diff --git a/apis/cloud/v1alpha1/credential_types.go b/apis/cloud/v1alpha1/credential_types.go
index 6551f43c..945d57d4 100644
--- a/apis/cloud/v1alpha1/credential_types.go
+++ b/apis/cloud/v1alpha1/credential_types.go
@@ -26,23 +26,25 @@ const (
 	ResourceCredentials    = "credentials"
 )
 
-// +kubebuilder:validation:Enum=Aws;Azure;AzureStorage;DigitalOcean;GoogleCloud;GoogleOAuth;Linode;Packet;Rancher;Scaleway;Vultr;Swift;Hetzner
+// +kubebuilder:validation:Enum=Aws;Azure;AzureStorage;CloudflareStorage;DigitalOcean;GoogleCloud;GoogleOAuth;Hetzner;HetznerStorage;Linode;Packet;Rancher;Scaleway;Vultr;Swift;Hetzner
 type CredentialType string
 
 const (
-	CredentialTypeAWS          CredentialType = "Aws"
-	CredentialTypeAzure        CredentialType = "Azure"
-	CredentialTypeAzureStorage CredentialType = "AzureStorage"
-	CredentialTypeDigitalOcean CredentialType = "DigitalOcean"
-	CredentialTypeGoogleCloud  CredentialType = "GoogleCloud"
-	CredentialTypeGoogleOAuth  CredentialType = "GoogleOAuth"
-	CredentialTypeLinode       CredentialType = "Linode"
-	CredentialTypePacket       CredentialType = "Packet"
-	CredentialTypeRancher      CredentialType = "Rancher"
-	CredentialTypeScaleway     CredentialType = "Scaleway"
-	CredentialTypeVultr        CredentialType = "Vultr"
-	CredentialTypeSwift        CredentialType = "Swift"
-	CredentialTypeHetzner      CredentialType = "Hetzner"
+	CredentialTypeAWS               CredentialType = "Aws"
+	CredentialTypeAzure             CredentialType = "Azure"
+	CredentialTypeAzureStorage      CredentialType = "AzureStorage"
+	CredentialTypeCloudflareStorage CredentialType = "CloudflareStorage"
+	CredentialTypeDigitalOcean      CredentialType = "DigitalOcean"
+	CredentialTypeGoogleCloud       CredentialType = "GoogleCloud"
+	CredentialTypeGoogleOAuth       CredentialType = "GoogleOAuth"
+	CredentialTypeHetzner           CredentialType = "Hetzner"
+	CredentialTypeHetznerStorage    CredentialType = "HetznerStorage"
+	CredentialTypeLinode            CredentialType = "Linode"
+	CredentialTypePacket            CredentialType = "Packet"
+	CredentialTypeRancher           CredentialType = "Rancher"
+	CredentialTypeScaleway          CredentialType = "Scaleway"
+	CredentialTypeVultr             CredentialType = "Vultr"
+	CredentialTypeSwift             CredentialType = "Swift"
 )
 
 // +genclient
@@ -72,12 +74,18 @@ type CredentialSpec struct {
 	//+optional
 	AzureStorage *AzureStorageCredential `json:"azureStorage,omitempty"`
 	//+optional
+	CloudflareStorage *CloudflareStorageCredential `json:"cloudflareStorage,omitempty"`
+	//+optional
 	DigitalOcean *DigitalOceanCredential `json:"digitalocean,omitempty"`
 	//+optional
 	GoogleCloud *GoogleCloudCredential `json:"googleCloud,omitempty"`
 	//+optional
 	GoogleOAuth *GoogleOAuthCredential `json:"googleOAuth,omitempty"`
 	//+optional
+	Hetzner *HetznerCredential `json:"hetzner,omitempty"`
+	//+optional
+	HetznerStorage *HetznerStorageCredential `json:"hetznerStorage,omitempty"`
+	//+optional
 	Linode *LinodeCredential `json:"linode,omitempty"`
 	//+optional
 	Packet *PacketCredential `json:"packet,omitempty"`
@@ -89,8 +97,6 @@ type CredentialSpec struct {
 	Swift *SwiftCredential `json:"swift,omitempty"`
 	//+optional
 	Vultr *VultrCredential `json:"vultr,omitempty"`
-	//+optional
-	Hetzner *HetznerCredential `json:"hetzner,omitempty"`
 }
 
 type GoogleOAuthCredential struct {
@@ -163,11 +169,23 @@ type SwiftCredential struct {
 	TenantId      string `json:"tenantID,omitempty"`
 	TenantDomain  string `json:"tenantDomain,omitempty"`
 }
+
 type HetznerCredential struct {
 	SSHKeyName string `json:"sshKeyName"`
 	Token      string `json:"token"`
 }
 
+type HetznerStorageCredential struct {
+	AccessKeyID     string `json:"accessKeyID"`
+	SecretAccessKey string `json:"secretAccessKey"`
+}
+
+type CloudflareStorageCredential struct {
+	AccountID       string `json:"accountID"`
+	AccessKeyID     string `json:"accessKeyID"`
+	SecretAccessKey string `json:"secretAccessKey"`
+}
+
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +kubebuilder:object:root=true
 type CredentialList struct {
diff --git a/apis/cloud/v1alpha1/zz_generated.deepcopy.go b/apis/cloud/v1alpha1/zz_generated.deepcopy.go
index 15e341a9..b51ba2e8 100644
--- a/apis/cloud/v1alpha1/zz_generated.deepcopy.go
+++ b/apis/cloud/v1alpha1/zz_generated.deepcopy.go
@@ -163,6 +163,22 @@ func (in *CloudProviderSpec) DeepCopy() *CloudProviderSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CloudflareStorageCredential) DeepCopyInto(out *CloudflareStorageCredential) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CloudflareStorageCredential.
+func (in *CloudflareStorageCredential) DeepCopy() *CloudflareStorageCredential {
+	if in == nil {
+		return nil
+	}
+	out := new(CloudflareStorageCredential)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Credential) DeepCopyInto(out *Credential) {
 	*out = *in
@@ -242,6 +258,11 @@ func (in *CredentialSpec) DeepCopyInto(out *CredentialSpec) {
 		*out = new(AzureStorageCredential)
 		**out = **in
 	}
+	if in.CloudflareStorage != nil {
+		in, out := &in.CloudflareStorage, &out.CloudflareStorage
+		*out = new(CloudflareStorageCredential)
+		**out = **in
+	}
 	if in.DigitalOcean != nil {
 		in, out := &in.DigitalOcean, &out.DigitalOcean
 		*out = new(DigitalOceanCredential)
@@ -257,6 +278,16 @@ func (in *CredentialSpec) DeepCopyInto(out *CredentialSpec) {
 		*out = new(GoogleOAuthCredential)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.Hetzner != nil {
+		in, out := &in.Hetzner, &out.Hetzner
+		*out = new(HetznerCredential)
+		**out = **in
+	}
+	if in.HetznerStorage != nil {
+		in, out := &in.HetznerStorage, &out.HetznerStorage
+		*out = new(HetznerStorageCredential)
+		**out = **in
+	}
 	if in.Linode != nil {
 		in, out := &in.Linode, &out.Linode
 		*out = new(LinodeCredential)
@@ -287,11 +318,6 @@ func (in *CredentialSpec) DeepCopyInto(out *CredentialSpec) {
 		*out = new(VultrCredential)
 		**out = **in
 	}
-	if in.Hetzner != nil {
-		in, out := &in.Hetzner, &out.Hetzner
-		*out = new(HetznerCredential)
-		**out = **in
-	}
 	return
 }
 
@@ -390,6 +416,22 @@ func (in *HetznerCredential) DeepCopy() *HetznerCredential {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HetznerStorageCredential) DeepCopyInto(out *HetznerStorageCredential) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HetznerStorageCredential.
+func (in *HetznerStorageCredential) DeepCopy() *HetznerStorageCredential {
+	if in == nil {
+		return nil
+	}
+	out := new(HetznerStorageCredential)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *LinodeCredential) DeepCopyInto(out *LinodeCredential) {
 	*out = *in
diff --git a/crds/cloud.appscode.com_credentials.yaml b/crds/cloud.appscode.com_credentials.yaml
index 879b27ab..6168d900 100644
--- a/crds/cloud.appscode.com_credentials.yaml
+++ b/crds/cloud.appscode.com_credentials.yaml
@@ -74,6 +74,19 @@ spec:
                 - account
                 - key
                 type: object
+              cloudflareStorage:
+                properties:
+                  accessKeyID:
+                    type: string
+                  accountID:
+                    type: string
+                  secretAccessKey:
+                    type: string
+                required:
+                - accessKeyID
+                - accountID
+                - secretAccessKey
+                type: object
               digitalocean:
                 properties:
                   token:
@@ -117,6 +130,16 @@ spec:
                 - sshKeyName
                 - token
                 type: object
+              hetznerStorage:
+                properties:
+                  accessKeyID:
+                    type: string
+                  secretAccessKey:
+                    type: string
+                required:
+                - accessKeyID
+                - secretAccessKey
+                type: object
               linode:
                 properties:
                   token:
@@ -189,9 +212,12 @@ spec:
                 - Aws
                 - Azure
                 - AzureStorage
+                - CloudflareStorage
                 - DigitalOcean
                 - GoogleCloud
                 - GoogleOAuth
+                - Hetzner
+                - HetznerStorage
                 - Linode
                 - Packet
                 - Rancher