Polaris CDN Migration

Cluster Runbook Generator — select a cluster, fill in credentials, click Generate. All commands populate and are ready to copy.

🌐 Select Cluster

Cluster

Required — select a cluster

CDN — S3 — R2 —

⚙️ Cluster Configuration — pre-filled on cluster select, click ✏ to edit

POLARIS_URL

Polaris server hostname for this cluster

—

Required

CDN_DOMAIN

Cloudflare custom domain for this cluster's R2 Worker

—

Required

S3_BUCKET

Existing AWS S3 bucket for this cluster

—

Required

R2_BUCKET

New R2 bucket to create (polaris-cdn-<cluster>-r2)

—

Required

R2_LOCATION_HINT

AP1/AP2 → apac · EU1 → eeur · NA1/NA2 → enam

—

Required

🔑 Credentials & Config

🖥️ Polaris

POLARIS_ADMIN_USER per cluster

Polaris admin username for this cluster (used in API curl calls).

Required

POLARIS_ADMIN_PASSWORD per cluster

Polaris admin password for this cluster.

Required

☁️ Cloudflare

CF_ACCOUNT_ID shared across all clusters

Cloudflare dashboard → R2 → Overview (right sidebar). Also: wrangler whoami

Required

CF_API_TOKEN shared across all clusters

CF dashboard → My Profile → API Tokens. Required scopes: R2 Storage Edit, Workers Scripts Edit, Workers Routes Edit.

Required

R2_ACCESS_KEY per cluster bucket

CF dashboard → R2 → Manage R2 API Tokens → Create API Token. One token per cluster.

Required

R2_SECRET_KEY per cluster bucket

Secret key paired with the R2 Access Key above. Shown only once at creation.

Required

🪣 AWS S3

S3_ACCESS_KEY from cluster DB

Run: SELECT site__settings::jsonb -> 'amazonS3Settings' FROM site; — use s3AccessKey.

Required

S3_SECRET_KEY from cluster DB

Same SQL query — use the s3SecretKey field.

Required

⚓ Kubernetes

K8S_NAMESPACE Kubernetes namespace

Verify with: kubectl get pods -A | grep polaris

Required

URL_SIGNING_SECRET generated per cluster

Must be identical in the Cloudflare Worker (step 1.5) and Polaris CDN config (step 2.2). Record it safely.

Required

Step 1 — Set Up Cloudflare

Cloudflare / Wrangler

1.1

Authenticate wrangler

1.2

Create R2 Bucket

1.3

URL Signing Secret

The URL signing secret for this deployment (set as a wrangler secret in step 1.5 and in Polaris config in step 2.2):

1.4

Enable Sippy (Lazy S3 → R2 migration)

1.5

Deploy URL Validator Worker

Update dev/cloudflare/r2-worker/wrangler.toml — edit the [env.prod] block with the values below, then deploy via wrangler.

wrangler.toml — [env.prod] section (two lines to change):

Set wrangler secret and deploy:

1.6

Verify

Step 2 — Point Polaris at Cloudflare

Polaris API / kubectl

2.1

2.2

Configure CDN Domain + Signing Secret

2.3

Restart Polaris Pod

2.4

Post-restart Verification Checklist

Polaris pod is Running and Ready (kubectl get pods -n <namespace>)
GET /api/v1/site/cloudflareR2 returns enabled: true and correct bucket name
GET /api/v1/site/cloudflareR2/cdn returns correct CDN domain and enabled: true
Upload a test app/profile via Polaris UI — verify the asset URL uses the CDN domain (not S3)
Download the asset via the signed CDN URL — confirm HTTP 200
R2 bucket object count is incrementing (Cloudflare dashboard → R2 → polaris-cdn-r2)
Wrangler tail shows 200 responses for signed URL requests: wrangler tail --env prod
No errors in Polaris application logs relating to R2/Cloudflare storage
Sippy status shows active (wrangler r2 bucket sippy get <r2-bucket>)

Click each item to check it off. Checklist state is not persisted.

Rollback

Emergency

Disable Cloudflare R2 in Polaris

Restart Polaris Pod