Secret Values
Secret Values may be used to store sensitive information such as passwords, tokens or keys. While Secret Values are referenced by name in Deployment specifications, their actual values are not exposed to users.
Secret Values are bound to a Namespace. Within each Namespace the names of the Secret Values have to be unique.
Secret Values Specification
Plain Secret Values
Plain Secret Values are persisted in plain text within the context of Ververica Platform. They simply provide a value containing the secret.
1kind: SecretValue
2metadata:
3 name: SECRET_VALUE_NAME
4 namespace: default
5 # ...
6spec:
7 kind: PLAIN
8 value: secretUsing Secret Values
Secret Values may be referenced by name in configurations using ${SECRET_VALUE_NAME}.
Secret Values are only allowed on the following Deployment Template configuration fields:
- Jar URI (
spec.template.artifact.jarUri) if the Artifact is of kindJAR - Apache Flink® Configuration (
spec.template.flinkConfiguration)
When referencing Secret Values curly braces ${} are mandatory.
The Ververica distribution of Apache Flink® does not include any special precautions for protecting access to secrets. Secret Values may be exposed on the Flink UI and Kubernetes ConfigMaps. Make sure to restrict access to the Kubernetes cluster and to the Flink UI.