From 4c2b5d6b4ed07b249cf59eb9617e15e09ceb0a54 Mon Sep 17 00:00:00 2001
From: Arunanshu Biswas <48434243+arunanshub@users.noreply.github.com>
Date: Sat, 5 Sep 2026 02:38:39 +0530
Subject: [PATCH 1/2] Enhance deployment.yaml with security context

Added security context for ICMP traffic and updated protocol argument.
---
 .../cloudflared/resources/deployment.yaml       | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/kubernetes/components/cloudflared/resources/deployment.yaml b/kubernetes/components/cloudflared/resources/deployment.yaml
index 23a07cfd..076a200b 100644
--- a/kubernetes/components/cloudflared/resources/deployment.yaml
+++ b/kubernetes/components/cloudflared/resources/deployment.yaml
@@ -18,9 +18,13 @@ spec:
       labels:
         app: cloudflared
     spec:
+      securityContext:
+        sysctls:
+          # Allows ICMP traffic (ping, traceroute) to resources behind cloudflared.
+          - name: net.ipv4.ping_group_range
+            value: "65532 65532"
       automountServiceAccountToken: false
-      terminationGracePeriodSeconds: 60
-      # One connector per node limits a node failure to one connector.
+      # terminationGracePeriodSeconds: 60
       topologySpreadConstraints:
         - maxSkew: 1
           topologyKey: kubernetes.io/hostname
@@ -28,6 +32,7 @@ spec:
           labelSelector:
             matchLabels:
               app: cloudflared
+
       containers:
         - name: cloudflared
           image: cloudflare/cloudflared
@@ -44,8 +49,8 @@ spec:
             # HTTP/2 is a static transport selection. The Cloudflare edge can
             # still disconnect a TCP connector, but it avoided request errors
             # during the observed QUIC connection collapse.
-            # - --protocol
-            # - http2
+            - --protocol
+            - http2
             - run
           ports:
             - name: metrics
@@ -57,8 +62,8 @@ spec:
                 secretKeyRef:
                   name: cloudflared-tunnel-token
                   key: token
-            - name: TUNNEL_GRACE_PERIOD
-              value: 50s
+            # - name: TUNNEL_GRACE_PERIOD
+            #   value: 50s
           # cloudflared exits cleanly (code 0) when it cannot maintain tunnel
           # connections, so no liveness probe is needed — Kubernetes restarts
           # it automatically. /ready returns 503 until connections are up;

From 6d31d02578e5c85cc86dd7e809e55a8499f55f1c Mon Sep 17 00:00:00 2001
From: Arunanshu Biswas <48434243+arunanshub@users.noreply.github.com>
Date: Sat, 5 Sep 2026 02:40:08 +0530
Subject: [PATCH 2/2] Update deployment.yaml

---
 kubernetes/components/cloudflared/resources/deployment.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kubernetes/components/cloudflared/resources/deployment.yaml b/kubernetes/components/cloudflared/resources/deployment.yaml
index 076a200b..04587707 100644
--- a/kubernetes/components/cloudflared/resources/deployment.yaml
+++ b/kubernetes/components/cloudflared/resources/deployment.yaml
@@ -57,13 +57,13 @@ spec:
               containerPort: 2000
               protocol: TCP
           env:
+            # - name: TUNNEL_GRACE_PERIOD
+            # value: 50s
             - name: TUNNEL_TOKEN
               valueFrom:
                 secretKeyRef:
                   name: cloudflared-tunnel-token
                   key: token
-            # - name: TUNNEL_GRACE_PERIOD
-            #   value: 50s
           # cloudflared exits cleanly (code 0) when it cannot maintain tunnel
           # connections, so no liveness probe is needed — Kubernetes restarts
           # it automatically. /ready returns 503 until connections are up;