{"id":9724,"date":"2022-10-26T12:37:04","date_gmt":"2022-10-26T07:07:04","guid":{"rendered":"https:\/\/www.skynats.com\/?p=9724"},"modified":"2024-12-11T16:12:08","modified_gmt":"2024-12-11T10:42:08","slug":"using-cloudflare-argo-tunnel-to-expose-kubernetes-services","status":"publish","type":"post","link":"https:\/\/www.skynats.com\/blog\/using-cloudflare-argo-tunnel-to-expose-kubernetes-services\/","title":{"rendered":"Using Cloudflare Argo Tunnel to expose Kubernetes services"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Utilize Cloudflare Argo Tunnel to expose Kubernetes services like a pro with a little assistance from our experts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As a part of our <a href=\"https:\/\/www.skynats.com\/blog\/\" target=\"_blank\" rel=\"noreferrer noopener\">Server Management Service<\/a>, we at Skynats provide answers to all kinds of questions, no matter how big or small.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let&#8217;s look at how our support team is prepared to assist clients who are experiencing issues with the http\/2 smuggling vulnerability in Cloudflare.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-use-cloudflare-argo-tunnel-to-expose-kubernetes-services\">How to Use Cloudflare Argo Tunnel to Expose Kubernetes Services<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before we begin, here is an overview of the architecture:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The procedure entails creating a Cloudflare Argo tunnel. When we&#8217;re done, the.cloudflared directory will contain the following files:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>cert.pem<\/li><li>tunnel-ID.json<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">It is now time to configure the on-premise Kubernetes Cluster. This also entails copying the JSON file&#8217;s contents to the credential-file configmap.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To ensure that it responds to all requests, we must modify the config file that the Ingress-Controller depends on. In this situation, our support team advises using a catch*all to route all traffic to all the CNAME records we will be setting up later. In addition, if we need to set up a specific service mapping, we can create a Hostname\/Service.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apiVersion: v1\r\ndata:\r\n  default.yaml: |-\r\n    tunnel: \r\n    credentials-file: \/etc\/cloudflared\/cred.json\r\n    ingress:\r\n#    - hostname: # ADD specific hostname if needed\r\n#      service: # \r\n# use catch-all service\r\n    - service: http:\/\/traefik.traefik\r\nkind: ConfigMap\r\nmetadata:\r\n  name: config-file\r\n  namespace: cloudflared<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Additionally, port 9090 is where the Prometheus port is visible.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>annotations:\r\n    prometheus.io\/path: \/metrics\r\n    prometheus.io\/port: \"9090\"\r\n    prometheus.io\/scrape: \"true\"\r\n  labels:\r\n    app: cloudflared\r\nspec:\r\n  containers:\r\n  - args:\r\n    - tunnel\r\n    - --config\r\n    - \/etc\/cloudflared\/default.yaml\r\n    - --metrics\r\n- 0.0.0.0:9090<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-cname-creation-for-the-argo-tunnel\">CNAME creation for the Argo Tunnel<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To route traffic, the Argo Tunnel needs a CNAME record to the tunnel ID. We can set up this k8s resource with the following manifest after configuring the external DNS in Kubernetes:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kind: Service\r\napiVersion: v1\r\nmetadata:\r\n  name: cname-test\r\n  annotations:\r\n    external-dns.alpha.kubernetes.io\/hostname: # CLOUDFLARE PUBLIC DOMAIN\r\n    external-dns.alpha.kubernetes.io\/ttl: \"120\" # optional\r\nspec:\r\n  type: ExternalName\r\n  externalName: #TUNNEL ID.cfargotunnel.com<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-putting-it-all-together\">Putting it all together<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">After everything has been set up, the web application can be exposed as follows:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>The application should first be deployed to the Kubernetes cluster.<\/li><li>Next, make sure a service is present in the cluster. In this case, ClusterIP will also function.<\/li><li>Then, to expose it behind the IngressController, we must create an Ingress. We must verify that the public record hosted by Cloudflare matches the IngressRoute\/ FQDN\/ Public Domain.<\/li><li>To create a public CNAME record for the service, create a different service to create CNAME.<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The service will now be available outside of the building.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Are you looking for an answer to another query?\u00a0<a href=\"https:\/\/www.skynats.com\/contact-us\/\" target=\"_blank\" rel=\"noreferrer noopener\">Contact<\/a>\u00a0our technical support team.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Utilize Cloudflare Argo Tunnel to expose Kubernetes services like a pro with a little assistance from our experts. As a part of our Server Management Service, we at Skynats provide answers to all kinds of questions, no matter how big or small. Let&#8217;s look at how our support team is prepared to assist clients who [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[747],"class_list":["post-9724","post","type-post","status-publish","format-standard","hentry","category-blog","tag-kubernetes"],"_links":{"self":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts\/9724","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/comments?post=9724"}],"version-history":[{"count":0,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts\/9724\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/media?parent=9724"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/categories?post=9724"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/tags?post=9724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}