Ververica DocsVerverica Docs
Docs Home
Viewing docs for
Self-ManagedNot available for BYOC

Ververica Platform 3.1.3

Applies toSelf-Managed v3
4 min read
On this page

Release Date: 2026-09-03

Ververica Platform 3.1.3 is a feature release focused on security and configuration hardening for self-managed installations, including workspace-scoped admin API tokens, secret encryption at rest, external database credentials through Kubernetes Secrets, a toggle for the Swagger UI, and control over which JDK versions a new installation exposes, plus bug fixes across logging, namespace handling, session cluster metrics, and OpenShift deployments.

New Features and Improvements

Structured Deployment Defaults with Named Fields

Ververica Platform 3.1.3 splits globalDeploymentDefaults into named fields for the settings platform admins change most often (jobmanager and taskmanager cpu and memory, upgrade strategy, number of task slots, and Flink configuration), alongside the existing spec/batchSpec raw passthrough for everything else. Setting a single common value no longer requires restating the whole block.

For more information, see Platform-Wide Deployment Defaults.

Workspace-Scoped Admin API Tokens

Ververica Platform 3.1.3 adds a workspace-scoped admin API token, declared through Helm configuration, that works across every namespace in a workspace instead of the single namespace a regular token is limited to. It carries the admin role, suited for automation that needs to authenticate unattended, such as a CI pipeline or a health-check integration.

For more information, see API Tokens.

External Database Credentials from a Kubernetes Secret

You can now point Ververica Platform at an existing Kubernetes Secret for the metadata store database password, using the new global.database.passwordSecret and global.database.passwordSecretKey Helm values instead of passing the password as plain text. This works with PostgreSQL, MySQL, and MariaDB, and is intended for sourcing the password from an external secrets manager such as Vault or the External Secrets Operator.

For more information, see PostgreSQL as Metadata Store.

Encrypting Secret Values at Rest

Self-managed installations can now encrypt stored secret values with AES-256 instead of the plain-text default, through a new opt-in Helm setting. It's off by default, so upgrading to 3.1.3 doesn't change anything until you enable it. The encryption key can't be changed once secrets are written under it, and existing secrets aren't converted until they're re-saved.

For more information, see Secret Values.

Swagger UI Enable/Disable Toggle

Self-managed installations can now turn off the interactive Swagger UI through a new Helm value, enabled by default. Disabling it removes the /swagger and /swagger-ui paths; the REST API and its OpenAPI specification endpoint stay available either way.

For more information, see Swagger UI.

Configuring JDK Versions for New Installations

Ververica Platform 3.1.3 lets you control which JDK-based Flink engine versions a new installation makes available. Both JDK 11 and JDK 17 are available by default.

To make only JDK 17 available, set installByDefault to false for JDK 11 and true for JDK 17:

YAML
1vvp-appmanager:
2  flinkVersionMetas:
3    jdk11:
4      installByDefault: false
5    jdk17:
6      installByDefault: true

JDK 11 is then hidden from every Flink engine version selector.

This setting applies only to new installations. An existing installation keeps every JDK version it already has available.

Bug Fixes

Missing Logs of Failed Jobs

Ververica Platform 3.1.3 adds Azure log appender support for TaskManager and JobManager logs, closing a gap where logs for failed jobs weren't retrievable on Azure BYOC and Managed Service.

Switching Between Namespaces Uses the Same Deployment Target

Ververica Platform 3.1.3 fixes an issue where switching to a different namespace kept using the previous namespace's cached deployment target list instead of loading the list for the newly selected namespace.

Writing CSV to S3 Bucket Fails

Ververica Platform 3.1.3 fixes a filesystem connector issue where writing CSV output to an S3 bucket failed with a "Stream closed" error during checkpoint commits. JSON output and batch-mode CSV writes weren't affected.

Operator-Managed Deployments Failing on OpenShift

Ververica Platform 3.1.3 fixes an issue on OpenShift where the Kubernetes Operator's auto-stamped ownerReference on operator-managed deployments was rejected by OpenShift's OwnerReferencesPermissionEnforcement admission plugin, so those deployments always failed.

Clearer Error on Namespace Re-Creation

Ververica Platform 3.1.3 fixes an issue where re-creating a namespace immediately after deleting it returned a generic "Internal error" instead of a clear message. Namespace deletion is asynchronous, and a create request submitted during that window now returns a 409 Conflict explaining that the namespace is still being deleted and the request can be retried shortly.

Session Cluster Prometheus Metrics

Ververica Platform 3.1.3 fixes an issue where session cluster JobManager and TaskManager pods exposed no Prometheus metrics. The platform stamped every session cluster pod with scrape annotations for port 9999 but shipped no metrics reporter configuration for session clusters, so nothing listened on that port.

Namespace Isolation Bypass

Ververica Platform 3.1.3 fixes an issue that could let users with namespace-scoped access view resources in other namespaces within the same workspace.

The fix applies only to namespace permissions created after the upgrade. Recreate existing permissions to apply the fix to them, and rotate any affected API tokens.

Vulnerability Fixes (Inside Apache Flink®)

Vulnerability Fixes (Outside Apache Flink®)

Upgrade

To upgrade Ververica Platform to version 3.1.3, run the following Helm command:

BASH
1helm upgrade --install <RELEASE_NAME> \
2  oci://registry.ververica.cloud/platform-charts/ververica-platform \
3  --version 3.1.3 \
4  --namespace vvp-system \
5  --values values.yaml
Was this helpful?