Purge Cloudflare Cache on Deployment Healthy

Stale CDN cache is the silent failure of an otherwise green deployment: the release ships, health checks pass, yet users keep hitting old HTML, JavaScript, and assets served from Cloudflare edge nodes. This blueprint closes that gap by turning a deploy-healthy event into an automatic Cloudflare cache purge, a fresh-content verification, and a Slack notification, so the cache is invalidated the instant a new release is live instead of waiting on TTL expiry or a manual purge.

How it works

1. A io.kestra.plugin.core.trigger.Webhook trigger named deploy_healthy listens for an HTTP call from your CD system (for example Argo CD reporting Healthy). The webhook is guarded by a secret key.
2. The purge_cache task (io.kestra.plugin.cloudflare.cache.Purge) purges the entire zone with purgeAll: true for the zoneId passed in, using an apiToken injected through pluginDefaults.
3. The verify_site task (io.kestra.plugin.core.http.Request) issues a GET against verify_url to confirm the site is serving after the purge.
4. The notify task (io.kestra.plugin.slack.notifications.SlackIncomingWebhook) posts a message reporting the purged zone and the HTTP status code returned by the verification probe.

What you get

• Zero-stale releases: users fetch the new build as soon as the deploy is healthy.
• A built-in smoke check via outputs.verify_site.code confirming the site responds post-purge.
• Slack visibility for every purge, including the zone and verification result.
• A reusable, secret-driven flow that any CD system can call.

Who it's for

• Platform and DevOps engineers wiring CDN invalidation into delivery pipelines.
• SRE teams who want deploy-time cache purges with an audit trail.
• Frontend and web teams shipping behind Cloudflare who need fresh content on release.

Why orchestrate this with Kestra

Cloudflare itself has no concept of "a deployment just finished," so its cache only clears on TTL or a manual API call. Kestra bridges that gap with an event-driven Webhook trigger, automatic retries on transient API failures, full execution lineage and logs for every purge, and a declarative YAML definition you version alongside your infrastructure. The purge, verification, and notification become one observable, replayable pipeline rather than a fragile post-deploy script.

Prerequisites

A CD system (Argo CD, GitHub Actions, GitLab CI, or similar) able to POST to the Kestra webhook URL when a deploy reaches a healthy state, and a Cloudflare zone.

Secrets

• CLOUDFLARE_API_TOKEN: Cloudflare API token with cache purge permission.
• CLOUDFLARE_PURGE_WEBHOOK_KEY: secret key that guards the webhook trigger.
• SLACK_WEBHOOK_URL: Slack incoming webhook URL for notifications.

Quick start

1. Add the three secrets above to your Kestra namespace.
2. Point your CD post-sync hook (for example Argo CD notifications) at the Kestra webhook URL.
3. Pass zone_id and verify_url in the webhook body, or run the flow manually to test.

How to extend

• Replace purgeAll: true with file or tag based purges for surgical invalidation.
• Add a conditional Slack message or PagerDuty alert when outputs.verify_site.code is not 200.
• Chain a downstream cache warm-up by requesting key URLs after the purge.
• Fan out across multiple zones by looping the purge task over a list of zone IDs.

Links

• Cloudflare plugin documentation
• Cloudflare orchestration with Kestra