apiVersion: apps/v1
kind: Deployment
metadata:
  name: cloudflared
  namespace: networking
  labels:
    app: cloudflared
  annotations:
    glance/id: cloudflared
    glance/description: "Clourflare Tunnels"
    glance/icon: di:cloudflared
    glance/url: https://dash.cloudflare.com/d1ecdad4f5c739647b0c123f0c97f57e/one/networks/connectors
spec:
  replicas: 2
  selector:
    matchLabels:
      app: cloudflared
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
  template:
    metadata:
      labels:
        app: cloudflared
        app.kubernetes.io/name: cloudflared
        glance/parent: cloudflared
    spec:
      containers:
        - name: cloudflared
          image: cloudflare/cloudflared:2026.5.2
          imagePullPolicy: IfNotPresent
          args:
            - tunnel
            - --no-autoupdate
            - --metrics
            - 0.0.0.0:2000
            - run
          env:
            - name: TUNNEL_TOKEN
              valueFrom:
                secretKeyRef:
                  name: cloudflared-secrets
                  key: tunnel_token
          readinessProbe:
            httpGet:
              path: /ready
              port: 2000
            initialDelaySeconds: 5
            periodSeconds: 5
          livenessProbe:
            httpGet:
              path: /ready
              port: 2000
            initialDelaySeconds: 10
            periodSeconds: 10
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 500m
              memory: 256Mi
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app: cloudflared