github.com/STRRL/cloudflare-tunnel-ingress-controller

Breaking change since v0.1.0-rc.0

The two ServiceMonitor value groups are merged into one:

• metrics.serviceMonitor.* and cloudflaredServiceMonitor.* are replaced by a single serviceMonitor group.
• One serviceMonitor.create switch now creates ServiceMonitors for both the controller and the managed cloudflared connectors.
• Connector only settings moved under serviceMonitor.cloudflared (jobLabel, honorLabels, scheme).

Migration example:

# before
metrics:
  serviceMonitor:
    create: true
cloudflaredServiceMonitor:
  create: true
  jobLabel: app.kubernetes.io/component

# after
serviceMonitor:
  create: true
  cloudflared:
    jobLabel: app.kubernetes.io/component

Grafana dashboards

• Dashboards are now published on grafana.com: 25659 (controller) and 25660 (per hostname traffic), and the dist JSON files pass the grafana.com upload check.
• Traffic dashboard: latency percentiles (p50/p90/p95/p99), request duration heatmap, stacked bar charts for request rate and status classes, in/out traffic volume, and a new pod variable to filter by connector pod.
• Controller dashboard: the job variable no longer matches unrelated jobs when set to All, and the sync freshness stat stays green.

See the monitoring guide for setup.

What's Changed

• refactor: split e2e scenarios into godog features by @STRRL in #327
• security: patch vulnerable deps (mapstructure GO-2025-3787) and bump Go toolchain by @devin-ai-integration[bot] in #328
• Improve error propagation in DNS sync and ingress reconcile by @devin-ai-integration[bot] in #330
• refactor: extract duplicated exposure filtering, DNS TXT lookup, and connector label helpers by @devin-ai-integration[bot] in #329
• docs: import tunnel.strrl.dev docs site into this repo by @STRRL in #331
• docs: cover recently merged features and fix helm install commands by @STRRL in #332
• ci: skip e2e test for docs-only changes by @STRRL in #333
• docs: add architecture explanation page by @STRRL in #335
• docs: fill reference gaps in controller configuration and helm values by @STRRL in #337
• docs: add symptom-oriented troubleshooting page by @STRRL in #338
• docs: add how-to guide series by @STRRL in #339
• docs: slim README down to point at the docs site, purify quickstart into a tutorial by @STRRL in #336
• docs: reorganize sidebar by Divio quadrant and add docs feedback CTA by @STRRL in #340
• ci: keep e2e-test required check satisfied on docs-only changes by @STRRL in #341
• fix: garbage collect connector resources on uninstall by @STRRL in #342
• feat: support cloudflared originRequest settings via ingress annotations by @STRRL in #343
• feat: add controller observability (health probes, metrics, events) by @STRRL in #344
• feat: default to patched cloudflared image by @STRRL in #347
• feat: add Grafana dashboards for controller and per-hostname traffic by @STRRL in #348
• feat: add Prometheus alert rules for sync health and per-hostname errors by @STRRL in #349

New Contributors

• @devin-ai-integration[bot] made their first contribution in #328

Full Changelog: v0.0.24...v0.1.0-rc.0

What's Changed

• 🔒 Fix sensitive API token logging by @STRRL in #285
• feat: pass tunnel token via Kubernetes Secret instead of command args by @STRRL in #270
• chore(deps): Bump github.com/onsi/gomega from 1.39.1 to 1.41.0 by @dependabot[bot] in #305
• chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.28.1 to 2.32.0 by @dependabot[bot] in #304
• ci: group dependabot updates by @STRRL in #314
• chore(deps): Bump the go-deps group with 3 updates by @dependabot[bot] in #315
• chore: remove k8s.io replace pins and update script by @STRRL in #316
• chore(deps): Bump sigs.k8s.io/controller-runtime from 0.23.1 to 0.24.1 by @dependabot[bot] in #306
• fix(controller): return error when ingress rule has host but nil HTTP by @AruneshDwivedi in #313
• feat: emit Kubernetes events for skipped and failed ingress rules by @STRRL in #317
• ci: replace floating branch refs with version tags and track actions via dependabot by @STRRL in #319
• fix: omit tunnel rule path for non http backend protocols by @STRRL in #321
• Sort wildcard domain ingress routes after non-wildcard routes by @joelcox22 in #287
• feat: add per-ingress annotation to disable DNS record management by @lado936 in #311
• feat: refine wildcard rule ordering and verify routing end to end by @STRRL in #322
• feat: relinquish DNS ownership when management is disabled by @STRRL in #323
• chore(deps): Bump the kubernetes group across 1 directory with 3 updates by @dependabot[bot] in #318
• chore(deps): Bump the actions group across 1 directory with 9 updates by @dependabot[bot] in #320
• feat: use Viper for controller configuration loading by @rdyjun in #292
• chore: finish viper config loading follow up by @STRRL in #324
• feat: add pod anti-affinity for multi-replica cloudflared connector (#297) by @STRRL in #325
• feat: make cloudflared pod anti-affinity an explicit opt in by @STRRL in #326
• Allow customization of cloudflared Deployment spec by @STRRL in #273

New Contributors

• @AruneshDwivedi made their first contribution in #313
• @joelcox22 made their first contribution in #287
• @lado936 made their first contribution in #311
• @rdyjun made their first contribution in #292

Full Changelog: v0.0.23...v0.0.24

What's Changed

• feat: add leader election support for high availability by @STRRL in #272
• 🧹 Use ptr.To Instead of boolPointer by @STRRL in #282
• 🧹 Rename weel_known_annotations.go to well_known_annotations.go by @STRRL in #280
• 🧹 use slices package instead of custom helpers by @STRRL in #279
• fix: skip UpdateTunnelConfiguration when ingress rules are unchanged by @conrado in #290
• feat: add configurable DNS comment template for CNAME records by @STRRL in #275

Full Changelog: v0.0.22...v0.0.23

• feat: add --cluster-domain flag for custom cluster domains

Kubernetes clusters can use a custom domain via --cluster-domain
(kubelet) instead of the default cluster.local. The controller
hardcoded cluster.local when constructing backend service FQDNs,
causing DNS resolution failures on clusters with custom domains.

Add a --cluster-domain flag (default: cluster.local) and expose
it as a Helm value (clusterDomain).

Fixes #263

• test: use custom cluster domain in tests to verify --cluster-domain flag

Use non-default cluster domains across unit, integration, and e2e tests
to ensure the clusterDomain parameter is actually propagated rather than
relying on the default "cluster.local". Also enrich descriptions for the
--cluster-domain flag and the Helm clusterDomain value.

Co-authored-by: Zhiqiang ZHOU im@strrl.dev

What's Changed

• ci: remove GitHub Actions cache from container image builds by @STRRL in #245
• also migrate gha ubuntu-20.04 -> ubuntu-latest

Full Changelog: v0.0.19...v0.0.21

Remove cache-from and cache-to configuration from both amd64 and arm64
build jobs to avoid dependency on GitHub Actions cache and gcloud
authentication requirements.

Co-authored-by: Claude noreply@anthropic.com

What's Changed

• Add Claude Code GitHub Workflow by @STRRL in #204
• feat: apply extra args by @STRRL in #206
• chore: bump deps by @STRRL in #207
• chore(deps): Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by @dependabot[bot] in #183
• chore(deps): Bump sigs.k8s.io/controller-runtime from 0.20.1 to 0.20.4 by @dependabot[bot] in #190
• Add Claude Code GitHub Workflow by @STRRL in #212
• feat: use FQDN service names instead of cluster IPs for Cloudflare tunnel configuration by @STRRL in #216
• feat: improve docs for contributing by @valkiriaaquatica in #203
• test(e2e): add end-to-end testing framework by @STRRL in #229
• chore(deps): Bump github.com/go-logr/logr from 1.4.2 to 1.4.3 by @dependabot[bot] in #211
• chore(deps): Bump github.com/stretchr/testify from 1.10.0 to 1.11.1 by @dependabot[bot] in #220
• chore(deps): Bump github.com/onsi/gomega from 1.36.2 to 1.38.2 by @dependabot[bot] in #222
• chore(deps): Bump github.com/spf13/cobra from 1.9.1 to 1.10.1 by @dependabot[bot] in #223
• chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.22.2 to 2.26.0 by @dependabot[bot] in #228
• chore(deps): update Go dependencies by @STRRL in #241
• feat: add custom labels support to ServiceMonitor by @conrado in #239

New Contributors

• @valkiriaaquatica made their first contribution in #203
• @conrado made their first contribution in #239

Full Changelog: v0.0.18...v0.0.19

What's Changed

• Allow setting http-host-header and origin-server-name annotations by @jingyuanliang in #177

Full Changelog: v0.0.17...v0.0.18