From 22ad47418fcce6ffe270b93ffa0d948c707cddaf Mon Sep 17 00:00:00 2001
From: Devin Buhl <devin@buhl.casa>
Date: Sun, 14 Apr 2024 14:47:00 -0400
Subject: [PATCH] feat: drop support for web/dashboard created cloudflare
 tunnel

Signed-off-by: Devin Buhl <devin@buhl.casa>
---
 .../cloudflared/app/helmrelease.yaml.j2       |  7 -----
 .../cloudflared/app/secret.sops.yaml.j2       |  3 --
 config.sample.yaml                            | 29 ++++++++-----------
 3 files changed, 12 insertions(+), 27 deletions(-)

diff --git a/bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2
index 898f4f86..ca7fd3ff 100644
--- a/bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2
@@ -44,13 +44,6 @@ spec:
                   secretKeyRef:
                     name: cloudflared-secret
                     key: TUNNEL_ID
-              #% if bootstrap_cloudflare.tunnel.token %#
-              TUNNEL_TOKEN:
-                valueFrom:
-                  secretKeyRef:
-                    name: cloudflared-secret
-                    key: TUNNEL_TOKEN
-              #% endif %#
             args:
               - tunnel
               - --config
diff --git a/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2
index 0d32339d..67d169ed 100644
--- a/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2
@@ -5,9 +5,6 @@ metadata:
   name: cloudflared-secret
 stringData:
   TUNNEL_ID: "#{ bootstrap_cloudflare.tunnel.id }#"
-  #% if bootstrap_cloudflare.tunnel.token %#
-  TUNNEL_TOKEN: "#{ bootstrap_cloudflare.tunnel.token }#"
-  #% endif %#
   credentials.json: |
     {
       "AccountTag": "#{ bootstrap_cloudflare.tunnel.account_id }#",
diff --git a/config.sample.yaml b/config.sample.yaml
index ce0189e5..4b5c6eb9 100644
--- a/config.sample.yaml
+++ b/config.sample.yaml
@@ -99,7 +99,7 @@ bootstrap_tls_sans: []
 # (Required) Age Public Key (e.g. age1...)
 # 1. Generate a new key with the following command:
 #    > task sops:age-keygen
-# 2. Copy the public key and paste it below
+# 2. Copy the PUBLIC key and paste it below
 bootstrap_sops_age_pubkey: ""
 
 # (Optional) Use cilium BGP control plane when L2 announcements won't traverse VLAN network segments.
@@ -139,7 +139,7 @@ bootstrap_github_webhook_token: ""
 #   1. Generate a new key with the following command:
 #      > ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f github-deploy.key -q -P ""
 #   2. Make sure to paste public key from "github-deploy.key.pub" into
-#      the deploy keys section of your repository settings.
+#      the deploy keys section of your GitHub repository settings.
 #   3. Uncomment and paste the private key below
 #   4. Optionally set your repository on GitHub to private
 # bootstrap_github_private_key: |
@@ -189,25 +189,20 @@ bootstrap_cloudflare:
   gateway_vip: ""
   # (Required) Options for Cloudflare Tunnel
   # There's two methods to create a tunnel, via the CLI or the Cloudflare dashboard.
-  #   CLI:
-  #     1. Authenticate cloudflared to your domain
-  #        > cloudflared tunnel login
-  #     2. Create the tunnel
-  #        > cloudflared tunnel create k8s
-  #     3. Copy the AccountTag, TunnelID, and TunnelSecret from the tunnel configuration file and paste them below
-  #   Dashboard:
-  #     1. Goto https://one.dash.cloudflare.com/ and create a new tunnel
-  #     2. Paste the tunnel id and token below (ignore account_id and secret)
+  #   1. Authenticate cloudflared to your domain with the following command:
+  #     > cloudflared tunnel login
+  #   2. Create the tunnel with the following command:
+  #     > cloudflared tunnel create k8s
   tunnel:
-    # (Required) Cloudflared Tunnel ID
-    # If the tunnel was created by the CLI: (cat ~/.cloudflared/*.json | jq -r .TunnelID)
+    # (Required) Get the Cloudflared Tunnel ID with the following command:
+    #   > jq -r .TunnelID ~/.cloudflared/*.json
     id: ""
-    # (Required: CLI) Cloudflare Account ID: (cat ~/.cloudflared/*.json | jq -r .AccountTag)
+    # (Required) Get the Cloudflare Account ID with the following command:
+    #   > jq -r .AccountTag ~/.cloudflared/*.json
     account_id: ""
-    # (Required: CLI) Cloudflared Tunnel Secret: (cat ~/.cloudflared/*.json | jq -r .TunnelSecret)
+    # (Required) Get the Cloudflared Tunnel Secret with the following command:
+    #   > jq -r .TunnelSecret ~/.cloudflared/*.json
     secret: ""
-    # (Optional: Dashboard) Cloudflared Tunnel Token managed via the Cloudflare dashboard, Dashboard take higher priority over locally managed tunnel
-    token: ""
     # (Required) Provide WAN access to the cluster ingresses for external ingress classes
     # The Load balancer IP for external ingress, choose an available IP
     #   in your nodes host network that is NOT being used. This is announced over L2.