> ## Documentation Index
> Fetch the complete documentation index at: https://docs.akua.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare Tunnel

> Use your own Cloudflare account to route custom domains to your cluster — no public IPs required

<Frame>
  <img className="block dark:hidden" src="https://mintcdn.com/akua-1dce587a/XutebFe61mz4P6aZ/images/heros/cloudflare-tunnel-light.svg?fit=max&auto=format&n=XutebFe61mz4P6aZ&q=85&s=e5a77235380daf4df2db41b023944f5a" alt="A cloudflared agent inside the cluster dials outbound to the Cloudflare edge, so requests reach your app with no inbound ports open." width="1536" height="864" data-path="images/heros/cloudflare-tunnel-light.svg" />

  <img className="hidden dark:block" src="https://mintcdn.com/akua-1dce587a/XutebFe61mz4P6aZ/images/heros/cloudflare-tunnel-dark.svg?fit=max&auto=format&n=XutebFe61mz4P6aZ&q=85&s=9598a0b1773b3a5adee0da2225c67e47" alt="A cloudflared agent inside the cluster dials outbound to the Cloudflare edge, so requests reach your app with no inbound ports open." width="1536" height="864" data-path="images/heros/cloudflare-tunnel-dark.svg" />
</Frame>

Cloudflare Tunnel lets you expose applications on your own custom domains through Cloudflare's network. Unlike [preview domains](/networking/preview-domains) where Akua manages the domain, here you bring your own Cloudflare account and keep control of Cloudflare-level settings such as access policies, WAF rules, caching, and DNS.

Your worker nodes don't need public IP addresses. A <Tooltip headline="cloudflared" tip="The Cloudflare Tunnel agent. It runs on your cluster and creates an outbound-only connection to Cloudflare's edge network. Since the connection is outbound, no firewall rules or open ports are needed.">cloudflared</Tooltip> agent on your cluster establishes an outbound connection to Cloudflare's edge, and Cloudflare routes incoming requests through the tunnel to your applications.

```
Browser → Cloudflare Edge (TLS + DDoS protection) → Tunnel → Your Cluster → App
```

## Why use this

* **No public IPs needed**: `cloudflared` connects outbound from your cluster. No firewall rules, no port forwarding, no exposed nodes.
* **Your domain, your Cloudflare account**: full control over DNS, caching, access policies, WAF rules, and tunnel settings.
* **Cloudflare edge**: TLS termination, DDoS protection, and global edge caching come built-in.
* **Works anywhere**: behind NAT, corporate firewalls, and private networks, as long as the cluster has outbound internet access.
* **Standard routing**: uses standard Kubernetes <Tooltip headline="Gateway API" tip="Gateway API is the Kubernetes standard for managing external traffic routing. It replaces older Ingress resources with a more expressive, role-oriented model.">Gateway API</Tooltip> resources, so the same route configuration works whether you're using Cloudflare Tunnel or another gateway.

## How it works

Akua deploys a Gateway API controller to your cluster that bridges Kubernetes routing with Cloudflare Tunnels. When you create a route (either through Akua's UI or a Helm chart), Akua automatically:

1. Creates a Cloudflare Tunnel and deploys the `cloudflared` agent.
2. Publishes the tunnel endpoint metadata for the route.
3. Updates Akua's routing records and the required Cloudflare DNS and certificate state for the hostname.

Routing updates happen within seconds because the public hostname mapping is updated centrally, without requiring the cluster controller to create or delete per-hostname DNS records.

## Setup

<Steps>
  <Step title="Deploy a Cloudflare gateway">
    From your cluster's detail page, deploy a **Cloudflare Tunnel** gateway. This installs the Gateway API controller and creates the base gateway resource on your cluster.
  </Step>

  <Step title="Provide your Cloudflare credentials">
    Add your Cloudflare API token in the Akua dashboard under your cluster's settings. You'll need a token with two permissions:

    | Permission                  | Scope   | Why                                                         |
    | --------------------------- | ------- | ----------------------------------------------------------- |
    | **Cloudflare Tunnel: Edit** | Account | Create and manage tunnels                                   |
    | **DNS: Edit**               | Zone    | Manage DNS and hostname verification state for your domains |

    Credentials are stored centrally in Akua, not on your cluster. You can rotate or update your token from the dashboard at any time without touching the cluster.
  </Step>

  <Step title="Expose your app with a custom hostname">
    For Packages that expose web ports through Akua's generated install flow, go to the installation's **Settings > Ports**, toggle **Expose externally**, and enter your custom domain (for example, `app.yourdomain.com`).

    For chart sources, configure the route hostname through the Package inputs when the Package exposes those values.

    The controller detects the new route and publishes the tunnel endpoint. Akua updates the public routing record and Cloudflare state for the hostname.
  </Step>

  <Step title="Verify">
    Open `https://app.yourdomain.com` in your browser. Cloudflare handles TLS automatically, with no certificate setup needed on your side.
  </Step>
</Steps>

## Compared to preview domains

Both preview domains and Cloudflare Tunnel use Cloudflare's network to route traffic to your cluster. The difference is who manages the configuration:

|                         | Preview domains               | Cloudflare Tunnel                            |
| ----------------------- | ----------------------------- | -------------------------------------------- |
| **Domain**              | `*.akua.run` (auto-generated) | Your own domain                              |
| **Cloudflare account**  | Akua's account                | Your account                                 |
| **DNS**                 | Automatic                     | Automatic (managed centrally by Akua)        |
| **TLS**                 | Automatic                     | Automatic (Cloudflare edge)                  |
| **Tunnel config**       | Managed by Akua               | Managed by Akua with your credentials        |
| **Cloudflare settings** | None (fully managed)          | Full control (WAF, caching, access policies) |

If you don't need a custom domain or Cloudflare-level configuration, [preview domains](/networking/preview-domains) are the fastest way to get a public URL.

## Under the hood

**Same controller, different credentials.** Cloudflare Tunnel and [preview domains](/networking/preview-domains) share the same Gateway API controller on your cluster. The difference is whose Cloudflare account is used. For preview domains, Akua uses its own account. For custom domains, Akua uses the credentials you provide in the dashboard. The controller publishes tunnel endpoint metadata to Akua; Akua then routes to the right Cloudflare account.

**Akua acts as a proxy.** The controller on your cluster never calls the Cloudflare API directly. Instead, it sends tunnel endpoint updates to Akua's API, and Akua applies the Cloudflare changes using your stored credentials. This means credential rotation happens in the dashboard, with no cluster access needed. It also gives Akua a complete picture of every tunnel and route across all your clusters, which enables reliable cleanup even if a cluster becomes unreachable.

**One tunnel per gateway.** Each gateway resource on your cluster maps to one Cloudflare Tunnel. The controller deploys a `cloudflared` agent that connects to Cloudflare using a scoped tunnel token. Multiple `cloudflared` replicas can connect to the same tunnel for high availability; Cloudflare load-balances across them automatically.

**DNS records are automatic.** When Akua sees a custom hostname that should route through a Cloudflare Tunnel, Akua creates or updates the Cloudflare DNS and certificate state from the platform side. The cluster controller does not own per-hostname DNS records; it owns the tunnel endpoint metadata that lets Akua route the hostname to the correct cluster.

**Platform-managed public routing.** Akua owns the public hostname routing records for preview domains and Akua-managed custom domains. Your cluster remains the source of truth for Kubernetes service routing, while Akua is the source of truth for which public hostname points at which tunnel endpoint.

## API

Manage custom domains and Cloudflare credentials programmatically.

<CardGroup cols={2}>
  <Card title="Custom domains API" icon="code" href="/api-reference/custom-domains/list-custom-domains">
    Create, verify, and delete custom domains on a workspace.
  </Card>

  <Card title="Cloudflare credentials API" icon="key" href="/api-reference/cloudflare/create-cloudflare-credential">
    Register and rotate Cloudflare API credentials.
  </Card>
</CardGroup>

## Related topics

<CardGroup cols={2}>
  <Card title="Networking overview" icon="globe" href="/networking">
    Compare all options for exposing applications.
  </Card>

  <Card title="Preview domains" icon="link" href="/networking/preview-domains">
    Instant URLs without DNS setup, managed by Akua.
  </Card>

  <Card title="Direct IP" icon="server" href="/networking/direct-ip">
    Route directly to worker node IPs.
  </Card>

  <Card title="Domain routing API" icon="code" href="/apis/domain-routing">
    Automate custom domains and hostname management.
  </Card>
</CardGroup>