This tool is used as aprt of our helm charts to manage Cloudflare DNS records automatically post deployment.
Set CF_API_KEY to a Cloudflare API token and leave CF_API_EMAIL unset, or set CF_API_KEY to a
Global API Key and CF_API_EMAIL to the account address. The presence of CF_API_EMAIL selects
between the two, so a chart still passing it keeps working.
A record is matched by its exact name, $subdomain.$CF_API_DOMAIN. Cloudflare's search parameter
is a substring filter, so matching on the subdomain alone lets one service act on another's record
whenever one name is a prefix of another — pepper against pepper-mcp, for instance. If a zone
somehow holds more than one matching record, the script stops rather than guessing.
create waits for the ingress (or service) to publish an external address before it writes the DNS
record. The controller publishes on its own cycle, roughly every 55s, which is well after the
deployment rollout this job also waits for - so reading the address once usually reads it too early.
ADDRESS_TIMEOUT bounds the wait, default 120s, and ADDRESS_POLL_SECONDS sets the interval,
default 5s. On timeout the object's events are printed and the job fails. Nothing on an Ingress
distinguishes "not assigned yet" from "will never be assigned" - IngressStatus carries only
loadBalancer.ingress[] and no conditions - so a bounded wait is the only way to separate the two.
Authenticate to the Azure Container Registry:
az acr login -n RedRiverBuild and push the image to the Azure Container Registry:
docker build . --tag redriver.azurecr.io/cloudflare-cli:VERSION --push