We are using L7 to point K8S.
I would like to proxy the traffic via CloudFlare.
I should have the FW block all the traffic unless its from specific CF IP addresses. How can I do this?
You can use Cloud Armor to attach policies for incoming requests at HTTP(S) load balancer level.
Is not specified in your question description, but if you're using a GKE cluster with a GCE ingress class, you can also attach these policies to it following this guide.