Cloudflare Tunnel (OCI Access)

Cloudflare Tunnel (cloudflared) provides secure, encrypted access to internal K3s services without exposing public ports.

1. Overview

Cloudflared runs as a stateless Deployment inside K3s and provides the external Cloudflare path for OpenClaw. It is separate from the OpenClaw application pod.

Status: Active
Target Environment: Cloud (Oracle Cloud)

2. Requirements & Prerequisites

Necessary components or states prior to implementation:

Cloudflare Account: Configured tunnel token.
Sealed Secrets: cloudflare-tunnel-token provisioned in the cluster.

3. Implementation Procedure

The tunnel is deployed as a standard K8s Deployment within the OCI cluster.

A. Protocol Optimization

Due to specific network constraints in Oracle Cloud, the tunnel protocol is forced to HTTP/2.

B. Service Deployment

The deployment is managed via ArgoCD.

# Deploy the cloudflared agent
    kubectl apply -f apps/infra/cloudflare-tunnel.yaml

4. Configuration Standards

Settings are managed according to the following standards:

Persistence: Stateless execution with no local storage requirements.
Security: Token-based authentication using Kubernetes Secrets.
Network: Configured with --protocol http2 for Oracle Cloud compatibility.
Image: cloudflare/cloudflared:2026.9.1.

5. Verification

System health is validated through these procedures:

Tunnel Status: Confirm the tunnel status is "Healthy" in the Cloudflare Zero Trust dashboard.
Connectivity: Test the configured OpenClaw Cloudflare hostname.