Reconcile Multi-Zone Cloudflare DNS from a Git Manifest

Manage Cloudflare DNS the GitOps way: keep one JSON manifest of desired records per zone in a Git repository and let Kestra reconcile your live zones to match. This blueprint clones the manifest repo, lists your Cloudflare account zones for an auditable scope, then iterates every managed zone and applies its declared record set in a single batch API call. It solves DNS drift, ad hoc dashboard edits, and the lack of version control and review that comes with manually clicking through the Cloudflare UI across dozens of zones.

How it works

1. io.kestra.plugin.git.Clone clones the manifest repository from inputs.manifest_repo on inputs.manifest_branch into the manifest directory.
2. io.kestra.plugin.cloudflare.zones.List lists the account's zones so the reconciliation scope is captured and auditable.
3. io.kestra.plugin.core.flow.ForEach iterates over inputs.zones, and for each zone ID an io.kestra.plugin.cloudflare.dns.records.Batch task reads manifest/manifest/<zoneId>.json, parses it with fromJson, and submits the records as posts in one batch request.
4. The io.kestra.plugin.core.trigger.Schedule trigger (cron */30 * * * *, disabled by default) can run the reconciliation continuously so DNS converges toward what Git declares.

What you get

• A single source of truth for DNS across many Cloudflare zones, versioned in Git.
• One batch API call per zone instead of dozens of individual record edits.
• An audit trail of the account zones at each run via the list_zones task.
• A scheduled, hands-off reconciliation loop you can enable when ready.

Who it's for

• Platform and infrastructure engineers managing DNS at scale.
• SRE and DevOps teams adopting GitOps for network configuration.
• Anyone tired of manual, unreviewed edits in the Cloudflare dashboard.

Why orchestrate this with Kestra

Cloudflare's dashboard and API have no built-in scheduler, no retry policy, and no lineage across zones. Kestra adds event and schedule triggers, automatic retries, full execution history, and declarative YAML you can review in pull requests. The ForEach task fans the work out per zone with isolated, traceable subflows, something the Cloudflare API alone cannot coordinate or replay.

Prerequisites

Secrets

• CLOUDFLARE_API_TOKEN: a Cloudflare API token with DNS edit and zone read permissions, used by both the zones.List and dns.records.Batch tasks.

Additionally, a Git repository containing one manifest/<zoneId>.json file per zone, where each file is a JSON array of record objects (for example type, name, content, ttl, proxied).

Quick start

1. Set CLOUDFLARE_API_TOKEN in your Kestra namespace secrets.
2. Create a manifest/<zoneId>.json file for each zone you manage in your Git repo.
3. Run the flow, passing manifest_repo, manifest_branch, and the list of zone IDs in zones.
4. Enable the reconcile_on_schedule trigger once you are happy with the dry results.

How to extend

• Add patch and delete operations to the Batch task so the flow fully converges (not just creates) records.
• Send a Slack or email notification summarizing per-zone results after each run.
• Diff the live zones from list_zones against the manifest and alert on drift.
• Gate changes behind a manual approval step before applying to production zones.

Links

• Plugin docs: https://kestra.io/plugins/plugin-cloudflare
• Orchestrate Cloudflare with Kestra: https://kestra.io/orchestration/cloudflare