Skip to main content

Moving from Read-only Cloudflare to Fully Managed

When Cloudflare is connected to IO River with a read-only token, IO River can import its configuration, monitor it, and steer traffic to it, but cannot update its configuration. Moving to a fully managed Cloudflare account lets IO River deploy and maintain your service configuration on Cloudflare, like any other managed CDN provider.

Before you begin​

This guide assumes that the onboarding has already been completed:

  • Your IO River account has a Cloudflare read-only account provider.
  • Your services were either created or imported from Cloudflare, and their configuration was reviewed and approved.
  • The relevant services have the Cloudflare read-only service provider, as well as other service providers.
  • Your domains' DNS records point to the IO River service CNAMEs.
  • A significant portion of your production traffic is being served from the additional CDN provider.

Note: Switching to a fully-managed Cloudflare account must be performed simultaneously for all services and subdomains in a single zone.

Create a read-write Cloudflare account provider​

Add a Cloudflare account provider with a read-write token (this is a one time operation):

  1. In Cloudflare, create an API token with the permissions required for a fully managed account, as described in Creating an API Token in Cloudflare. The token must be created for the same Cloudflare account that is currently connected in read-only mode.
  2. In IO River, choose the CDN Providers tab.
  3. Select Cloudflare, provide the read-write API token, and click Apply.

For more details, see Add a CDN Provider to your Account.

Process overview​

Once you have the read-write account, the process includes the following steps:

  1. Remove the read-only Cloudflare provider from your services

Note: repeat this step for every service in the zone

  1. Clean up the Cloudflare zone:
    1. Remove all page rules
    2. Remove all configuration rules
    3. Remove all categorized rules
    4. Remove all domains
    5. Remove all certificates
    6. Remove all workers
    7. Remove all DNS records, even if they are not for domains

Note: if you are not sure about cleaning up the cloudflare zone, contact support@ioriver.io for assistance.

  1. Add the read-write Cloudflare provider to your services, and gradually route traffic back to it.

Note: repeat this step for every service in the zone

Step 1: Remove the read-only Cloudflare provider from your services​

Perform the following for each service in the zone that uses the read-only Cloudflare provider:

  1. Navigate to the service and choose Traffic Policies in the sidebar.
  2. Move all traffic that is routed to Cloudflare to your other CDN providers. Make sure to update the default traffic policy, as well as any geo-specific policy that routes traffic to Cloudflare. See Traffic Policies.
  3. Use the service dashboards to verify that Cloudflare no longer receives traffic, and that the other CDN providers serve it without errors.
  4. Navigate to the service and choose CDN Providers in the sidebar.
  5. Remove the read-only Cloudflare provider from the service.

Step 2: Clean up the Cloudflare zone​

In Cloudflare dashboard, remove all domains and workers from your zone.

Step 3: Add the read-write Cloudflare provider to your services​

Perform the following for each service from which you removed the read-only provider:

  1. Navigate to the service and choose CDN Providers in the sidebar.
  2. Select the read-write Cloudflare account you added, and click Add. IO River deploys the service configuration to Cloudflare.
  3. Once the deployment is complete, test the service on Cloudflare before routing production traffic to it. See Testing HTTP Traffic.
  4. Gradually route traffic to Cloudflare using the service traffic policies, and use the dashboards to compare Cloudflare with your other CDN providers at each stage. We recommend starting with a small percentage, for example 1%, and increasing it in stages until you reach your target distribution. See Migrating Traffic to a New CDN Provider.

From now on, make configuration changes in IO River rather than directly in Cloudflare, so that your service configuration remains consistent across all CDN providers.

Optional: Delete the read-only Cloudflare account​

After the read-only Cloudflare account has been removed from all services, you can delete it from your IO River account. See Updating & Deleting a CDN Account.