Hi Team, We are using Flink K8s operator to deploy flink in our azure k8s environment. We have some secrets that we use in the flink jobs, and we are using a azure-keyvault-secrets-mounter to mount this secret as an environment variable in Flink Job Manager and Task manager. In our setup, we change the secret after every x days. And once the secret is changed, the azure secret mounter identifies this change and applies it to the k8s cluster. The challenge that we are facing is that even though the secret has changed, the pods of job manager and task manager do not restart. This works seamlessly for all other pods in our system. We are using

stakater/reloader:v1.0.29

to reload the pods when a config changes. But the annotations that are working with other pods, are not working with Flink components. Is anyone using a similar setup and has run into such a problem? We don't want to create a custom solution for job restarts, and manual restarts, are not optimal.

Flink loads everything as part of the job graph. Are you using

ParameterTool

to read the secrets? You can either trigger a restart on the pipeline or something like it. I'm not sure if there is a straight forward way to achieving automatic reload of secrets.

Hi Pedro, We are not using ParameterTools and are using environment variables to pass the secrets to the pod. In the job, when the pod starts, we fetch the environment variable by using below code.

String envVariableValue = System.getenv(envVariableName);

We will also look into

ParameterTool

and see if that can help us.

Also, if you only use credentials on

open

method it may be something to look at. Because this method is called only when the job is getting deployed. So, even if you have changes, it will not re-trigger new resource creation.