cloudflare / cloudflare/cloudflared
Feature Request: Permit certificate to be supplied by base64 environment string
- Dominant language
- Go
- Stars
- 15.6k
- Forks
- 1.4k
- PR merge metrics
- No merged PRs in 30d
Description
My understanding of https://developers.cloudflare.com/argo-tunnel/reference/arguments/#origincert is that the cert can only be supplied by file.
For something like AWS Fargate this is a bit tricky, I think the options would be to:
1. Do something which is probably not advisable and build our own image using yours as a base but COPY our cert into the expected location `~/.cloudflared/cert.pem` and deploy this image.
1. Provision a AWS EFS and attach the EFS to the task and ensure the cert is on the EFS in the right place
1. Don't use fargate and use EKS or ECS backed by EC2 allowing bind mounts, but still needing to ensure the file is in place on the mount
If this image would permit an option to supply the cert by an environment variable string such as a base64 encoded version of the cert we could perhaps then use AWS secrets manager to store the secret and provide the string to the image. This makes deployment very simple and fast.
Is there a big negative I haven't considered here r.e. the security of the cert if it were to be supplied to the environment this way (such as another process doing a `printenv` or something).
Contributor guide
Assessment
This issue has not been assessed yet.