Where to store CockroachCloud CA certificate?

You could store it in a volume.

You can also set it as a secret or just an environment variable (if it’s just the CA public key) and, using an entrypoint, write it to disk before cockroach starts.