared): manage tunnel ingress locally via ConfigMap

The tunnel was remotely managed from the Zero Trust dashboard: the
Deployment ran 'run --token' and ignored the ConfigMap that already
existed in the tree. Switch to a locally-managed tunnel so the ingress
routing table lives in git.

- deployment: mount cloudflared-config (config.yml) and the
  cloudflared-credentials Secret; drop TUNNEL_TOKEN env
- configmap.yaml: per-hostname ingress rules to ingress-nginx via the
  CoreDNS rewrite, plus a 404 catch-all
- secret-generator: register the SOPS-encrypted credentials file
- homelab-ca: add the cloudflared namespace copy so the connector trusts
  the ingress certificate (force-ssl-redirect makes plaintext impossible)

Credentials were extracted from the live cloudflared-token Secret and
re-encrypted with SOPS; no plaintext secret is committed.

This commit is contained in:

rock

2026-10-25 19:57:37 -07:00

parent d4e9dbf350

commit 227a67a8c1

6 changed files with 168 additions and 8 deletions

									
										k8s/apps/cloudflared/kustomization.yaml
									
		+1
		
												View File
												
				@@ -3,3 +3,4 @@ kind: Kustomization

				namespace: cloudflared

				resources:

				  - deployment.yaml

				  - configmap.yaml