Ververica Platform Docker Images

For convenience, Ververica hosts a public Docker registry that contains images of all Ververica Platform components. You can either use this registry directly or host the images yourself in a private registry. Please find more details for both options below.

Ververica Platform Public Registry

The registry is hosted at registry.ververica.com, and the images of a particular Ververica Platform version are published under the specific version prefix.

We use the following base images for the Ververica Platform images:

• flink: eclipse-temurin:8-jre-focal (or eclipse-temurin:11-jre-focal, depending on the Java version) is used in flink v1.14.6 and from v1.15.2. Other versions (v1.12.7, v1.13.3 and v1.14.X up to v1.14.5) use openjdk:8-jre-slim-bullseye (or openjdk:11-jre-slim-bullseye, depending on the Java version)
• vvp-appmanager, vvp-artifact-fetcher, vvp-gateway, vvp-result-fetcher-service: eclipse-temurin:11-jre
• vvp-ui: nginx:latest

For Ververica Platform , the following images are available and needed to run Ververica Platform:

Private Registry

We recommend using a private registry for all Ververica Platform images. The setup consists of two steps.

Mirroring the Images

If you want to host the Ververica Platform images yourself, you will have to pull, re-tag, and push all of the images listed above.

Below is a snippet demonstrating this for one of the images used by Ververica Platform. Just update REGISTRY and IMAGE as necessary.

1REGISTRY=registry.acme.inc; \
2  IMAGE=v{shortVersion}/vvp-appmanager:{release}; \
3  docker pull registry.ververica.com/${IMAGE} && \
4  docker tag registry.ververica.com/${IMAGE} ${REGISTRY}/${IMAGE} && \
5  docker push ${REGISTRY}/${IMAGE}

If you're using a private registry that has restricted network access, you might need to fetch the images, move them, and then load them into the target registry. Below is a simple snippet that builds on the one above to accomplish this.

1REGISTRY=registry.acme.inc; \
2  IMAGE=v{shortVersion}/vvp-appmanager:{release}; \
3  ARCHIVE=$(echo ${IMAGE} | sed -e 's/.*\///g' -e 's/:/-/g').tar.gz; \
4  docker pull registry.ververica.com/${IMAGE} && \
5  docker tag registry.ververica.com/${IMAGE} ${REGISTRY}/${IMAGE} && \
6  docker save ${REGISTRY}/${IMAGE} | gzip > ${ARCHIVE}
7
8REGISTRY=registry.acme.inc; \
9  IMAGE=v{shortVersion}/vvp-appmanager:{release}; \
10  ARCHIVE=$(echo ${IMAGE} | sed -e 's/.*\///g' -e 's/:/-/g').tar.gz; \
11  gunzip -c ${ARCHIVE} | docker load && \
12  docker push ${REGISTRY}/${IMAGE}

Configuring the Helm Chart

To configure Ververica Platform to use your registry you point vvp.registry in your Helm values file to your private registry:

1vvp:
2  registry: registry.acme.inc/vvp

If your private Docker registry requires authentication from within Kubernetes, you first need to create a Kubernetes Secret containing credentials for your registry in every Kubernetes namespace that the platform uses, i.e. the platform's namespace and all namespaces listed under rbac.additionalNamespaces.

Second, you need to configure Ververica Platform as well as your Deployments to use this secret as an imagePullSecret for all pods:

• The Kubernetes service account used by Ververica Platform needs to use your secret as an imagePullSecret. If you let helm create the service account for you (rbac.create: true), this done by setting rbac.imagePullSecret. If you pass a service account during installation with helm (rbac.serviceAccountName: <existing-service-account>) this service account needs to use your secret, too.
• For every Apache Flink® Deployment configure your secret as an image pull secret as described in Image Pull Secrets. In order to use this secret as a default for all Deployments, you can use Global Deployment Defaults.