Setting custom prefix to tunnel subdomain CNAME

[whatnick]

API Token has been generated with recommended settings and zone can be extracted from CLI. However token validation apparently fails.

Also tries to create the tunnel twice with newTunnel settings. Would be useful to fetch tunnel credentials somehow if tunnel already exists or exercise the delete API automatically to cycle it.

Error below :

2026-01-10T13:17:54Z	ERROR	Failed to validate API credentials	{"controller": "clustertunnel", "controllerGroup": "networking.cfargotunnel.com", "controllerKind": "ClusterTunnel", "ClusterTunnel": {"name":"mc-tunnel"}, "namespace": "", "name": "mc-tunnel", "reconcileID": "399b4dab-5c52-4dbe-8f20-959503b53c6e", "error": "error fetching Zone ID by Zone Name"}

[whatnick]

This was due to supplied DNS needing to be an ANAME rather than target CNAME. The question is now more like what is the recommended current approach to the custom CNAME subdomain as requested by #66. The annotation on the service does not quite work.

[adyanth]

Custom subdomains are still a thing after migration to CRDs. See https://github.com/adyanth/cloudflare-operator/blob/main/api/v1alpha1/tunnelbinding_types.go#L36-L41. Service annotations were deprecated, see https://github.com/adyanth/cloudflare-operator/blob/main/docs/migrations/operator/v0.9.md

❯ k explain tunnelbinding.subjects.spec.fqdn
GROUP:      networking.cfargotunnel.com
KIND:       TunnelBinding
VERSION:    v1alpha1

FIELD: fqdn <string>


DESCRIPTION:
    Fqdn specifies the DNS name to access this service from.
    Defaults to the service.metadata.name + tunnel.spec.domain.
    If specifying this, make sure to use the same domain that the tunnel belongs
    to.
    This is not validated and used as provided

Does that answer your use case? ANAMEs are not supported directly by the tunnel.