Keep outbound tunnel connectors outside scale-to-zero app inventory

An outbound tunnel can remain available while application workloads are scaled to zero if the connector is treated as separate edge infrastructure. Put connectors in their own namespace, expose no Kubernetes LoadBalancer, Ingress, or Gateway, use multiple zone-spread replicas with disruption protection, mount the tunnel token as a read-only file, and terminate remote ingress rules with an explicit 404. The application namespaces and admission fence remain the authority for whether work may start. This avoids request-triggered compute, but the tunnel and identity layer become availability dependencies.

Applies when: A Kubernetes service needs private origin ingress while only one provider may run. Keywords: Cloudflare Tunnel Kubernetes scale zero namespace LoadBalancer token file high availability