TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Infrastructure as Code with Terraform

16 posts · Dec 2016 – Sep 2026

What this trail covers

Cloudflare's platform is expanding to offer a comprehensive CI/CD solution, integrating code storage (Artifacts), build/test/deploy pipelines (Workflows, CI SDK), and self-healing capabilities powered by AI agents. This allows for platform-managed or custom CI pipelines, running code in isolated sandbox environments with dependency caching and automated deployment upon successful builds. The integration aims to simplify the developer experience for managing millions of repositories. Workers Build

All Cloudflare trails
  1. Introducing Worker Previews: isolated preview environments for every change your agent makesIntroduces Worker Previews, an isolated environment for each Git branch to test changes before production. Each Preview gets its own code, configuration, URL, observability, and state, including isolated Durable Objects and Containers. This enables an Agent Development Lifecycle (ADLC) with atomic, independently deployable, observable, and revisable changes. Previews can be configured with a base configuration and overridden as needed, and Preview URLs can be served on custom domains and protected with Cloudflare Access. This feature aims to improve the reliability and safety of code deployments, especially in agent-assisted development workflows.
  2. Run CI/CD for millions of repos — on your platform, on CloudflareThis post introduces the CI SDK, built on Cloudflare Workflows, enabling users to define CI/CD pipelines in TypeScript. It details how to automate builds, run linters/typechecks, cache dependencies, execute unit tests, integrate AI agents for self-healing, and deploy conditionally. The integration with Artifacts allows triggering Workflows directly on push events, simplifying the setup compared to previous event subscription methods. It also highlights the use of the Sandbox SDK for isolated execution and dependency caching for reduced latency.
  3. Artifacts: versioned storage that speaks GitIntroduces Artifacts, a new versioned filesystem service that speaks Git, designed for agents and applications. Artifacts allows programmatic creation of Git repositories, import from existing Git repositories, and forking of repositories for isolated environments. It is built on Durable Objects and a custom Zig-based Git server compiled to WebAssembly. Also introduces ArtifactFS, an open-source filesystem driver for mounting large Git repositories asynchronously by hydrating file contents on demand.
  4. Building a CLI for all of CloudflareThis post introduces a significant evolution in Cloudflare's IaC strategy by announcing the rebuilding of the Wrangler CLI to become a unified interface for all Cloudflare products. It introduces a new TypeScript schema for defining APIs, CLI commands, and bindings, enabling code generation for multiple interfaces including the CLI, SDKs, Terraform, and documentation. The post also announces 'Local Explorer,' a new feature for local development that mirrors the Cloudflare API for simulated resources, enhancing agent-based development workflows.
  5. A one-line Kubernetes fix that saved 600 hours a yearThis post details a specific Kubernetes configuration issue related to `fsGroup` and `fsGroupChangePolicy` that caused significant delays during pod restarts for the Atlantis StatefulSet. The issue stemmed from the default `Always` setting for `fsGroupChangePolicy`, which recursively changed volume ownership on every mount, becoming a bottleneck for large persistent volumes. The fix involved changing this policy to `OnRootMismatch`, reducing restart times from 30 minutes to 30 seconds and reclaiming approximately 600 engineering hours per year. This highlights how default Kubernetes settings can become performance bottlenecks at scale, particularly with large persistent volumes.
  7. Code Orange: Fail Small — our resilience plan following recent incidentsThis post introduces the 'Code Orange: Fail Small' initiative, a comprehensive plan to enhance network resilience following recent major outages. It directly extends the Infrastructure as Code theme by proposing to apply the same controlled rollout and Health Mediated Deployment (HMD) principles used for software releases to configuration changes. This includes requiring controlled rollouts for all configuration changes, reviewing and improving failure modes between critical services, and overhauling 'break glass' procedures for faster incident resolution. The post highlights the critical need to treat configuration changes with the same rigor as code deployments to prevent future widespread incidents.
  8. Shifting left at enterprise scale: how we manage Cloudflare with Infrastructure as CodeThis post details Cloudflare's internal adoption of Infrastructure as Code (IaC) for managing hundreds of internal production Cloudflare accounts. It outlines the "shift left" principles applied, the use of Terraform with the Cloudflare provider, Atlantis for CI/CD, tfstate-butler for secure state management, and Open Policy Agent (OPA) with Rego for defining and enforcing security baselines. It also discusses challenges like importing existing configurations, handling configuration drift with a custom detection service, and the evolution of the Terraform provider.
  9. Finding the grain of sand in a heap of SaltThis post details the critical role of configuration management tools like Salt in maintaining Cloudflare's IaC-driven infrastructure. It explains how Salt failures can cause release delays and introduces the development of a self-service system to diagnose and resolve these failures by correlating them with git commits, external service failures, and ad hoc releases. This enhances the overall integrity, traceability, and efficiency of infrastructure management.
  10. Let’s DO this: detecting Workers Builds errors across 1 million Durable ObjectsThis post details the development of an automated error detection system for Cloudflare Workers Builds. The system leverages Workers Queues to process build logs, identify failure patterns using static regex matchers and normalization logic, and categorize errors into specific codes and groups. It also addresses the challenge of analyzing historical build failures by processing logs stored across over a million Durable Objects, demonstrating a proactive approach to improving CI/CD reliability.
  11. A steam locomotive from 1993 broke my yarn testThis post details a complex debugging scenario encountered while setting up a local development environment for the Backstage project. The author describes a persistent 27-second timeout error with `yarn test` on a Linux system, which was not present on macOS. Through extensive troubleshooting, including shell history analysis, Jest flag experimentation, and the use of `strace`, the author identified the issue as a system-level timeout related to `epoll_wait` and `SIGCHLD` signals, potentially linked to filesystem watchers or process management. The post emphasizes the importance of detailed system-level analysis and collaborative debugging in resolving intricate development environment issues, which indirectly supports the broader theme of robust infrastructure management and development practices.
  12. Workers Builds: integrated CI/CD built on the Workers platformIntroduced Workers Builds, a new CI/CD system built entirely on the Workers platform. This system leverages Durable Objects for build management (Scheduler DO and BuildBuddy DO) and a Client Worker for configuration, connecting to a PostgreSQL database via Hyperdrive for build metadata. It automates the build and deployment process for Workers and full-stack applications by integrating with GitHub/GitLab repositories. The system addresses the design problem of picking up commits and running containerized build jobs with minimal latency and secure log storage.
  13. Automatically generating Cloudflare’s Terraform providerCloudflare has automated the generation of its Terraform provider from OpenAPI schemas, aligning it with the SDK ecosystem. This migration involved transitioning from terraform-plugin-sdk (SDKv2) to terraform-plugin-framework to reliably handle three-state boolean values and improve developer experience. The process also involved porting the existing acceptance test suite to validate the generated provider and identify bugs in the generation pipeline.
  14. How Cloudflare uses Terraform to manage CloudflareThis post details Cloudflare's internal use of the Terraform provider for managing its own Cloudflare accounts. It outlines best practices for using Terraform for configuration management, including peer reviews, auditability, API token management, and rapid deployment of large changes. It also introduces Atlantis for CI/CD integration and a new Zero Trust Dashboard toggle for API/Terraform read-only mode. Specific code snippets for account membership management are provided.
  15. Our growing Developer Platform partner ecosystemThis post announces a growing ecosystem of partners for Cloudflare's Developer Platform, focusing on source, build, deploy, database, and observability integrations. It highlights partnerships with GitLab and GitHub for DevOps, and with Contentful, Sanity, and Strapi for headless CMS integrations, enabling automated deployments via deploy hooks. It also details database partnerships with Macrometa and Fauna, and observability partnerships with Splunk, Datadog, Sumo Logic, New Relic, and Sentry, emphasizing end-to-end visibility and debugging capabilities for applications built on Cloudflare Workers.
  16. The Cloudflare Bug Bounty program and Cloudflare PagesThis post details the discovery and remediation of six security vulnerabilities in Cloudflare Pages, primarily related to command injection and API key disclosure during the build and publishing processes. The vulnerabilities stemmed from issues in build initialization logic, input validation, file permissions, and the use of Azure Pipelines with privileged containers. The team responded by patching vulnerabilities, rotating secrets, and significantly re-architecting the build infrastructure, migrating from Azure Pipelines to Kubernetes and adopting gVisor for enhanced isolation of untrusted code execution. A specific vulnerability related to missing iptables rules in the Kubernetes control plane also led to the notification of all impacted Cloudflare Pages customers.
  17. wrangler 2.0 — a new developer experience for Cloudflare WorkersThis post introduces wrangler 2.0, a significant upgrade to the Cloudflare Workers developer tooling. Key improvements include a no-config setup for new Workers, live remote debugging capabilities, and a local development mode powered by Miniflare. The new experience aims to streamline onboarding and accelerate development cycles by providing an out-of-the-box, lightning-fast development environment that can run Workers locally or on the Cloudflare network with seamless switching and debugging.
  18. Automating Cloudflare Tunnel with TerraformThis post details how to automate the creation and management of Cloudflare Tunnels using Terraform. It introduces Named Tunnels and their API, enabling programmatic tunnel creation and credential management. The post provides a practical example of configuring a GCP instance with a startup script that dynamically generates tunnel credentials and configuration files, integrating with Cloudflare Tunnel's ingress rules and Cloudflare Access for Zero Trust policies. It highlights the benefits of IaC for tunnel management, including auto-scaling, dynamic resource provisioning, and CI/CD pipeline integration.
  19. Cloudflare’s Partnership with HashiCorp and Bootstrapping Terraform with Cf-TerraformingThis post announces an update to cf-terraforming, Cloudflare's tool for bootstrapping Terraform configurations from existing Cloudflare resources. The new version leverages terraform-exec and the provider's JSON schema for more automated generation of Terraform configuration (tfconfig). It also simplifies tfstate management by outputting `terraform import` commands instead of generating tfstate files directly. This reduces duplication of effort when Cloudflare APIs or Terraform change, and simplifies the workflow for developers migrating existing Cloudflare configurations to Terraform.
  20. Automating data center expansions with AirflowCloudflare built a Provisioning-as-a-Service (PraaS) platform using Apache Airflow to automate the installation of new servers into their data centers. This involved replacing manual SOP steps with API calls to Salt, Prometheus, Thanos, and other internal systems, organized as tasks within Airflow DAGs. Custom Airflow operators were developed to integrate with these systems, and features like failure handling, comprehensive logging, notifications, Jinja templating, and macros were implemented. Sensors were used to manage preconditions and human intervention, and reusable DAGs were created to handle complex workflows and scale across over 200 data centers by parameterizing DAGs.
  21. Terraforming Cloudflare: in quest of the optimal setupThis post details Workable's journey in adopting Infrastructure as Code (IaC) for managing Cloudflare configurations using Terraform and Terragrunt. It outlines their approach to structuring Terraform modules, managing multiple organizations and zones, and implementing static, parameterized, and dynamic resource management strategies. Specific examples include managing access rules, zone settings overrides, account members, and rate limits, highlighting the trade-offs and evolution of their IaC practices.
  22. A Full CI/CD Pipeline for Workers with Travis CIThis post details the setup of a CI/CD pipeline for Cloudflare Workers using Travis CI, Serverless Framework, and GitHub. It outlines the necessary files (worker.js, serverless.yml, .travis.yml), provides code examples for the Worker script and tests, and explains the configuration of Travis CI with environment variables for deployment. The contribution is the practical demonstration of automating the deployment of Workers through a CI/CD workflow.
  23. Introducing Cf-TerraformingIntroduced cf-terraforming, an open-source utility to export existing Cloudflare configurations (zones, DNS records, Spectrum applications, etc.) into Terraform-compliant configuration files. This tool simplifies the migration of existing Cloudflare setups to Infrastructure as Code (IaC) managed by Terraform.
  24. Deploy Workers using TerraformThis post introduces the integration of Cloudflare Workers with Terraform, enabling infrastructure-as-code management for Workers scripts and routes. It details how to configure the Cloudflare Terraform provider, define worker scripts and routes using `cloudflare_worker_script` and `cloudflare_worker_route` resources, and apply these configurations using `terraform apply`. It also covers importing existing workers into Terraform management.
  25. Getting started with Terraform and Cloudflare (Part 2 of 2)This post continues the walkthrough of using Terraform with Cloudflare by demonstrating how to add load balancing, page rules, and review/rollback configuration. It introduces adding multiple DNS records for the same hostname, configuring Cloudflare Load Balancing with health checks, pools, and origins, and utilizing geo steering for traffic management. It also covers reviewing and rolling back Terraform configurations using Git.
  26. Getting started with Terraform and Cloudflare (Part 1 of 2)This post introduces the Cloudflare Terraform provider, version 1.0, which extends support beyond DNS records to include Zone Settings, Rate Limiting, and Load Balancing. It details the installation of Terraform, the creation of a basic configuration file (`cloudflare.tf`) for managing DNS records, the initialization of Terraform with the Cloudflare provider, and the process of reviewing and applying changes using `terraform plan` and `terraform apply`. It also emphasizes using environment variables for authentication to maintain security best practices when storing configurations in source control.
  27. Manage Cloudflare records with SaltThis post introduces the Cloudflare Salt module, enabling the management of Cloudflare DNS records using SaltStack. This allows for DNS records to be treated as configuration, providing a single source of truth, peer-reviewed and versioned changes, and making these capabilities available to customers. The module supports managing zone records with authentication details and record configurations, with plans to extend Salt management to other Cloudflare settings like WAF, caching, and page rules.