Your login shouldn't stop at the tunnel.
Today at 11 AM ET on Ziti TV, we'll sign into Cloudflare Access, and use it to connect over an OpenZiti service. Same URL, three people, three different answers.
Ziti Access Bridge (ZAB) is a small Go proof of concept. It runs the Cloudflare Tunnel itself, verifies the Access JWT, and authenticates to OpenZiti with that same JWT through an external JWT signer, as that person. Service policy then decides which apps each person reaches, and the apps listen on 127.0.0.1 only.
What we build, live:
- a Cloudflare Tunnel and Access app, with Keycloak as the login
- an OpenZiti quickstart with an external JWT signer for Cloudflare
- three people who all pass Cloudflare and get three different answers
- revoking one person's access mid-session
- the same bridge in Kubernetes, two replicas, no Ingress, LoadBalancer or NodePort
Scripts and walkthrough: GitHub - openziti-test-kitchen/ziti-tv: A repository for various Ziti TV related activities · GitHub. The recording stays up after the stream. Questions welcome here after the fact or in the live chat on YouTube.