Skip to content
Docs

Changelog

New updates and improvements at Cloudflare.

Subscribe to RSS View RSS feeds
Cloudflare Mesh
hero image

  1. High availability replica management for Cloudflare Mesh

    Cloudflare Mesh Cloudflare One

    The Cloudflare Mesh dashboard now shows per-replica details for high availability nodes. You can see which replica is active, view each replica's Mesh IP and connection details, and manually trigger failover — all from the node detail page.

    Mesh HA replica tabs showing active and passive replicas with per-replica Mesh IPs and a manual failover option

    What's new

    • Replica tabs on the node detail page — switch between replicas to see each one's Mesh IP, edge data center, origin IP, platform, version, and uptime.
    • Active/passive badges identify which replica is currently routing traffic.
    • Manual failover — promote a passive replica to active with a single click. The previous active replica switches to standby.
    • HA badge in the overview table identifies nodes running multiple replicas.
    • Active replica IP shown in the overview table — the dashboard now resolves which replica is active and displays the correct Mesh IP.

    Manual failover

    To manually promote a passive replica:

    1. In the Cloudflare dashboard ↗, go to Networking > Mesh.
    2. Select an HA-enabled node.
    3. Select the passive replica tab.
    4. Select Promote to active and confirm.

    Traffic reroutes to the promoted replica immediately. Refer to High availability for details on failover behavior.

  1. Granular permissions for Cloudflare Tunnel and Cloudflare Mesh

    Cloudflare Fundamentals Cloudflare One Cloudflare Tunnel for SASE Cloudflare Tunnel Cloudflare Mesh

    You can now scope Cloudflare permissions to individual Cloudflare Tunnel instances and Cloudflare Mesh nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking.

    What is new

    When you add a member or create a permission policy, the resource picker now lists Cloudflare Tunnel instances and Cloudflare Mesh nodes as scopable resource types. You can:

    • Grant a read-only role on a single Cloudflare Tunnel instance to a support operator for log streaming and diagnostics — without exposing other Tunnels or destructive actions.
    • Grant a write role on a specific Cloudflare Mesh node to an application team — without giving them access to the rest of your private network.
    • Scope a single policy to one or many Tunnels and Mesh nodes at once.

    How it works

    Granular permissions are a parallel layer to existing account-level roles — they do not replace them.

    • Existing account-level roles continue to work. A member with Cloudflare Access or Cloudflare Zero Trust retains write access to every Tunnel and Mesh node in the account. This ensures backward compatibility for existing automation and tokens.
    • Granular permissions are additive. For any API request on a specific Tunnel or Mesh node, access is granted if the principal has either the account-level role or a granular permission for that resource.
    • Resource enumeration is authorization-aware. Listing endpoints (GET /accounts/{id}/cfd_tunnel, GET /accounts/{id}/warp_connector) return only the resources the principal has at least read access to.

    Get started