skills.rest
saintgo7
saintgo7COMMUNITY
Explore all skills by this author →
GitHub

cloudflare-tunnel-ssh-access-pattern

Route external SSH to Kubernetes pods through Cloudflare Tunnel and cloudflared access ssh.

Updated Apr 4, 2026
Search Tags:#kubernetes#zero trust#cloudflare tunnel#sshd#ssh access#proxycommand#zero public ip
One-click install
npx skills add https://github.com/saintgo7/claude-skills --skill cloudflare-tunnel-ssh-access-pattern
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cloudflare-tunnel-ssh-access-pattern
Source: https://github.com/saintgo7/claude-skills/tree/main/cloudflare-tunnel-ssh-access-pattern
Command: npx skills add https://github.com/saintgo7/claude-skills --skill cloudflare-tunnel-ssh-access-pattern

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve?

This Skill solves the problem of exposing SSH access to Kubernetes pods or internal nodes when you have no public IP and traditional inbound port 22 access is blocked.

Core Features & Use Cases

  • Cloudflare Tunnel + Access SSH ProxyCommand: Uses cloudflared access ssh as an SSH ProxyCommand so external clients can reach pod-local sshd safely.
  • Node-isolated tunnel design: Creates a separate tunnel per node to provide failure isolation and prevent cross-node outages.
  • Pod-local unprivileged SSHD: Runs sshd on port 2222 in the user space (no root, no privileged port 22) and connects it to Cloudflare via localhost.

Quick Start

Tell the AI: “Give me a checklist to set up Cloudflare Tunnel for SSH to K8s pods using port 2222 and cloudflared access ssh ProxyCommand, including DNS, client ~/.ssh/config, and verification steps.”

Frequently Asked Questions about cloudflare-tunnel-ssh-access-pattern

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I SSH into Kubernetes pods without a public IP?▼

You can SSH into Kubernetes pods without a public IP by routing external SSH through Cloudflare Tunnel using cloudflared access ssh as a ProxyCommand to reach a pod-local sshd on port 2222.

What is Zero Trust SSH and how does Cloudflare Tunnel enable it?▼

Zero Trust SSH eliminates inbound ports by routing connections through Cloudflare Tunnel with optional Cloudflare Access policy enforcement, ensuring only authenticated users reach the internal sshd on port 2222.

Can I use cloudflared access ssh as an SSH ProxyCommand for internal hosts?▼

Yes, cloudflared access ssh functions as an SSH ProxyCommand by routing client traffic through Cloudflare's edge to a local tunnel daemon connected to an unprivileged sshd on port 2222.

How do I configure ~/.ssh/config for Cloudflare Tunnel SSH access?▼

Configure ~/.ssh/config by adding a Host entry using cloudflared access ssh --hostname %h as the ProxyCommand, pointing to the DNS record routing to your Cloudflare Tunnel ingress.

Why create a separate Cloudflare Tunnel per node in a multi-node Kubernetes cluster?▼

Creating a separate Cloudflare Tunnel per node provides failure isolation, ensuring a single node's tunnel failure does not break SSH access to other nodes in the multi-node Kubernetes cluster.

Does running sshd on port 2222 require root privileges in Kubernetes pods?▼

No, running sshd on port 2222 does not require root privileges. It operates as an unprivileged pod-local user space service, avoiding the need for root access or binding to privileged port 22.

Related Skills

Explore More Software Engineering Skills→
saintgo7saintgo7

cloudflare-tunnel-setup

Configure Cloudflare Tunnel to expose local HTTP, TCP, and SSH endpoints.

Community
Intermediate
almazomalmazom

ssh-mesh

Establish and validate a three-node SSH mesh with aliases, keys, and SCP transfers.

Community
Advanced
gilesknapgilesknap
32

cloudflare

Expose K3s services via Cloudflare Tunnel and Access policies.

Community
Advanced
dreadnodedreadnode
11

h2-connect-internal-scan

Enumerate internal services via HTTP/2 CONNECT requests through reverse proxies.

Official
Intermediate