Gateway API¶

This section documents the Gateway API implementation in the Cloudflare Tunnel Gateway Controller.

Overview¶

The controller implements the Kubernetes Gateway API to manage an in-process L7 reverse proxy data plane. It watches Gateway and Route resources, pushes routing configuration to the in-cluster proxy, and writes each tunnel an ingress document through the Cloudflare API. All L7 routing, matching, and filter logic executes in the in-cluster proxy; the ingress document only feeds the Cloudflare dashboard.

Supported Resources¶

Sections¶

How It Works¶

flowchart TB
    subgraph Kubernetes["Kubernetes Cluster"]
        GW[Gateway]
        HR[HTTPRoute]
        SVC[Services]
        CTRL[Controller]
        PROXY[Proxy Pod<br/>embedded cloudflared transport]
    end

    subgraph Cloudflare["Cloudflare Edge"]
        API[Cloudflare API]
        EDGE[Edge Network]
    end

    GW -->|watch| CTRL
    HR -->|watch| CTRL
    SVC -->|resolve| CTRL
    CTRL -->|configure| API
    CTRL -->|sync routes| PROXY
    API -->|tunnel config| PROXY
    PROXY -->|tunnel| EDGE
    EDGE -->|traffic| PROXY
    PROXY -->|route| SVC

Key Concepts¶