更安全地部署流媒体应用程序

The Flink framework has gained popularity as a real-time stateful stream processing solution for distributed stream and batch data processing. Flink also provides data distribution, communication, and fault tolerance for distributed computations over data streams. To fully leverage Flink’s features, Coban, Grab’s real-time data platform team, has adopted Flink as part of our service offerings.

Flink框架作为分布式流和批处理数据的实时有状态流处理解决方案，已经获得了广泛的支持。Flink还为数据流上的分布式计算提供了数据分发、通信和容错功能。为了充分利用 Flink 的功能，Grab 的实时数据平台团队 Coban 已将 Flink 作为我们服务产品的一部分。

In this article, we explore how we ensure that deploying Flink applications remain safe as we incorporate the lessons learned through our journey to continuous delivery.

在这篇文章中，我们将探讨如何确保部署Flink应用程序的安全，因为我们在持续交付的过程中吸取了经验教训。

Background

背景介绍

Figure 1. Flink platform architecture within Coban

图1.Coban中的Flink平台架构

Users interact with our systems to develop and deploy Flink applications in three different ways.

用户通过三种不同的方式与我们的系统互动，开发和部署Flink应用程序。

Firstly, users create a Merge Request (MR) to develop their Flink applications on our Flink Scala repository, according to business requirements. After the MR is merged, GitOps Continuous Integration/Continuous Deployment (CI/CD) automatically runs and dockerises the application, allowing the containerised applications to be deployed easily.

首先，用户创建一个合并请求（MR），根据业务需求在我们的Flink Scala仓库开发他们的Flink应用。MR合并后，GitOps持续集成/持续部署（CI/CD）会自动运行并对应用程序进行docker化，从而使容器化的应用程序能够轻松部署。

Secondly, users create another MR to our infrastructure as a code repository. The GitOps CI/CD that is integrated with Terraform runs and configures the created Spinnaker application. This process configures the Flink application that will be deployed.

其次，用户为我们的基础设施创建另一个MR作为代码库。与Terraform集成的GitOps CI/CD运行并配置创建的Spinnaker应用程序。这个过程配置了将被部署的Flink应用程序。

Finally, users trigger the actual deployment of the Flink applications on Spinnaker, which orchestrates the deployment of the Docker image onto our Kubernetes cluster. Flink applications are deployed as standalone clusters in Grab to ensure resource isolati...