Conrad DevOps

Train

Cloudflare at the edge

What Cloudflare does in front of Conrad's storefront and why the app runs on GKE rather than Workers, with answers to the open questions in your notes — WAF, Snippets, the CF-Device-Type header, Cloudflare Access, Apigee and the 512-character limit — and edge versus origin caching.
Cloudflare SnippetsCache by device typeCloudflare WAFWhat is Apigee

From the "Why not Cloudflare" and "What do they use Cloudflare for" parts of your Conrad DevOps note, including the questions you left open there.

Know

  • Cloudflare's role: entry point for every request (DNS and proxy), bot checks, the WAF, and the CDN for static assets. The app runs on GKE.
  • Why not Workers for the app: pods keep pooled connections to Valkey; a Worker's connections are request-scoped, so every request would connect to Redis in Google Cloud first.
  • WAF: an application-layer firewall for HTTP: managed and custom rules against SQL injection, XSS and known exploits, plus rate limiting.
  • Snippets: small JavaScript functions for requests matching a rule, for header changes, redirects and token checks; Pro plan and above; 5 ms, 2 MB and 32 KB limits.
  • CF-Device-Type: sent to the origin as mobile, tablet or desktop when caching by device type is on, for rendering and cache variants.
  • Cloudflare Access: a Zero Trust gate; requests without a valid identity or service token are rejected at the edge.
  • Apigee: Google Cloud's API management: proxies with auth, quotas, transformations, analytics and a ResponseCache policy.
  • The 512-character comment: Cloudflare limits include 32 KB URLs (414 beyond), 512-byte Workers KV keys and 1,024-character cache tags; ask which one applies.

Fact check of your notes

Gotcha· Nothing to correct, but do not guess the 512 limit

The notes are accurate. The one point to handle carefully is the 512-character limit: Cloudflare documents several length limits, and only Conrad's code history says which one the comment refers to. Ask, and say how you would encode such a limit.

Exercise

Exercise
  • Explain WAF, Snippets, Access and Apigee to a friend in one sentence each, without notes.
  • Prepare your answer to "why don't we just run the storefront on Workers?" using your Develit experience on both sides of the argument.

Be able to say

Be able to say· Why does the storefront run on GKE behind Cloudflare rather than on Cloudflare Workers?

"Because of the cache. Each Nuxt pod is a long-lived process with a pool of open connections to Valkey, so a cache hit costs one round trip. A Worker is request-scoped: its connections cannot be reused across requests, so every request would first open a connection to Redis in Google Cloud, which throws away the edge's advantage. Add the existing GCP setup, with GKE, Apigee and Terraform. Cloudflare still does what it is best at, in front: bot protection, the WAF and the asset CDN. I know the Workers side well from Develit, where it fit, because there was nothing shared to cache."

Be able to say· What do Snippets, Access and Apigee each do?

"Snippets are tiny edge functions for request and response tweaks, such as headers, redirects or token checks, with strict limits of 5 milliseconds and 32 kilobytes. Access is Cloudflare's Zero Trust gate in front of internal apps and APIs: people sign in through an identity provider, machines use service tokens, and everyone else is rejected at the edge. Apigee is Google's API gateway in front of the backend services: authentication, quotas, transformations, analytics, and it can cache responses."

Your notes

Open in Notes

Nothing yet. Notes filed here show up on this page and the section overview.

Conrad DevOps

Preparation for the platform part of the Conrad interview, written from your Conrad DevOps note — Cloudflare at the edge, the GitLab to GKE pipeline, Docker and Kubernetes, monitoring and A/B testing, your Develit architecture to compare, and the questions to ask them.

CI/CD pipeline

How a change reaches Conrad's production — GitLab CI tests and lint, Kaniko builds the image, assets go to Cloud Storage behind the CDN, Terraform reads secrets and applies the Helm release, and GKE rolls out the pods — plus image tags, deploy ordering and build-once runtime configuration.