Blogs›Cloudflare›Container Identity and Secret Management
Cloudflare has developed PAL (Permissive Action Link), a tool to securely distribute secrets to Dockerized production applications. PAL addresses the challenge of bootstrapping service identity in containerized environments by allowing encrypted secrets to be decrypted at runtime after the service's identity has been established. It supports PGP and Red October for encryption and leverages container labels and cgroups for authorization, enabling secure access control for secrets and facilitating the deployment of secret management services.
7/3/2017
Introduced PAL (Permissive Action Link), a tool for securely distributing secrets to Dockerized production applications. PAL enables encrypted secrets to be decrypted at runtime after service identity is established, supporting PGP and Red October encryption methods. It uses container labels derived from cgroups and Docker metadata for authorization, allowing secrets to be installed as environment variables or files within containers.