Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proposal: Complementary Service controller annotations for Access #43

Open
adyanth opened this issue Mar 26, 2022 · 1 comment · May be fixed by #69
Open

Proposal: Complementary Service controller annotations for Access #43

adyanth opened this issue Mar 26, 2022 · 1 comment · May be fixed by #69
Labels
enhancement New feature or request roadmap Roadmap Item

Comments

@adyanth
Copy link
Owner

adyanth commented Mar 26, 2022

Motivation

Seamlessly expose TCP/UDP* services from one cluster to another securely tunnelled over Cloudflare.

Current status

Currently, the operator provides the tunnelling functionality of cloudflared to expose services. This is good enough for HTTP/S endpoints. But for any TCP/UDP* (including SSH/RDP) based traffic, like a database service, this is one piece of the puzzle. There needs to be another cloudflared running at the consumer pointing to the same FQDN which in turn would expose a port that connects to the other end.

Implementation

Implementing this would be a two-step process.

  • We need another set of annotations for the service. If the endpoint is protected by Cloudflare Access/Zero Trust, we need a CRD that can capture data needed for logging in and getting a token (which would not need the level of access used by the tunnel)

  • The service controller would then listen to those, spin up a cloudflared deployment in access mode and point the service to it. An alternative could be to run a common WARP client per CRD, but that would be getting more access than needed, creating edge cases for conflicting ports, and a security nightmare.

@adyanth adyanth added enhancement New feature or request help wanted Extra attention is needed roadmap Roadmap Item labels Mar 26, 2022
@adyanth adyanth pinned this issue Mar 27, 2022
@adyanth adyanth removed the help wanted Extra attention is needed label Dec 13, 2022
@adyanth
Copy link
Owner Author

adyanth commented Dec 15, 2022

One client can only listen to one port, so it has to be multiple containers, one per port.

@adyanth adyanth linked a pull request Dec 15, 2022 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request roadmap Roadmap Item
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant