Issue

Cloudflare tunnel pods appeared healthy in Kubernetes but failed to connect to Cloudflare’s edge servers. Logs displayed persistent timeout and connection refused errors when attempting to reach Cloudflare’s edge network on port 7844, preventing the tunnel from establishing secure connections. This issue blocked all traffic routed through Cloudflare, including critical email delivery systems, where external messages (e.g., from [email]) failed to reach @name.com recipients.

Culprit

The root cause was a misconfigured Kubernetes NetworkPolicy that explicitly blocked egress traffic on port 7844, which Cloudflare Tunnel (cloudflared) requires for establishing persistent connections to Cloudflare’s edge network. The policy (cloudflare-tunnel-ingress-only) permitted only:

DNS traffic (port 53)
HTTPS traffic (port 443)
Internal API traffic (port 8000)

However, it did not include port 7844, leading to a silent firewall block where the tunnel process could start but could not complete the handshake with Cloudflare’s edge servers.

Solution

Updated Network Policy

The NetworkPolicy was modified to include port 7844 in the allowed egress rules. This allowed Cloudflared to establish the required connections with Cloudflare’s edge network.

Additional Fixes

AWS Configuration:
- Replaced hardcoded AWS account IDs in configurations with environment variable references.
- Updated .env file to include the required AWS account ID (AWS_ACCOUNT_ID=465983269025).
Database Configuration:
- Added [email] as a parent user in PostgreSQL to resolve email routing issues.

Verification

Tunnel logs were verified to confirm healthy connections to Cloudflare’s edge network.
End-to-end email flow tests were conducted to validate connectivity from [email] to @name.com and AI response handling.

Impact:

Resolved tunnel connectivity issues, restoring Cloudflare-based traffic routing.
Ensured email delivery systems functioned correctly.
Improved infrastructure security by aligning network policies with Cloudflare’s requirements.