High availability and operations
Monitor, update, rotate, and recover
Own connector versions, service health, logs, credentials, route inventory, and a tested emergency path.
8 minute lesson
Monitor tunnel and connector health, connection count, origin errors, latency, and route changes. Keep cloudflared updated through a controlled host process.
Inventory every hostname, CIDR, connector host, token owner, policy, and fallback. Rotate a compromised token by revoking it and deploying a new credential to trusted replicas. Test what users see when the connector or origin is unavailable.
Write a runbook for lost connector host, leaked token, bad route, expired origin certificate, and rollback.
Prove that a second connector can serve the same route before maintenance:
cloudflared tunnel info practice-app
systemctl status cloudflared
journalctl -u cloudflared --since '15 minutes ago'Stop one connector and request the application through the public hostname or private route. Rotate credentials in a planned window, then remove the retired connector. Keep an origin-local recovery path so a Cloudflare or identity failure does not lock operators out.
Lesson completed