Using Cloudflare with K3s and Cert-Manager


estimated read time: 4 minutes

Using Cloudflare Edge Protection

Cyber protection illustration

Overview

This tutorial walks through setting up Cloudflare on a K3s cluster:

  1. Purchase a domain name from a registrar
  2. Sign up for a Cloudflare account and add your domain
  3. Update your domain’s nameservers to those provided by Cloudflare
  4. Configure Cloudflare settings (security, performance) to suit your needs
  5. Verify your website works correctly via the Cloudflare dashboard

Migrating an Existing Domain

To migrate your domain to Cloudflare:

  1. Sign up for a Cloudflare account and add your domain name
  2. Update your domain’s nameservers to those shown in the Cloudflare dashboard under the “DNS” tab
  3. Wait for DNS changes to propagate (up to 24–48 hours)
  4. Verify your website works correctly via the Cloudflare dashboard
  5. Once confirmed, continue with the rest of this guide
  6. Disable or delete DNS records at your previous provider

Ensure your website works correctly at each step. Don’t cancel services with your previous DNS provider until the migration is complete.

Working illustration

What is Cert-Manager?

Cert-Manager automatically handles SSL/TLS certificates for your Kubernetes cluster, making it straightforward to set up and maintain secure communications. No more manual certificate renewals or rotations—this tool handles it all. Built on the popular cert-manager project, it’s reliable and well-supported.

What is Cloudflare Cert-Manager?

Cloudflare Cert-Manager simplifies SSL/TLS certificate management for your domains. It integrates with the Cloudflare API, allowing you to provision and manage certificates directly from the Cloudflare dashboard.

Key features include:

Deploying Cloudflare and Cert-Manager

Deploying a secure, production-ready Kubernetes cluster can be daunting, but Cloudflare simplifies secure communication with the outside world.

Cloudflare is a widely used CDN and security solution offering features to protect and accelerate web applications. One particularly useful feature is SSL for SaaS, which automates SSL certificate provisioning and renewal. Combined with cert-manager—a Kubernetes-native certificate management tool—you can fully automate certificate management for your K3s cluster.

Here’s how to set it up:

First, ensure you have a K3s cluster running. See earlier in the series for setup instructions.

Next, install cert-manager. You can use Helm, kubectl, or cert-manager’s own installation method:

helm repo add jetstack https://charts.jetstack.io
helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --set installCRDs=true

Creating the ClusterIssuer

Create a file called cloudflare-issuer.yaml:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: cloudflare-issuer
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]
    privateKeySecretRef:
      name: cloudflare-issuer-account-key
    solvers:
      - selector:
          dnsZones:
            - example.com
        dns01:
          cloudflare:
            email: [email protected]
            apiKeySecretRef:
              name: cloudflare-api-key
              key: api-key

Replace:

Creating the API Key Secret

Create a Kubernetes secret containing your Cloudflare API key:

kubectl create secret generic cloudflare-api-key --from-literal=api-key=YOUR_API_KEY

Applying the Configuration

Apply the ClusterIssuer:

kubectl apply -f cloudflare-issuer.yaml

With this configuration in place, cert-manager will use your Cloudflare account to automatically issue and renew SSL certificates for any Ingress resources with the kubernetes.io/tls-acme: "true" annotation and the correct DNS zones configured.

As always, adjust the configuration to match your environment and remember to back up your keys and configuration files.

Pi Cluster Series