Cloudflared is a lightweight proxy client for securely connecting applications to Cloudflare’s network. It powers Cloudflare Tunnel, allowing services to be exposed without opening ports or configuring firewall rules. cloudflared routes traffic through Cloudflare’s global network, enhancing security with DDoS protection, authentication, and encrypted connections. It supports HTTP, TCP, and QUIC, making it ideal for self-hosted services, remote access, and zero-trust networking.
cloudflared from bjw-s-labs/charts is more popular with 45 repositories.
Install with:
helm repo add cloudflared oci://ghcr.io/bjw-s-labs/charts/
helm install cloudflared cloudflared/cloudflared -f values.yamlSee examples from other people.
| Name | Repo | Stars | Version | Timestamp |
|---|---|---|---|---|
| cloudflared | Mafyuh/iac | 954 | 5.2.1 | 5 days ago |
| cloudflared | pascaliske/infrastructure | 73 | 3.0.0 | a month ago |
| cloudflared | ahgraber/homelab-gitops-k3s | 122 | 5.1.0 | 3 months ago |
See the most popular values for this chart:
| Key | Types |
|---|---|
| number | |
controllers.cloudflared.containers.app.args[] (14) - tunnel | string |
controllers.cloudflared.containers.app.image.repository (14) mirror.gcr.io/cloudflare/cloudflared | string |
controllers.cloudflared.containers.app.image.tag (14) 2026.9.3@sha256:072c067d25ccbe61d46e18f0d0723255f2bb5304f7317caa95b27031520ff92c | string |
| boolean | |
| boolean | |
| number | |
| string | |
| number | |
| number | |
| number | |
| number | |
| boolean | |
| boolean | |
| number | |
| string | |
| number | |
| number | |
| number | |
| number | |
| boolean | |
| boolean | |
| number | |
| string | |
| number | |
| number | |
| string | |
| string | |
| string | |
| string | |
| boolean, string | |
| boolean | |
| string | |
controllers.cloudflared.containers.app.env.TUNNEL_CRED_FILE (5) /etc/cloudflared/creds/credentials.json | string |
| boolean | |
| string | |
| string | |
controllers.cloudflared.containers.app.env.TZ (2) Europe/Madrid | string |
| boolean | |
| string | |
| boolean | |
| boolean | |
| string | |
| boolean | |
controllers.cloudflared.containers.app.envFrom[].secretRef.name (9) {{ .Release.Name }} | string |
| string | |
| string | |
| string | |
| string | |
controllers.cloudflared.containers.cloudflared.env.TUNNEL_CRED_FILE (1) /etc/cloudflared/creds/credentials.json | string |
| string | |
| string | |
| string | |
| string | |
controllers.cloudflared.containers.cloudflared.image.repository (2) cloudflare/cloudflared | string |
controllers.cloudflared.containers.cloudflared.image.tag (2) 2026.9.3@sha256:072c067d25ccbe61d46e18f0d0723255f2bb5304f7317caa95b27031520ff92c | string |
| boolean | |
| boolean | |
| number | |
| string | |
| number | |
| number | |
| number | |
| number | |
| boolean | |
| boolean | |
| number | |
| string | |
| number | |
| number | |
| number | |
| number | |
| boolean | |
| boolean | |
| number | |
| string | |
| number | |
| number | |
| string | |
| string | |
| string | |
| boolean | |
| string | |
| boolean | |
controllers.cloudflared.strategy (14) RollingUpdate | string |
| string | |
| string | |
| string | |
| string | |
| number | |
| boolean | |
| number | |
| number | |
| string | |
| string | |
| string | |
| string | |
| number | |
controllers.cloudflared.pod.topologySpreadConstraints[].topologyKey (2) kubernetes.io/hostname | string |
| string | |
| boolean | |
| string | |
| boolean | |
| number | |
| number | |
controllers.main.containers.app.args[] (1) - tunnel | string |
| string | |
controllers.main.containers.app.env.TUNNEL_TOKEN.valueFrom.secretKeyRef.name (1) cloudflared-credentials | string |
| string | |
controllers.main.containers.app.image.repository (1) cloudflare/cloudflared | string |
controllers.main.containers.app.image.tag (1) 2026.9.1@sha256:b269e8abd07a5bf6f3f4be65d5050b2174eca89c56a0241a8ff32a16aec454e4 | string |
| boolean | |
| boolean | |
| number | |
| string | |
| number | |
| number | |
| number | |
| boolean | |
| boolean | |
| string | |
| number | |
| number | |
| number | |
| string | |
| string | |
| string | |
| number | |
| number | |
service.app.controller (6) cloudflared | string |
service.app.ipFamilyPolicy (1) PreferDualStack | string |
service.cloudflared.controller (2) cloudflared | string |
| number | |
| string | |
| number | |
| string | |
| boolean | |
| string | |
| string | |
| string | |
| string | |
| string | |
serviceMonitor.app.serviceName (5) cloudflared | string |
| string | |
| string | |
| string | |
| string | |
| string | |
serviceMonitor.cloudflared.serviceName (2) cloudflared | string |
| boolean | |
| boolean | |
| string | |
| string | |
| string | |
| string | |
| number | |
| boolean | |
| number | |
| string | |
| number | |
| string | |
| boolean | |
| boolean | |
| string | |
| number | |
defaultPodOptions.topologySpreadConstraints[].topologyKey (1) kubernetes.io/hostname | string |
| string | |
persistence.config.globalMounts[].path (10) /etc/cloudflared/config/config.yaml | string |
| string | |
| boolean | |
persistence.config.type (10) configMap | string |
persistence.config.name (8) cloudflared-configmap | string |
| string | |
persistence.creds.globalMounts[].path (5) /etc/cloudflared/creds/credentials.json | string |
| boolean | |
persistence.creds.globalMounts[].subPath (5) credentials.json | string |
persistence.creds.name (5) cloudflared-credential | string |
| string | |
persistence.config-file.globalMounts[].path (3) /etc/cloudflared/config.yaml | string |
| string | |
| boolean | |
persistence.config-file.type (3) configMap | string |
| string | |
persistence.config-file.name (1) cloudflared-configmap | string |
persistence.secret-file.globalMounts[].path (1) /etc/cloudflared/creds/credentials.json | string |
| boolean | |
persistence.secret-file.globalMounts[].subPath (1) credentials.json | string |
persistence.secret-file.name (1) cloudflared-tunnel-secret | string |
| string | |
configMaps.config.data."config.yaml" (4) ingress:
- hostname: "*.aresu.eu"
originRequest:
http2Origin: true
originServerName: ingress-ext.aresu.eu
service: https://envoy-external.{{ .Release.Namespace }}.svc.cluster.local:443
- service: http_status:404 | string |
| string | |
| string | |
| string | |
| string | |
| number | |
env[].name (1) TZ | string |
env[].value (1) ${TIMEZONE} | string |
| string | |
| string | |
| string | |
externalSecrets.cloudflared.secretStoreRef.kind (1) ClusterSecretStore | string |
externalSecrets.cloudflared.secretStoreRef.name (1) onepassword-connect | string |
externalSecrets.cloudflared.target.template.data.TUNNEL_TOKEN (1) {{ toJson (dict "a" .tunnel_account_tag "t" .tunnel_id "s" .tunnel_secret) | b64enc }} | string |
| string | |
externalSecrets.main.forceRename (1) cloudflared-tunnel | string |
externalSecrets.main.secretStoreRef.kind (1) ClusterSecretStore | string |
externalSecrets.main.secretStoreRef.name (1) akeyless-secret-store | string |
externalSecrets.main.target.name (1) cloudflared-tunnel | string |
externalSecrets.main.target.template.data."credentials.json" (1) {
"AccountTag": "{{ .CLOUDFLARE_ACCOUNT_TAG }}",
"TunnelSecret": "{{ .TALOS_MAXI_CLOUDFLARE_TUNNEL_SECRET }}",
"TunnelID": "f38c7795-d069-4708-bd78-f88f0d3f8171"
}
| string |
fullnameOverride (1) cloudflared | string |
image.repository (1) ghcr.io/crazy-max/cloudflared | string |
image.tag (1) 2025.9.1 | string |
| string | |
rawResources.cloudflare-egress.manifest.kind (1) CiliumNetworkPolicy | string |
rawResources.cloudflare-egress.manifest.spec.egress[].toFQDNs[].matchName (1) region1.v2.argotunnel.com | string |
| string | |
| string | |
| string | |
| string | |
rawResources.cyberchef-egress.manifest.kind (1) CiliumNetworkPolicy | string |
| string | |
| string | |
| string | |
| string | |
| string | |
rawResources.dns-egress.manifest.apiVersion (1) cilium.io/v2 | string |
rawResources.dns-egress.manifest.kind (1) CiliumNetworkPolicy | string |
| string | |
| string | |
| string | |
| string | |
| string | |
| string | |
| string | |
rawResources.forgejo-egress.manifest.kind (1) CiliumNetworkPolicy | string |
| string | |
| string | |
| string | |
| string | |
| string | |
| string | |
rawResources.healthchecks-egress.manifest.kind (1) CiliumNetworkPolicy | string |
| string | |
| string | |
| string | |
| string | |
| string | |
| string | |
rawResources.it-tools-egress.manifest.kind (1) CiliumNetworkPolicy | string |
| string | |
| string | |
| string | |
| string | |
| string | |
rawResources.kuma-egress.manifest.apiVersion (1) cilium.io/v2 | string |
rawResources.kuma-egress.manifest.kind (1) CiliumNetworkPolicy | string |
| string | |
| string | |
| string | |
| string | |
| string | |
| string | |
rawResources.librespeed-egress.manifest.kind (1) CiliumNetworkPolicy | string |
| string | |
| string | |
| string | |
| string | |
| string | |
| string | |
rawResources.monitoring-ingress.manifest.kind (1) CiliumNetworkPolicy | string |
| string | |
| string | |
| string | |
| string | |
| string | |
| string | |
rawResources.pocket-id-egress.manifest.kind (1) CiliumNetworkPolicy | string |
| string | |
| string | |
| string | |
| string | |
| string | |
| string | |
rawResources.wastebin-egress.manifest.kind (1) CiliumNetworkPolicy | string |
| string | |
| string | |
| string | |
| string | |
| string | |
| string | |
| string | |
| string | |
| string | |
route.app.hostnames[] (1) - cloudflared.aresu.eu | string |
route.app.parentRefs[].name (1) envoy-internal | string |
| string |