I found this git repo: https://github.com/getindata/flink-dynamic-cep-demo
Looks like they have a Flink Job with a function that spins up a minicluster for every rule they receive. Have mixed feelings on this approach, afaik the minicluster is intended for testing purposes not production use - and spinning up a minicluster for each ruke might become expensive