Roadmap: put the Cloudflare bootstrap owner in charge and keep it current #21

🤖 Generated by the Agentic Engineer

Objective

The Cloudflare resources the platform needs before it can start — the zone, bootstrap DNS, backup storage and scoped service tokens — are owned by this repository, kept current, and recoverable without a running cluster.

Where it stands (read 2026-10-25)

• Built, not yet in charge. The configuration, the no-destructive-plan guard, the decision record and the recovery runbook exist and pass credential-free CI. Nothing live has been imported yet, so the repository does not manage anything today. Making it authoritative needs credentials and a person reading the first plan, which is the open work on Create a declarative Cloudflare bootstrap owner monorepo#3274.
• Current, with updates running. The Cloudflare provider is pinned at 5.28.0 (chore(deps): bump the Cloudflare provider to 5.28.0 #23); 5.28.1 is the newest release (20 October). Dependabot now proposes provider updates (chore(deps): propose Cloudflare provider updates with Dependabot #26, read 2026-10-25): its first run used the OpenTofu registry and is holding 5.28.1 for its seven-day cooldown, and Automate Cloudflare provider updates with a tool that supports OpenTofu lock files #3 stays open until that first proposal passes CI.

Themes, in order

1. Stay current. Done by hand for 5.28.0 (Bump the Cloudflare provider from 5.24.0 to 5.28.0 while automatic updates cannot run #22), before the first import, when a schema change costs nothing to absorb. Dependabot takes over from here; Automate Cloudflare provider updates with a tool that supports OpenTofu lock files #3 tracks its first proposal.
2. Become authoritative safely (maintainer-gated): inventory, import, a human-read no-destroy plan, then the first apply — the checklist on Create a declarative Cloudflare bootstrap owner monorepo#3274.
3. Prove recovery: exercise the runbook from a fresh operator environment with no cluster, and verify a clean drift plan after migration.

Success signal

The provider is within one minor release of upstream, the first apply happened from a reviewed no-destroy plan, and a recovery drill from a clean machine has been recorded.

Not in scope

In-cluster consumers of Cloudflare (issuers, external-dns, backup destinations, egress) stay in devantler-tech/platform.