CommunityTeamEnterprise

Ververica Platform

tip

Ververica Platform integration is actively being worked on and is currently in early access!

Contact sales@factorhouse.io for more details.

Overview

Ververica Platform is the enterprise-grade solution for stateful stream processing and analytics, built upon Apache Flink®.

Flex delivers a unified experience to monitor, manage, and observe your Flink clusters and associated resources. It provides centralized visibility and control over Flink jobs, TaskManagers, and JobManagers from a single, enterprise-ready interface.

Compatibility

Flex is compatible with the version 2 of Ververica Platform. It has been tested and supports both the Community and Enterprise editions.

Configuration

Flex connects to Ververica Platform with environment variables.

Variable	Description
VERVERICA_PLATFORM_REST_URL	The URL endpoint of your Ververica Platform instance.
VERVERICA_PLATFORM_ENVIRONMENT_NAME	Optional. A user-friendly name for this environment (e.g., "VVP Staging") displayed in the Flex UI and logs.
VERVERICA_PLATFORM_NAMESPACE	The target Namespace within your Ververica Platform installation (defaults to default).
VERVERICA_PLATFORM_API_TOKEN	Optional. The API Token of your Ververica Platform installation. Leave empty if running the Community Edition of Ververica Platform.

API Tokens

In order for Flex to authenticate against your Ververica Platform resources you will need to create an API Token.

Flex requires an API token for the target namespace with a role that has sufficient permissions, such as editor or owner. For more details on creating API tokens within Ververica Platform, refer to the official Ververica Platform documentation.

Example API Token

POST /apitokens/v1/namespaces/default/apitokens


{
  "name": "namespaces/default/apitokens/ci-token",
  "role": "editor"
}

Use the value of the secret field in the response body as the value for the VERVERICA_PLATFORM_API_TOKEN environment variable.

Multiple Ververica Platform instances

Flex supports configuring multiple Ververica Platform instances. For example, you can set up separate instances for different environments such as Staging, Production, and UAT.

In addition to Ververica Platform, Flex also supports standalone Flink clusters, with upcoming support for the Kubernetes Operator, OpenShift, and Amazon Managed Service for Apache Flink. You can seamlessly mix and match these deployment backends within a single Flex configuration.

To configure multiple instances, append a suffix like _2, _3, etc., to the set of environment variables.

# Connection to a standalone Flink cluster
FLINK_REST_URL="http://localhost:8081"

# Connection to the Staging Ververica Platform instance
VERVERICA_PLATFORM_REST_URL="http://localhost:8080"
VERVERICA_PLATFORM_ENVIRONMENT_NAME="VVP (Staging)"
VERVERICA_PLATFORM_NAMESPACE=staging
VERVERICA_PLATFORM_API_TOKEN_2="STAGING_API_TOKEN"

# Connection to the Production Ververica Platform instance
VERVERICA_PLATFORM_REST_URL_2="http://localhost:8081"
VERVERICA_PLATFORM_ENVIRONMENT_NAME_2="VVP (Prod)"
VERVERICA_PLATFORM_NAMESPACE_2=prod
VERVERICA_PLATFORM_API_TOKEN_3=PRODUCTION_API_TOKEN

Multi-tenancy integration

Ververica Platform support integrates with Flex's multi-tenancy functionality, which allows you to define granular access rules based on patterns that match the Flink cluster ID. Within Flex, each Ververica Platform resource (Deployment or Session Cluster) is identified using a clear, hierarchical Flink cluster ID.

This hierarchy follows the pattern:

• {{VERVERICA_PLATFORM_ENVIRONMENT_NAME}} / {{VERVERICA_PLATFORM_NAMESPACE}} / {{RESOURCE_NAME}}

Here, RESOURCE_NAME can be the name of either a Session Cluster or a Deployment.

This translates into a concrete ID that Flex uses for applying access control rules. For example:

• VVP Staging/default/order-statistics-akk62

Multi-tenancy examples

Example 1: Grant access to a specific namespace across all instances

This rule allows a user to see all resources but only within the default namespace, regardless of which Ververica Platform instance (Staging, Prod, etc.) they belong to.

resources:
  - include: [ "flink", "*/default/*" ]

• * (first segment): Matches any environment name (e.g., "VVP Staging", "VVP Prod").
• default (second segment): Matches only the namespace named default.
• * (third segment): Matches any resource name.

Example 2: Grant full access to the "VVP Staging" environment

This rule gives a user complete visibility into the "VVP Staging" environment, including all its namespaces and resources, but denies access to any other environment.

resources:
  - include: [ "flink", "VVP Staging/*/*" ]

• VVP Staging: Matches only the environment named "VVP Staging".
• *: Matches any namespace within that environment.
• *: Matches any resource within those namespaces.

Example 3: Grant access to resources based on a naming convention

This rule allows a user to see any resource whose name begins with finance-, regardless of the environment or namespace it is in. This is perfect for team-based access control.

resources:
  - include: [ "flink", "*/*/finance-*" ]

• *: Matches any environment.
• *: Matches any namespace.
• finance-*: Matches any resource name that starts with the prefix finance- (e.g., finance-risk-job, finance-reporting-cluster).