turtlecode-tunnel.yaml

# Dedicated cloudflared connector for the "turtlecode" tunnel (027dab4a),
# isolated in the turtlecode namespace. Token lives in secret `turtlecode-tunnel`
# (minted from the Cloudflare API; created out-of-band).
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cloudflared
  namespace: turtlecode
spec:
  replicas: 1
  selector:
    matchLabels: { app: cloudflared }
  template:
    metadata:
      labels: { app: cloudflared }
    spec:
      containers:
        - name: cloudflared
          image: cloudflare/cloudflared:latest
          args: ["tunnel", "--no-autoupdate", "run", "--token", "$(TUNNEL_TOKEN)"]
          env:
            - name: TUNNEL_TOKEN
              valueFrom:
                secretKeyRef:
                  name: turtlecode-tunnel
                  key: token
          resources:
            requests: { cpu: "10m", memory: "32Mi" }
            limits:   { cpu: "200m", memory: "128Mi" }