Cloudflare Tunnel + Access + Traefik Integration

Expose Kubernetes services through Cloudflare Tunnel with opt-in per-service access, Authentik forwardAuth for humans, and Service Tokens for machine-to-machine auth.

Architecture

Human (browser):
  → Cloudflare DNS (proxied) → CF Access (IdP) → Tunnel → cloudflared → Traefik
    → forwardAuth (Authentik) → app

Machine (service token):
  → Cloudflare DNS (proxied) → CF Access (Service Token) → Tunnel → cloudflared → Traefik
    → HeadersRegexp match → app (skips forwardAuth)

Cloudflare Access = outer gate (validates before traffic reaches cluster). Traefik = inner gate (routes by header presence, applies forwardAuth for humans).