Apache StreamPark

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is the recommended size. StreamPark, the Flink JobManager and the Flink TaskManager are three JVMs, and 8 GiB gives comfortable headroom for real streaming workloads. The image boots healthy on Standard_B2s (4 GiB) for evaluation, but size up for running jobs.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the console. StreamPark serves plain HTTP on port 80, so terminate TLS in front of it with your own domain for production. The Flink cluster is never exposed, because the JobManager and TaskManager bind to 127.0.0.1 only.

Step 1 - Deploy the image

Option A: Azure portal

• In the Azure portal, open Create a resource and search for Apache StreamPark on Ubuntu 24.04 LTS by SecureAnyCloud.
• Select the plan and click Create.
• On the Basics tab, choose your subscription, resource group and region, name the VM, and select Standard_B2ms.
• Set Authentication type to SSH public key, with azureuser as the username, and provide your public key.
• On the Networking tab, allow inbound 22/tcp (from your IP) and 80/tcp.
• Select Review + create, then Create. When deployment completes, note the VM's public IP address.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:apache-streampark:default:latest
az vm create \
  --resource-group my-streampark-rg \
  --name streampark \
  --image sac1647283583153:apache-streampark:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group my-streampark-rg --name streampark --port 80 --priority 900

Step 2 - Confirm the services are running

SSH in as azureuser and confirm that the systemd units are active. flink-jobmanager and flink-taskmanager are the co-located Flink cluster, streampark is the console, and nginx is the reverse proxy on port 80.

systemctl is-active flink-jobmanager flink-taskmanager streampark nginx

Expected output:

active active active active

Request the unauthenticated health endpoint that nginx serves on port 80 for liveness checks:

curl -s http://127.0.0.1/health

ok

The console and the Flink cluster all bind to the loopback interface, and nginx on port 80 is the sole external surface. Confirm the listening sockets:

ss -tln | grep -E ':80 |:10000 |:8081 |:6123 '

Step 3 - Retrieve the per-VM administrator password

StreamPark ships with a well-known default admin account (admin/streampark). On the first boot of every VM, a one-shot service rotates that password to a random value unique to the instance, verifies that the default is rejected, and writes the new password to a root-only file. Read it with sudo:

sudo cat /root/streampark-credentials.txt

The file records the console URL, the administrator username (admin) and the generated password:

# Apache StreamPark - Per-VM Credentials STREAMPARK_URL=http://YOUR_VM_IP/ STREAMPARK_ADMIN_USER=admin STREAMPARK_ADMIN_PASSWORD=<STREAMPARK_ADMIN_PASSWORD>

The file is 0600 root:root, so only the root user can read it. Keep this password safe, because it is the administrator credential for the console.

Step 4 - Sign in to the console

Open http://YOUR_VM_IP/ in your browser. StreamPark shows its sign-in page. Enter the username admin and the password from /root/streampark-credentials.txt, then click Sign in. The console is never served anonymously, and the vendor default password no longer works.

Step 5 - Explore the Application workbench

After you sign in, StreamPark opens the Application workbench under Apache Flink. This is where you create, build, release and monitor streaming applications, with dashboard cards for running jobs, available task slots and JobManager and TaskManager memory.

The image seeds a Flink SQL demo application so the workbench has a real entry to explore. To add your own jobs, click Add New.

Step 6 - View the co-located Flink cluster

Open Settings > Flink Cluster to see the Flink cluster that StreamPark manages. SecureAnyCloud registers the co-located standalone session cluster at first boot, so it is already present and RUNNING. It appears as one entry named local-session, with deploy mode standalone, pointed at the Flink REST on http://127.0.0.1:8081.

This is the proof that StreamPark is wired to a real, running Flink cluster rather than an empty console.

Step 7 - View the registered Flink runtime

Open Settings > Flink Home to see the registered Flink runtime. SecureAnyCloud registers the bundled Flink under /opt/flink as flink-1.20.5 and marks it the default, so any application or cluster you create uses it. This is how StreamPark knows which Flink distribution to build and submit against.

Step 8 - Prove StreamPark is managing the Flink cluster

Confirm the managed cluster from the command line, using the same data that the Flink Cluster view shows. Sign in to the StreamPark API with the per-VM password to get a token. Then list the registered clusters and check the Flink cluster's own REST overview:

PW=$(sudo grep '^STREAMPARK_ADMIN_PASSWORD=' /root/streampark-credentials.txt | cut -d= -f2-)
TOK=$(curl -s -X POST http://127.0.0.1/passport/signin \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode username=admin --data-urlencode "password=$PW" \
  --data-urlencode loginType=PASSWORD | jq -r '.data.token')
curl -s -X POST http://127.0.0.1/flink/cluster/list -H "Authorization: $TOK" \
  | jq -r '.data[] | "cluster=\(.clusterName) state=\(if .clusterState==1 then "RUNNING" else .clusterState end) address=\(.address)"'
curl -s http://127.0.0.1:8081/overview \
  | jq -r '"flink-version=\(.["flink-version"]) taskmanagers=\(.taskmanagers) slots-total=\(.["slots-total"])"'

cluster=local-session state=RUNNING address=http://127.0.0.1:8081 flink-version=1.20.5 taskmanagers=1 slots-total=2

The local-session cluster is RUNNING in StreamPark's registry, and the Flink cluster it points at reports Flink 1.20.5 with one TaskManager and two task slots.

Step 9 - Security model

This image is secure by default. StreamPark ships a well-known default administrator (admin/streampark), so SecureAnyCloud binds the console to loopback, keeps the public port shut, and at first boot rotates the admin password to a per-VM secret before opening nginx.

Prove the login wall directly. The health endpoint is served, the vendor default is rejected, and the per-VM password authenticates:

PW=$(sudo grep '^STREAMPARK_ADMIN_PASSWORD=' /root/streampark-credentials.txt | cut -d= -f2-) signin() { curl -s -X POST http://127.0.0.1/passport/signin -H 'Content-Type: application/x-www-form-urlencoded' --data-urlencode username=admin --data-urlencode "password=$1" --data-urlencode loginType=PASSWORD; } echo "health -> $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/health)" echo "default admin -> $(signin streampark | jq -r 'if .data.token then "ACCEPTED" else "rejected" end')" echo "per-VM admin -> $(signin "$PW" | jq -r 'if .data.token then "signed in" else "rejected" end')"

health -> 200 default admin -> rejected per-VM admin -> signed in

The vendor default admin/streampark is rejected, and only the per-VM password signs in. The Flink cluster is bound to loopback only, so it is never reachable from the network, and the NSG needs to open only ports 22 and 80.

Step 10 - Base image and versions

The base is a hardened Ubuntu 24.04 LTS, patched at build time, with unattended security upgrades enabled, so the image keeps receiving security updates on your VMs. Confirm the bundled software versions:

echo "kernel: $(uname -r)"
echo "streampark: $(basename "$(readlink -f /opt/streampark)" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')"
echo "flink: $(basename "$(readlink -f /opt/flink)" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')" java -version 2>&1 | head -1

Apache StreamPark 2.1.7 and Apache Flink 1.20.5 both run on OpenJDK 17. A first-boot service rotates the administrator password and registers the Flink runtime and cluster before the console opens to the network, so the ordering is deterministic on every boot.

Managing the services

Restart the console, the Flink cluster or the proxy with systemd:

sudo systemctl restart streampark
sudo systemctl restart flink-jobmanager flink-taskmanager
sudo systemctl restart nginx

StreamPark keeps its metadata in an embedded H2 database under /var/lib/streampark/h2-data and its workspace under /var/lib/streampark/workspace. The Flink cluster configuration is at /opt/flink/conf/config.yaml.

For production, repoint StreamPark's datasource at an external MySQL or PostgreSQL database in /opt/streampark/conf/config.yaml and restart the console.

Support

Every SecureAnyCloud image is backed by 24/7 support. If you have any questions about this deployment, contact the SecureAnyCloud team at sales@secureanycloud.com.

Deploy on Azure

Launch Apache StreamPark on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com