Using Cloudflare Tunnel and Access with Postgres

This post details the implementation of Cloudflare Tunnel and Cloudflare Access to provide secure, identity-driven access to internal PostgreSQL databases, replacing the previous SSH bastion host method. It describes the setup of Cloudflare Tunnel within Kubernetes to connect to the database clusters and the configuration of Cloudflare Access policies for authentication and authorization. The post also highlights the client-side setup using `cloudflared access` for users to connect to local ports, effectively tunneling traffic to the remote database. Granular access control for staging and production databases is achieved through independent Tunnels. A 'break glass' procedure using SSH jump-hosts for senior staff is maintained for emergency access.