Cloudflare DNS Record

Deploys a single DNS record into an existing Cloudflare DNS zone. The component supports A, AAAA, CNAME, MX, TXT, SRV, NS, and CAA record types, with optional Cloudflare proxy (orange-cloud) mode for A, AAAA, and CNAME records.

What Gets Created

When you deploy a CloudflareDnsRecord resource, OpenMCF provisions:

• DNS Record — a cloudflare_dns_record resource in the specified zone, configured with the given type, value, TTL, proxy setting, and optional priority and comment

Prerequisites

• Cloudflare credentials configured via environment variables or OpenMCF provider config
• An existing Cloudflare DNS zone — either the zone ID as a literal string or a deployed CloudflareDnsZone resource to reference
• Appropriate permissions — the API token must have DNS edit access for the target zone

Quick Start

Create a file dns-record.yaml:

apiVersion: cloudflare.openmcf.org/v1
kind: CloudflareDnsRecord
metadata:
  name: my-record
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: dev.CloudflareDnsRecord.my-record
spec:
  zoneId:
    value: 0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d
  name: www
  type: A
  value: "203.0.113.50"
  proxied: true

Deploy:

openmcf apply -f dns-record.yaml

This creates a proxied A record for www in the specified zone, routing traffic through Cloudflare's CDN and WAF.

Configuration Reference

Required Fields

Optional Fields

Zone ID Reference

The zoneId field accepts either a literal value or a cross-resource reference.

Literal value:

spec:
  zoneId:
    value: 0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d

Reference to a CloudflareDnsZone resource:

spec:
  zoneId:
    valueFrom:
      name: my-zone

When using valueFrom, the kind defaults to CloudflareDnsZone and the fieldPath defaults to status.outputs.zone_id, so only the resource name is required. You may also specify env to reference a zone deployed in a different environment.

Examples

Proxied A Record

An A record with Cloudflare proxy enabled, suitable for a web server:

apiVersion: cloudflare.openmcf.org/v1
kind: CloudflareDnsRecord
metadata:
  name: web-a-record
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: prod.CloudflareDnsRecord.web-a-record
spec:
  zoneId:
    valueFrom:
      name: prod-zone
  name: "@"
  type: A
  value: "198.51.100.10"
  proxied: true
  ttl: 1
  comment: "Production web server"

MX Record for Mail Delivery

An MX record pointing to a mail server, with priority set:

apiVersion: cloudflare.openmcf.org/v1
kind: CloudflareDnsRecord
metadata:
  name: mail-mx-record
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: prod.CloudflareDnsRecord.mail-mx-record
spec:
  zoneId:
    value: 0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d
  name: "@"
  type: MX
  value: aspmx.l.google.com
  priority: 1
  ttl: 3600
  comment: "Google Workspace primary"

TXT Record for SPF

A TXT record at the zone apex defining an SPF policy:

apiVersion: cloudflare.openmcf.org/v1
kind: CloudflareDnsRecord
metadata:
  name: spf-txt-record
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: prod.CloudflareDnsRecord.spf-txt-record
spec:
  zoneId:
    valueFrom:
      name: prod-zone
      env: prod
  name: "@"
  type: TXT
  value: "v=spf1 include:_spf.google.com ~all"
  ttl: 3600
  comment: "SPF for Google Workspace"

Stack Outputs

After deployment, the following outputs are available in status.outputs:

Related Components

• CloudflareDnsZone — manages the parent DNS zone; its zone_id output can be referenced by this component via valueFrom
• CloudflareR2Bucket — may use DNS records for custom domain access
• CloudflareWorker — commonly paired with DNS records pointing to Worker routes
• CloudflareLoadBalancer — load balances traffic across origins, often configured alongside DNS records