Cloudera Docs

Namespace management

The Flink Operator is capable of watching all of the Kubernetes cluster namespaces. However, when installing the CSA Operator, you can limit its access to a single or set number of namespaces.

By default, the Flink Operator is capable for watching all of the Kubernetes cluster namespaces. This means that no matter in which namespace the Flink Deployment is deployed, the Flink Operator picks it up and executes the Flink job in that namespace. However, in production environments managing access to the namespaces might be necessary. In this case, you can specify a list of namespaces the Flink Operator can watch and have access.

When installing the CSA Operator, you can define the namespace configuration with helm install:
helm install csa-operator --namespace [***NAMESPACE***] \
--set 'flink-kubernetes-operator.image.imagePullSecrets[0].name=[***SECRET NAME***]' \ 
--set 'ssb.sse.image.imagePullSecrets[0].name=[***SECRET NAME***]' \ 
--set 'ssb.sqlRunner.image.imagePullSecrets[0].name=[***SECRET NAME***]' \ 
--set-file clouderaLicense.fileContent=[***PATH TO LICENSE FILE***] \
--set flink-kubernetes-operator.watchAnyNamespace=true \
oci://container.repository.cloudera.com/cloudera-helm/csa-operator/csa-operator --version 1.0.0-b317
By setting the watchAnyNamespace to true, you enable the Flink Operator to have access to all of the namespace on the Kubernetes cluster. You can limit this configuration by listing the namespaces that should be watched by the Flink Operator:
-- set flink-kubernetes-operator.watchNamespaces={namespace1},{namespace2}

You have the option to create multiple namespaces and deploy Flink Deployments in any of the created namespaces as the Flink Operator can pick up the deployments from the watched namespaces. This also means that SSB does not have to be in the same namespace as the Flink Deployment. However, SSB can only manage one namespace. This means that if you want to deploy SSB in multiple namespaces, you need to install SSB in every namespace.

As an example, if you want to have two namespaces with Flink in namespace1 and SSB in namespace2, you need to install the Flink Kubernetes Operator in namespace1 without SSB, and install SSB without the Flink Kubernetes Operator in namespace2.

Watching all namespaces

By default, the Flink Operator has access to all of the namespace on the Kubernetes cluster. This means that no matter in which namespace the Flink Deployment is deployed, the Flink Operator picks it up and executes the Flink job in that namespace.

Limiting access to namespaces

In production environments managing access to the namespaces might be necessary. In this case, you can specify a list of namespaces the Flink Operator can watch and have access.

You can limit the Flink Operator’s access to one or more specific namespaces using the following configuration parameter:
--set "flink-kubernetes-operator.watchNamespaces={[***NAMESPACE1***],[***NAMESPACE2***]}"
You have the option to create multiple namespaces and deploy Flink Deployments in any of them, as the Flink Operator will pick up the deployments from all the watched namespaces you specified.

Examples

Installing SSB in a single namespace (other than the Flink Operator)
If you want to have two namespaces, with
  • Flink installed only in namespace1 (but managing all namespaces)
  • and SSB installed only in namespace2,
you would use the following commands:
helm install \
--namespace namespace1 \
--set ssb.enabled=false
--set "flink-kubernetes-operator.watchNamespaces=namespace1"
--set-file flink-kubernetes-operator.clouderaLicense.fileContent=[***PATH TO LICENSE FILE***]
csa-operator csa-operator-1.0.0-b293.tgz

helm install \
--namespace namespace2 \
--set flink-kubernetes-operator.enabled=false
csa-operator csa-operator-1.0.0-b293.tgz
This example installs the Flink Operator in namespace1 without SSB, and install SSB (without the Flink Operator) in namespace2. The Flink Operator will be watching all namespaces, because there’s no limitation set.
Installing Flink Operator and SSB in separate namespaces
If you want to have two separate namespaces, with both Flink and SSB installed and only watching a single namespace, you would use the following commands:
helm install \
--namespace namespace1 \
--set ssb.enabled=true
--set "flink-kubernetes-operator.watchNamespaces=namespace1"
--set-file flink-kubernetes-operator.clouderaLicense.fileContent=[***PATH TO LICENSE FILE***]
csa-operator csa-operator-1.0.0-b293.tgz

helm install \
--namespace namespace2 \
--set ssb.enabled=true
--set "flink-kubernetes-operator.watchNamespaces=namespace2"
--set-file flink-kubernetes-operator.clouderaLicense.fileContent=[***PATH TO LICENSE FILE***]
csa-operator csa-operator-1.0.0-b293.tgz
This example installs the Flink Operator with SSB in namespace1 and namespace1. The --set "flink-kubernetes-operator.watchNamespaces parameter limits the Flink Operator’s access to watch Flink Deployments in the single namespace it’s installed in.