Using Cloudflare Tunnel and Access with Postgres

What this post added

This post details the internal adoption of Cloudflare Tunnel and Cloudflare Access to replace SSH-based bastion hosts for accessing internal PostgreSQL databases. It describes the deployment of Cloudflare Tunnel within an internal Kubernetes cluster to establish connectivity to the database servers, and the implementation of identity-driven Zero Trust policies via Cloudflare Access for authentication and authorization. The post also covers the client-side setup using cloudflared for users to establish local TCP connections to the databases, and the maintenance of SSH jump-hosts as a 'break glass' procedure. The learnings highlight improved security posture, user experience, and the value of dogfooding Cloudflare's own products.