Eating Our Own Dogfood

The Argo Tunnel team spends its days making it easy to connect origins to the Internet without opening inbound ports. But we are also users of the product, and our development workflow shows how secure remote access and a solid local Kubernetes setup can speed up a distributed team.

From Docker Compose to a Local Kubernetes Stack

Early on, the team orchestrated its services with a simple docker-compose file. That worked while the group was small, but there was no native hot reload. Every code change meant restarting the stack, and the hacks used to work around that often led to time lost debugging Docker internals.

As the team grew, so did the frustration. Around the same time, Cloudflare was moving from Marathon to Kubernetes, so the team looked for a tool that could watch source files, build fresh images, and roll out updated pods automatically.

The Search for a Better Local Cluster

Skaffold initially looked like the right answer, so the team paired it with Minikube. The combination did not hold up in practice. Port forwarding was unstable, yielding frequent timeouts and connection-refused errors. Minikube also did not use the host Docker registry, so it could not benefit from cached image layers, and its startup time made iteration painfully slow.

Turning to Tilt’s comparison of local Kubernetes options, the team switched to the Kubernetes cluster built into Docker for Mac and adopted Tilt as the development orchestrator. Tilt detects local source changes and can push the new files straight into a running container, where it runs cargo build and restarts the service without rebuilding the image. Rust services that took around 20 minutes to rebuild now come back in under a minute.

Collaborating Across Time Zones, Securely

Once the local stack felt fast, the next problem was sharing it. With engineers split across Austin, Lisbon, and Seattle, helping a teammate debug often meant asking them to paste logs from multiple services. On one occasion, that back-and-forth turned a simple misconfiguration — a secret set to an empty string — into two hours of investigation.

Remote access to a colleague’s development environment would have made that a five-minute fix. Argo Tunnel is built for exactly this scenario: it creates an outbound-only connection from the resource to Cloudflare’s edge, so the origin never has to expose an IP address. Exposing a dev environment introduces a new concern, though: the services on it are sensitive. Cloudflare Access sits in front of the tunnel’s hostname and checks identity on every request, so only authenticated team members can reach the stack.

A Working Setup: Sharing the Kubernetes Dashboard

The Kubernetes dashboard that ships with Docker for Mac’s cluster gives a full view of the dev stack — pods, deployments, services, config maps, secrets — plus logs and an exec shell. By default it is protected by a token that changes on every restart, and handing that token to everyone on the team is impractical.

The team solved it by running a small reverse proxy that injects the dashboard’s service-account token into the Authorization header of each request. Argo Tunnel runs as a sidecar to that proxy, making the proxy addressable from the Internet without any inbound ports on the local machine. In front of that hostname, an Access policy limits visibility to team members only.

The resulting request path is: browser, then Cloudflare Access, then Argo Tunnel, then the reverse proxy, then the dashboard service.

How to Recreate It

The same model works for any team looking to develop against a shared Kubernetes cluster, wherever it lives. The starting point is a local Kubernetes setup; Tilt’s documentation covers the trade-offs between the available options for various operating systems.

  1. Bring up a local cluster.
  2. Enable the Kubernetes dashboard service.
  3. Deploy a reverse proxy that stamps the dashboard’s service-account token onto the Authorization header before forwarding requests.
  4. Add an Argo Tunnel sidecar to expose the proxy.
  5. Grab the tunnel’s public URL, guarded by an Access policy.
  6. Share that URL with collaborators so they can reach the dashboard from anywhere.

Cloudflare maintains a complete working example in the sharing-k8s-dashboard directory of the argo-tunnel-examples repository on GitHub.