cloudflared helm

Cloudflared is a lightweight proxy client for securely connecting applications to Cloudflare’s network. It powers Cloudflare Tunnel, allowing services to be exposed without opening ports or configuring firewall rules. cloudflared routes traffic through Cloudflare’s global network, enhancing security with DDoS protection, authentication, and encrypted connections. It supports HTTP, TCP, and QUIC, making it ideal for self-hosted services, remote access, and zero-trust networking.

More popular helm chart found

cloudflared from bjw-s-labs/helm/app-template is more popular with 58 repositories.

Install

Install with:

helm repo add bjw-s oci://ghcr.io/bjw-s/helm/
helm install cloudflared bjw-s/app-template -f values.yaml

Examples

See examples from other people.

Top Repositories (1 out of 43)

NameRepoStarsVersionTimestamp
cloudflaredbrettinternet/homeops2123.5.1a year ago

Resources

256Mi
5m10m

Values

See the most popular values for this chart:

KeyTypes
persistence.config.name (42)
cloudflared-configmap
string
persistence.config.type (42)
configMap
string
persistence.config.globalMounts[].path (38)
/etc/cloudflared/config/config.yaml
string
persistence.config.globalMounts[].readOnly (38)
true
boolean
persistence.config.globalMounts[].subPath (38)
config.yaml
string
persistence.config.enabled (12)
true
boolean
persistence.config.mountPath (4)
/etc/cloudflared/config/config.yaml
string
persistence.config.readOnly (4)
true
boolean
persistence.config.subPath (4)
config.yaml
string
persistence.creds.name (42)
cloudflared-secret
string
persistence.creds.type (42)
secret
string
persistence.creds.globalMounts[].path (38)
/etc/cloudflared/creds/credentials.json
string
persistence.creds.globalMounts[].readOnly (38)
true
boolean
persistence.creds.globalMounts[].subPath (38)
credentials.json
string
persistence.creds.enabled (4)
true
boolean
persistence.creds.mountPath (4)
/etc/cloudflared/creds/credentials.json
string
persistence.creds.readOnly (3)
true
boolean
persistence.creds.subPath (3)
credentials.json
string
persistence.config-file.globalMounts[].path (1)
/etc/cloudflared/config/config.yaml
string
persistence.config-file.globalMounts[].readOnly (1)
true
boolean
persistence.config-file.globalMounts[].subPath (1)
config.yaml
string
persistence.config-file.name (1)
cloudflared-configmap
string
persistence.config-file.type (1)
configMap
string
persistence.secret-file.globalMounts[].path (1)
/etc/cloudflared/creds/credentials.json
string
persistence.secret-file.globalMounts[].readOnly (1)
true
boolean
persistence.secret-file.globalMounts[].subPath (1)
credentials.json
string
persistence.secret-file.name (1)
cloudflared-tunnel-secret
string
persistence.secret-file.type (1)
secret
string
controllers.cloudflared.annotations."reloader.stakater.com/auto" (33)
true
string
controllers.cloudflared.strategy (32)
RollingUpdate
string
controllers.cloudflared.containers.app.args[] (31)
- tunnel
- --config
- /etc/cloudflared/config/config.yaml
- run
- $(TUNNEL_ID)
string
controllers.cloudflared.containers.app.env.TUNNEL_CRED_FILE (31)
/etc/cloudflared/creds/credentials.json
string
controllers.cloudflared.containers.app.env.TUNNEL_METRICS (31)
0.0.0.0:8080
string
controllers.cloudflared.containers.app.env.TUNNEL_TRANSPORT_PROTOCOL (31)
quic
string
controllers.cloudflared.containers.app.env.NO_AUTOUPDATE (30)
true
boolean, string
controllers.cloudflared.containers.app.env.TUNNEL_POST_QUANTUM (29)
true
boolean
controllers.cloudflared.containers.app.env.TUNNEL_ORIGIN_ENABLE_HTTP2 (28)
true
boolean
controllers.cloudflared.containers.app.env.TUNNEL_ID.valueFrom.secretKeyRef.key (24)
TUNNEL_ID
string
controllers.cloudflared.containers.app.env.TUNNEL_ID.valueFrom.secretKeyRef.name (24)
cloudflared-secret
string
controllers.cloudflared.containers.app.env.TUNNEL_ID (2)
c750bbca-6be2-4305-8ee7-ec1faf6316fe
string
controllers.cloudflared.containers.app.env.NO_AUTO_UPDATE (1)
true
boolean
controllers.cloudflared.containers.app.env.TUNNEL_MANAGEMENT_DIAGNOSTICS (1)
false
string
controllers.cloudflared.containers.app.env.TZ (1)
Europe/Madrid
string
controllers.cloudflared.containers.app.image.repository (31)
docker.io/cloudflare/cloudflared
string
controllers.cloudflared.containers.app.image.tag (31)
2025.8.1
string
controllers.cloudflared.containers.app.probes.liveness.custom (31)
true
boolean
controllers.cloudflared.containers.app.probes.liveness.enabled (31)
true
boolean
controllers.cloudflared.containers.app.probes.liveness.spec.failureThreshold (31)
3
number
controllers.cloudflared.containers.app.probes.liveness.spec.httpGet.path (31)
/ready
string
controllers.cloudflared.containers.app.probes.liveness.spec.httpGet.port (31)
8080
number
controllers.cloudflared.containers.app.probes.liveness.spec.initialDelaySeconds (31)
0
number
controllers.cloudflared.containers.app.probes.liveness.spec.periodSeconds (31)
10
number
controllers.cloudflared.containers.app.probes.liveness.spec.timeoutSeconds (31)
1
number
controllers.cloudflared.containers.app.probes.readiness.custom (31)
true
boolean
controllers.cloudflared.containers.app.probes.readiness.enabled (31)
true
boolean
controllers.cloudflared.containers.app.probes.readiness.spec.failureThreshold (31)
3
number
controllers.cloudflared.containers.app.probes.readiness.spec.httpGet.path (31)
/ready
string
controllers.cloudflared.containers.app.probes.readiness.spec.httpGet.port (31)
8080
number
controllers.cloudflared.containers.app.probes.readiness.spec.initialDelaySeconds (31)
0
number
controllers.cloudflared.containers.app.probes.readiness.spec.periodSeconds (31)
10
number
controllers.cloudflared.containers.app.probes.readiness.spec.timeoutSeconds (31)
1
number
controllers.cloudflared.containers.app.probes.startup.enabled (3)
false
boolean
controllers.cloudflared.containers.app.resources.requests.cpu (31)
10m
string
controllers.cloudflared.containers.app.resources.requests.memory (6)
256Mi
string
controllers.cloudflared.containers.app.resources.limits.memory (30)
256Mi
string
controllers.cloudflared.containers.app.securityContext.allowPrivilegeEscalation (30)
false
boolean
controllers.cloudflared.containers.app.securityContext.capabilities.drop[] (30)
- ALL
string
controllers.cloudflared.containers.app.securityContext.capabilities.add[] (1)
- NET_ADMIN
string
controllers.cloudflared.containers.app.securityContext.readOnlyRootFilesystem (30)
true
boolean
controllers.cloudflared.containers.app.securityContext.seccompProfile.type (1)
RuntimeDefault
string
controllers.cloudflared.containers.cloudflared.args[] (2)
- tunnel
- --config
- /etc/cloudflared/config/config.yaml
- run
- $(TUNNEL_ID)
string
controllers.cloudflared.containers.cloudflared.env.NO_AUTOUPDATE (2)
true
boolean
controllers.cloudflared.containers.cloudflared.env.TUNNEL_CRED_FILE (2)
/etc/cloudflared/creds/credentials.json
string
controllers.cloudflared.containers.cloudflared.env.TUNNEL_ID.valueFrom.secretKeyRef.key (2)
TUNNEL_ID
string
controllers.cloudflared.containers.cloudflared.env.TUNNEL_ID.valueFrom.secretKeyRef.name (2)
cloudflared-secret
string
controllers.cloudflared.containers.cloudflared.env.TUNNEL_METRICS (2)
0.0.0.0:8080
string
controllers.cloudflared.containers.cloudflared.env.TUNNEL_ORIGIN_ENABLE_HTTP2 (2)
true
boolean
controllers.cloudflared.containers.cloudflared.env.TUNNEL_TRANSPORT_PROTOCOL (2)
quic
string
controllers.cloudflared.containers.cloudflared.env.TUNNEL_POST_QUANTUM (1)
true
boolean
controllers.cloudflared.containers.cloudflared.image.repository (2)
docker.io/cloudflare/cloudflared
string
controllers.cloudflared.containers.cloudflared.image.tag (2)
2025.8.1
string
controllers.cloudflared.containers.cloudflared.probes.liveness.custom (2)
true
boolean
controllers.cloudflared.containers.cloudflared.probes.liveness.enabled (2)
true
boolean
controllers.cloudflared.containers.cloudflared.probes.liveness.spec.failureThreshold (2)
3
number
controllers.cloudflared.containers.cloudflared.probes.liveness.spec.httpGet.path (2)
/ready
string
controllers.cloudflared.containers.cloudflared.probes.liveness.spec.httpGet.port (2)
8080
number
controllers.cloudflared.containers.cloudflared.probes.liveness.spec.initialDelaySeconds (2)
0
number
controllers.cloudflared.containers.cloudflared.probes.liveness.spec.periodSeconds (2)
10
number
controllers.cloudflared.containers.cloudflared.probes.liveness.spec.timeoutSeconds (2)
1
number
controllers.cloudflared.containers.cloudflared.probes.readiness.custom (2)
true
boolean
controllers.cloudflared.containers.cloudflared.probes.readiness.enabled (2)
true
boolean
controllers.cloudflared.containers.cloudflared.probes.readiness.spec.failureThreshold (2)
3
number
controllers.cloudflared.containers.cloudflared.probes.readiness.spec.httpGet.path (2)
/ready
string
controllers.cloudflared.containers.cloudflared.probes.readiness.spec.httpGet.port (2)
8080
number
controllers.cloudflared.containers.cloudflared.probes.readiness.spec.initialDelaySeconds (2)
0
number
controllers.cloudflared.containers.cloudflared.probes.readiness.spec.periodSeconds (2)
10
number
controllers.cloudflared.containers.cloudflared.probes.readiness.spec.timeoutSeconds (2)
1
number
controllers.cloudflared.containers.cloudflared.probes.startup.enabled (1)
false
boolean
controllers.cloudflared.containers.cloudflared.resources.limits.memory (2)
256Mi
string
controllers.cloudflared.containers.cloudflared.resources.requests.cpu (2)
10m
string
controllers.cloudflared.containers.cloudflared.securityContext.allowPrivilegeEscalation (2)
false
boolean
controllers.cloudflared.containers.cloudflared.securityContext.capabilities.drop[] (2)
- ALL
string
controllers.cloudflared.containers.cloudflared.securityContext.readOnlyRootFilesystem (2)
true
boolean
controllers.cloudflared.containers.cloudflared.securityContext.seccompProfile.type (1)
RuntimeDefault
string
controllers.cloudflared.replicas (13)
2
number
controllers.cloudflared.pod.securityContext.runAsGroup (6)
568
number
controllers.cloudflared.pod.securityContext.runAsUser (6)
568
number
controllers.cloudflared.pod.securityContext.runAsNonRoot (5)
true
boolean
controllers.cloudflared.pod.securityContext.fsGroup (1)
568
number
controllers.cloudflared.pod.securityContext.fsGroupChangePolicy (1)
OnRootMismatch
string
controllers.cloudflared.pod.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/name" (2)
cloudflared
string
controllers.cloudflared.pod.topologySpreadConstraints[].maxSkew (2)
1
number
controllers.cloudflared.pod.topologySpreadConstraints[].topologyKey (2)
kubernetes.io/hostname
string
controllers.cloudflared.pod.topologySpreadConstraints[].whenUnsatisfiable (2)
DoNotSchedule
string
controllers.cloudflared.pod.imagePullSecrets[].name (1)
dockerhub-auth
string
controllers.cloudflared.rollingUpdate.unavailable (1)
0
number
controllers.main.annotations."reloader.stakater.com/auto" (6)
true
string
controllers.main.replicas (6)
2
number
controllers.main.strategy (6)
RollingUpdate
string
controllers.main.containers.main.args[] (5)
- tunnel
- --config
- /etc/cloudflared/config/config.yaml
- run
- $(TUNNEL_ID)
string
controllers.main.containers.main.env.NO_AUTOUPDATE (5)
true
boolean, string
controllers.main.containers.main.env.TUNNEL_CRED_FILE (5)
/etc/cloudflared/creds/credentials.json
string
controllers.main.containers.main.env.TUNNEL_METRICS (5)
0.0.0.0:8080
string
controllers.main.containers.main.env.TUNNEL_POST_QUANTUM (5)
true
boolean
controllers.main.containers.main.env.TUNNEL_TRANSPORT_PROTOCOL (5)
quic
string
controllers.main.containers.main.env.TUNNEL_ID.valueFrom.secretKeyRef.key (4)
TUNNEL_ID
string
controllers.main.containers.main.env.TUNNEL_ID.valueFrom.secretKeyRef.name (4)
cloudflared-secret
string
controllers.main.containers.main.env.TUNNEL_ORIGIN_ENABLE_HTTP2 (4)
true
boolean
controllers.main.containers.main.env.TUNNEL_EDGE_IP_VERSION (1)
auto
string
controllers.main.containers.main.image.repository (5)
docker.io/cloudflare/cloudflared
string
controllers.main.containers.main.image.tag (5)
2024.2.1
string
controllers.main.containers.main.probes.liveness.custom (5)
true
boolean
controllers.main.containers.main.probes.liveness.enabled (5)
true
boolean
controllers.main.containers.main.probes.liveness.spec.failureThreshold (5)
3
number
controllers.main.containers.main.probes.liveness.spec.httpGet.path (5)
/ready
string
controllers.main.containers.main.probes.liveness.spec.httpGet.port (5)
8080
number
controllers.main.containers.main.probes.liveness.spec.initialDelaySeconds (5)
0
number
controllers.main.containers.main.probes.liveness.spec.periodSeconds (5)
10
number
controllers.main.containers.main.probes.liveness.spec.timeoutSeconds (5)
1
number
controllers.main.containers.main.probes.readiness.custom (5)
true
boolean
controllers.main.containers.main.probes.readiness.enabled (5)
true
boolean
controllers.main.containers.main.probes.readiness.spec.failureThreshold (5)
3
number
controllers.main.containers.main.probes.readiness.spec.httpGet.path (5)
/ready
string
controllers.main.containers.main.probes.readiness.spec.httpGet.port (5)
8080
number
controllers.main.containers.main.probes.readiness.spec.initialDelaySeconds (5)
0
number
controllers.main.containers.main.probes.readiness.spec.periodSeconds (5)
10
number
controllers.main.containers.main.probes.readiness.spec.timeoutSeconds (5)
1
number
controllers.main.containers.main.probes.startup.enabled (5)
false
boolean
controllers.main.containers.main.resources.limits.memory (5)
256Mi
string
controllers.main.containers.main.resources.requests.cpu (5)
10m
string
controllers.main.containers.main.resources.requests.memory (1)
128M
string
controllers.main.containers.main.securityContext.allowPrivilegeEscalation (4)
false
boolean
controllers.main.containers.main.securityContext.capabilities.drop[] (4)
- ALL
string
controllers.main.containers.main.securityContext.readOnlyRootFilesystem (4)
true
boolean
controllers.main.containers.main.securityContext.seccompProfile.type (3)
RuntimeDefault
string
controllers.main.containers.cloudflared.args[] (1)
- tunnel
- --config
- /etc/cloudflared/config/config.yaml
- run
- $(TUNNEL_ID)
string
controllers.main.containers.cloudflared.env.NO_AUTOUPDATE (1)
true
string
controllers.main.containers.cloudflared.env.TUNNEL_CRED_FILE (1)
/etc/cloudflared/creds/credentials.json
string
controllers.main.containers.cloudflared.env.TUNNEL_ID.valueFrom.secretKeyRef.key (1)
TUNNEL_ID
string
controllers.main.containers.cloudflared.env.TUNNEL_ID.valueFrom.secretKeyRef.name (1)
cloudflared-secret
string
controllers.main.containers.cloudflared.env.TUNNEL_METRICS (1)
0.0.0.0:8080
string
controllers.main.containers.cloudflared.env.TUNNEL_TRANSPORT_PROTOCOL (1)
auto
string
controllers.main.containers.cloudflared.image.pullPolicy (1)
IfNotPresent
string
controllers.main.containers.cloudflared.image.repository (1)
docker.io/cloudflare/cloudflared
string
controllers.main.containers.cloudflared.image.tag (1)
2025.8.1
string
controllers.main.containers.cloudflared.probes.liveness.custom (1)
true
boolean
controllers.main.containers.cloudflared.probes.liveness.enabled (1)
true
boolean
controllers.main.containers.cloudflared.probes.liveness.spec.failureThreshold (1)
3
number
controllers.main.containers.cloudflared.probes.liveness.spec.httpGet.path (1)
/ready
string
controllers.main.containers.cloudflared.probes.liveness.spec.httpGet.port (1)
8080
number
controllers.main.containers.cloudflared.probes.liveness.spec.initialDelaySeconds (1)
0
number
controllers.main.containers.cloudflared.probes.liveness.spec.periodSeconds (1)
10
number
controllers.main.containers.cloudflared.probes.liveness.spec.timeoutSeconds (1)
1
number
controllers.main.containers.cloudflared.probes.readiness.custom (1)
true
boolean
controllers.main.containers.cloudflared.probes.readiness.enabled (1)
true
boolean
controllers.main.containers.cloudflared.probes.readiness.spec.failureThreshold (1)
3
number
controllers.main.containers.cloudflared.probes.readiness.spec.httpGet.path (1)
/ready
string
controllers.main.containers.cloudflared.probes.readiness.spec.httpGet.port (1)
8080
number
controllers.main.containers.cloudflared.probes.readiness.spec.initialDelaySeconds (1)
0
number
controllers.main.containers.cloudflared.probes.readiness.spec.periodSeconds (1)
10
number
controllers.main.containers.cloudflared.probes.readiness.spec.timeoutSeconds (1)
1
number
controllers.main.containers.cloudflared.probes.startup.enabled (1)
false
boolean
controllers.main.containers.cloudflared.resources.limits.memory (1)
256Mi
string
controllers.main.containers.cloudflared.resources.requests.cpu (1)
5m
string
controllers.main.containers.cloudflared.resources.requests.memory (1)
10Mi
string
controllers.main.pod.securityContext.runAsGroup (5)
65534
number
controllers.main.pod.securityContext.runAsUser (5)
65534
number
controllers.main.pod.securityContext.runAsNonRoot (4)
true
boolean
controllers.main.pod.dnsPolicy (1)
ClusterFirstWithHostNet
string
controllers.main.pod.hostNetwork (1)
true
boolean
controllers.main.pod.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/name" (1)
cloudflared
string
controllers.main.pod.topologySpreadConstraints[].maxSkew (1)
1
number
controllers.main.pod.topologySpreadConstraints[].topologyKey (1)
kubernetes.io/hostname
string
controllers.main.pod.topologySpreadConstraints[].whenUnsatisfiable (1)
DoNotSchedule
string
service.app.controller (31)
cloudflared
string
service.app.ports.http.port (31)
8080
number
service.main.ports.http.port (9)
8080
number
service.main.ports.http.enabled (1)
false
boolean
service.main.controller (1)
main
string
service.main.enabled (1)
false
boolean
service.cloudflared.controller (3)
cloudflared
string
service.cloudflared.ports.http.port (3)
8080
number
service.udptest.controller (1)
main
string
service.udptest.externalTrafficPolicy (1)
Local
string
service.udptest.ports.udp.port (1)
7844
number
service.udptest.type (1)
LoadBalancer
string
serviceMonitor.app.endpoints[].interval (29)
1m
string
serviceMonitor.app.endpoints[].path (29)
/metrics
string
serviceMonitor.app.endpoints[].port (29)
http
string
serviceMonitor.app.endpoints[].scheme (29)
http
string
serviceMonitor.app.endpoints[].scrapeTimeout (29)
10s
string
serviceMonitor.app.serviceName (29)
cloudflared
string
serviceMonitor.app.enabled (1)
true
boolean
serviceMonitor.app.labels.app (1)
cloudflared
string
serviceMonitor.app.labels.release (1)
kube-prometheus-stack
string
serviceMonitor.main.enabled (8)
true
boolean
serviceMonitor.main.endpoints[].interval (5)
1m
string
serviceMonitor.main.endpoints[].path (5)
/metrics
string
serviceMonitor.main.endpoints[].port (5)
http
string
serviceMonitor.main.endpoints[].scheme (5)
http
string
serviceMonitor.main.endpoints[].scrapeTimeout (5)
30s
string
serviceMonitor.main.serviceName (2)
cloudflared
string
serviceMonitor.cloudflared.endpoints[].port (2)
http
string
serviceMonitor.cloudflared.endpoints[].interval (1)
1m
string
serviceMonitor.cloudflared.endpoints[].path (1)
/metrics
string
serviceMonitor.cloudflared.endpoints[].scheme (1)
http
string
serviceMonitor.cloudflared.endpoints[].scrapeTimeout (1)
10s
string
serviceMonitor.cloudflared.serviceName (2)
cloudflared
string
defaultPodOptions.securityContext.runAsGroup (27)
65534
number
defaultPodOptions.securityContext.runAsNonRoot (27)
true
boolean
defaultPodOptions.securityContext.runAsUser (27)
65534
number
defaultPodOptions.securityContext.seccompProfile.type (25)
RuntimeDefault
string
defaultPodOptions.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/name" (3)
cloudflared
string
defaultPodOptions.topologySpreadConstraints[].maxSkew (3)
1
number
defaultPodOptions.topologySpreadConstraints[].topologyKey (3)
kubernetes.io/hostname
string
defaultPodOptions.topologySpreadConstraints[].whenUnsatisfiable (3)
DoNotSchedule
string
args[] (4)
- tunnel
- --config
- /etc/cloudflared/config/config.yaml
- run
- $(TUNNEL_ID)
string
image.repository (4)
docker.io/cloudflare/cloudflared
string
image.tag (4)
2024.12.2
string
controller.annotations."reloader.stakater.com/auto" (3)
true
string
controller.replicas (3)
1
number
controller.strategy (3)
RollingUpdate
string
env.NO_AUTOUPDATE (3)
true
string
env.TUNNEL_CRED_FILE (3)
/etc/cloudflared/creds/credentials.json
string
env.TUNNEL_ID.valueFrom.secretKeyRef.key (3)
TUNNEL_ID
string
env.TUNNEL_ID.valueFrom.secretKeyRef.name (3)
cloudflared-secret
string
env.TUNNEL_METRICS (3)
0.0.0.0:8080
string
env.TUNNEL_TRANSPORT_PROTOCOL (3)
auto
string
env.TUNNEL_POST_QUANTUM (1)
true
boolean
probes.liveness.custom (3)
true
boolean
probes.liveness.enabled (3)
true
boolean
probes.liveness.spec.failureThreshold (3)
3
number
probes.liveness.spec.httpGet.path (3)
/ready
string
probes.liveness.spec.httpGet.port (3)
http
string
probes.liveness.spec.initialDelaySeconds (3)
0
number
probes.liveness.spec.periodSeconds (3)
10
number
probes.liveness.spec.timeoutSeconds (3)
1
number
probes.readiness.custom (3)
true
boolean
probes.readiness.enabled (3)
true
boolean
probes.readiness.spec.failureThreshold (3)
3
number
probes.readiness.spec.httpGet.path (3)
/ready
string
probes.readiness.spec.httpGet.port (3)
http
string
probes.readiness.spec.initialDelaySeconds (3)
0
number
probes.readiness.spec.periodSeconds (3)
10
number
probes.readiness.spec.timeoutSeconds (3)
1
number
probes.startup.enabled (3)
false
boolean
resources.limits.memory (3)
256Mi
string
resources.requests.cpu (3)
5m
string
resources.requests.memory (3)
10Mi
string
global.annotations."reloader.stakater.com/search" (1)
true
string
ingress.main.enabled (1)
false
boolean