Having to manage SSH, RDP, and kubectl access for devs across hybrid environments. Looked at Cloudflare Access and Teleport. Core difference: one is an identity-aware proxy, the other is an access plane.
**Cloudflare Access**
* HTTP/S apps only. It's a reverse proxy with IdP integration (Okta, Google, etc.).
* No native SSH/RDP/K8s. You need Argo Tunnel (`cloudflared`) to expose non-web resources, and even then it's a tunnel to a local daemon. It's a workaround.
* Good for: internal web apps, replacing a VPN for SaaS-like access. Perimeter is your identity.
**Teleport**
* Built for infrastructure protocols: SSH, Kubernetes, Databases, RDP.
* Uses short-lived certificates instead of just proxying connections. Each session gets an identity file.
* Good for: replacing static SSH keys, unifying access to servers and k8s clusters, session recording.
Example Teleport config for a Kubernetes cluster join:
```yaml
# teleport.yaml
version: v2
teleport:
auth_server: teleport.example.com:3025
join_params:
method: token
token: "join-token"
proxy_server: teleport.example.com:3023
auth_service:
enabled: false
proxy_service:
enabled: false
kubernetes_service:
enabled: true
kube_cluster_name: "production-cluster"
labels:
env: prod
```
Bottom line: If it's all web apps, Cloudflare Access is simpler. If you need SSH, kubectl, or DB access, Teleport is the purpose-built tool. Cloudflare Access feels like a feature; Teleport feels like a product.
-dk
Trust but verify, then don't trust.