⚠️ Production runbook — commands execute against live clusters. Verify all values before running.

Polaris CDN Migration

Select a cluster to pre-fill values, edit any field, then click Generate. All commands populate and are ready to copy.

Select Cluster
New Custom Cluster
Enter the cluster ID — all values are auto-generated from it.
Cluster Configuration — pre-filled on cluster select, all fields editable
Polaris server hostname for this cluster. Required
Cloudflare custom domain mapped to the R2 Worker. Must be pre-created in CF dashboard → DNS. Required
Existing AWS S3 bucket for this cluster (source for Sippy migration). Required
New Cloudflare R2 bucket to create (convention: polaris-cdn-<cluster>-r2). Required
AP1/AP2 → apac · EU1 → eeur · NA1/NA2 → enam. Controls R2 data residency. Required

Polaris

Polaris admin username for this cluster (used in API curl calls). Required
Polaris admin password for this cluster. Required

Cloudflare

CF dashboard → R2 → Overview (right sidebar). Also: wrangler whoami Required
CF dashboard → My Profile → API Tokens. Scopes: R2 Storage Edit, Workers Scripts Edit, Workers Routes Edit. Required
CF dashboard → R2 → Manage R2 API Tokens → Create API Token. Required
Secret key paired with the R2 Access Key. Shown only once at creation. Required

AWS S3

Run: SELECT site__settings::jsonb -> 'amazonS3Settings' FROM site; — use s3AccessKey. Required
Same SQL query — use the s3SecretKey field. Required

Kubernetes

Verify with: kubectl get pods -A | grep polaris Required
Must match in the CF Worker (step 1.5) and Polaris config (step 2.2). Record it safely. Required

Step 1 — Set Up Cloudflare

Cloudflare / Wrangler
1.1
Authenticate wrangler

      

    


    

      
1.2
Create R2 Bucket

      

        

      

    


    

      
1.3
URL Signing Secret

      

        
The URL signing secret for this deployment (used in step 1.5 and 2.2):

        

      

    


    

      
1.4
Enable Sippy (Lazy S3 → R2 migration)

      

        

      

    


    

      
1.5
Deploy URL Validator Worker

      

        

          Update dev/cloudflare/r2-worker/wrangler.toml — edit the [env.prod] block with the values below, then deploy.
        

        
wrangler.toml — [env.prod] changes:

        

          

          
        

        
Set wrangler secret and deploy:

        

      

    


    

      
1.6
Verify

      

        

      

    


    

      
Step 2 — Point Polaris at Cloudflare

      Polaris API / kubectl
    


    

      
2.1
Register R2 Bucket

      

        

      

    


    

      
2.2
Configure CDN Domain + Signing Secret

      

        

      

    


    

      
2.3
Restart Polaris Pod

      

        

      

    


    

      
2.4
Post-restart Verification Checklist

      

        
    
          
  • Polaris pod is Running and Ready (kubectl get pods -n <namespace>)
    • 
          
  • GET /api/v1/site/cloudflareR2 returns enabled: true and correct bucket name
    • 
          
  • GET /api/v1/site/cloudflareR2/cdn returns correct CDN domain and enabled: true
    • 
          
  • Upload a test app/profile via Polaris UI — verify asset URL uses the CDN domain (not S3)
    • 
          
  • Download the asset via signed CDN URL — confirm HTTP 200
    • 
          
  • R2 bucket object count is incrementing (CF dashboard → R2 → polaris-cdn-r2)
    • 
          
  • Wrangler tail shows 200 responses: wrangler tail --env prod
    • 
          
  • No errors in Polaris logs relating to R2/Cloudflare storage
    • 
          
  • Sippy status shows active: wrangler r2 bucket sippy get <r2-bucket>
    • 
        

        
Click each item to check it off. State is not persisted.

      

    


    

      
Rollback

      Emergency
    


    

      
R1
Disable Cloudflare R2 in Polaris

      

        

      

    


    

      
R2
Restart Polaris Pod

      

        

      

    


  





Copied to clipboard