From aabb847ce85d8a8928875cbed8c2ed961514eae1 Mon Sep 17 00:00:00 2001
From: Jonathan Gill <jonathan@techize.co.uk>
Date: Tue, 27 Oct 2026 08:51:56 +0000
Subject: [PATCH] fix(cloudflared): pin 2026.10.3 by digest (compromised
 eMudhra certs)

Cloudflare advisory 2026-10-26: versions before 2026.10.2 still trust
eight compromised eMudhra certificates; restarting on an old image does
not fix it. Pin cloudflare/cloudflared:2026.10.3 by digest and keep one
connector up during rollout (maxUnavailable 0 / maxSurge 1).
---
 infrastructure/k8s/cloudflare-tunnel/deployment.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/infrastructure/k8s/cloudflare-tunnel/deployment.yaml b/infrastructure/k8s/cloudflare-tunnel/deployment.yaml
index 19e8eca3..547ae73d 100644
--- a/infrastructure/k8s/cloudflare-tunnel/deployment.yaml
+++ b/infrastructure/k8s/cloudflare-tunnel/deployment.yaml
@@ -5,6 +5,11 @@ metadata:
   namespace: batchivo
 spec:
   replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
   selector:
     matchLabels:
       app: cloudflared
@@ -19,7 +24,7 @@ spec:
         runAsGroup: 65532
       containers:
       - name: cloudflared
-        image: cloudflare/cloudflared:2026.7.3
+        image: cloudflare/cloudflared:2026.10.3@sha256:faa8e0a1475f137c910be6025f43c8e4092fdd35461b31e19fd1390657a1ff39  # fixes compromised eMudhra cert trust (CF advisory 2026-10-26; need >=2026.10.2)
         securityContext:
           allowPrivilegeEscalation: false
           capabilities: