Apache StreamPark on Ubuntu 24.04 on Azure User Guide

Overview

Apache StreamPark is a streaming application development framework and a one stop management console for Apache Flink. From a single browser console you can author, configure, deploy and monitor streaming applications, register and manage Flink runtimes and clusters, track application state, and standardise streaming operations across a team. Because StreamPark is a management platform rather than a compute engine, it needs a Flink cluster to drive, so this cloudimg image bundles one: a co located Apache Flink 1.20.5 standalone session cluster running on the same host, giving you a complete, self contained StreamPark workbench that manages a real, running Flink cluster the moment the instance boots.

The image ships Apache StreamPark 2.1.7 as a Spring Boot service behind an nginx reverse proxy on port 80, on a hardened, fully patched Ubuntu 24.04 LTS base. StreamPark stores its metadata in an embedded H2 database and binds to the loopback interface, and the co located Flink cluster (one JobManager and one TaskManager) binds to loopback too, so neither is exposed to the network. StreamPark ships a well known default administrator (admin/streampark); on the first boot of every VM cloudimg rotates that password to a value unique to the instance, proves the default is rejected, registers the local Flink cluster in the console, and only then opens the public port. Backed by 24/7 cloudimg support.

What is included:

• Apache StreamPark 2.1.7 served by nginx on port 80, running as a Spring Boot service on OpenJDK 17
• A co located Apache Flink 1.20.5 standalone session cluster (one JobManager, one TaskManager), already registered in StreamPark and shown RUNNING
• The vendor default admin password rotated to a per VM secret on first boot, recorded in a root only file; the default admin/streampark is proven rejected
• StreamPark's metadata in an embedded H2 database under /var/lib/streampark/h2-data
• The StreamPark console and the Flink REST API bound to 127.0.0.1 only, never exposed to the network
• flink-jobmanager.service, flink-taskmanager.service, streampark.service and nginx.service as enabled systemd units
• An unauthenticated /health endpoint on nginx for liveness checks
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2ms (2 vCPU / 8 GiB RAM) is the recommended size: StreamPark, the Flink JobManager and the Flink TaskManager are three JVMs, and 8 GiB gives comfortable headroom for real streaming workloads. The image boots healthy on Standard_B2s (4 GiB) for evaluation, but size up for running jobs. NSG inbound: allow 22/tcp from your management network and 80/tcp for the console. StreamPark serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain. The Flink cluster is never exposed: JobManager and TaskManager bind to 127.0.0.1 only.

Step 1 - Deploy the image

Option A: Azure portal

1. In the Azure portal, open Create a resource and search for Apache StreamPark on Ubuntu 24.04 LTS by cloudimg.
2. Select the plan and click Create.
3. On the Basics tab, choose your subscription, resource group and region, name the VM, and select Standard_B2ms.
4. Set Authentication type to SSH public key, with azureuser as the username, and provide your public key.
5. On the Networking tab, allow inbound 22/tcp (from your IP) and 80/tcp.
6. Review and create. When deployment completes, note the VM's public IP address.

Option B: Azure CLI

az vm create \
  --resource-group my-streampark-rg \
  --name streampark \
  --image cloudimg:apache-streampark:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group my-streampark-rg --name streampark --port 80 --priority 900

Step 2 - Confirm the services are running

SSH in as azureuser and confirm the systemd units are active. flink-jobmanager and flink-taskmanager are the co located Flink cluster, streampark is the console, and nginx is the reverse proxy on port 80.

systemctl is-active flink-jobmanager flink-taskmanager streampark nginx

Expected output:

active
active
active
active

nginx serves an unauthenticated health endpoint on port 80 for liveness checks:

curl -s http://127.0.0.1/health

ok

The console and the Flink cluster all bind to the loopback interface; nginx on port 80 is the sole external surface. You can confirm the listening sockets:

ss -tln | grep -E ':80 |:10000 |:8081 |:6123 '

Step 3 - Retrieve the per VM administrator password

StreamPark ships with a well known default administrator (admin/streampark). On the first boot of every VM a one shot service rotates that password to a random value unique to the instance, verifies the default is rejected, and writes the new password to a root only file. Read it with sudo:

sudo cat /root/streampark-credentials.txt

The file records the console URL, the administrator username (admin) and the generated password:

# Apache StreamPark - Per-VM Credentials
STREAMPARK_URL=http://YOUR_VM_IP/
STREAMPARK_ADMIN_USER=admin
STREAMPARK_ADMIN_PASSWORD=<STREAMPARK_ADMIN_PASSWORD>

The file is 0600 root:root, so only the root user can read it. Keep this password safe: it is the administrator credential for the console.

Step 4 - Sign in to the console

Open http://YOUR_VM_IP/ in your browser. StreamPark shows its sign in page. Enter the username admin and the password from /root/streampark-credentials.txt, then click Sign in. The console is never served anonymously, and the vendor default password no longer works.

Step 5 - The Application workbench

After signing in, StreamPark opens the Application workbench under Apache Flink. This is where you create, build, release and monitor streaming applications, with dashboard cards for running jobs, available task slots and JobManager and TaskManager memory. The image seeds a Flink SQL demo application so the workbench has a real entry to explore; from here you would add your own jobs with Add New.

Step 6 - The co located Flink cluster

Open Settings > Flink Cluster to see the Flink cluster StreamPark manages. cloudimg registers the co located standalone session cluster at first boot, so it is already present and RUNNING: one entry named local-session, deploy mode standalone, pointed at the Flink REST on http://127.0.0.1:8081. This is the proof that StreamPark is wired to a real, running Flink cluster rather than an empty console.

Step 7 - The registered Flink runtime

Open Settings > Flink Home to see the registered Flink runtime. cloudimg registers the bundled Flink under /opt/flink as flink-1.20.5 and marks it the default, so any application or cluster you create uses it. This is how StreamPark knows which Flink distribution to build and submit against.

Step 8 - Prove StreamPark is managing the Flink cluster

You can confirm the managed cluster from the command line, the same data the Flink Cluster view shows. Sign in to the StreamPark API with the per VM password to get a token, then list the registered clusters and check the Flink cluster's own REST overview:

PW=$(sudo grep '^STREAMPARK_ADMIN_PASSWORD=' /root/streampark-credentials.txt | cut -d= -f2-)
TOK=$(curl -s -X POST http://127.0.0.1/passport/signin \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode username=admin --data-urlencode "password=$PW" \
  --data-urlencode loginType=PASSWORD | jq -r '.data.token')
curl -s -X POST http://127.0.0.1/flink/cluster/list -H "Authorization: $TOK" \
  | jq -r '.data[] | "cluster=\(.clusterName) state=\(if .clusterState==1 then "RUNNING" else .clusterState end) address=\(.address)"'
curl -s http://127.0.0.1:8081/overview \
  | jq -r '"flink-version=\(.["flink-version"]) taskmanagers=\(.taskmanagers) slots-total=\(.["slots-total"])"'

cluster=local-session state=RUNNING address=http://127.0.0.1:8081
flink-version=1.20.5 taskmanagers=1 slots-total=2

The local-session cluster is RUNNING in StreamPark's registry, and the Flink cluster it points at reports Flink 1.20.5 with one TaskManager and two task slots.

Step 9 - Security model

This image is secure by default. StreamPark ships a well known default administrator (admin/streampark), so cloudimg binds the console to loopback, keeps the public port shut, and at first boot rotates the admin password to a per VM secret before opening nginx. You can prove the login wall directly: the health endpoint is served, the vendor default is rejected, and the per VM password authenticates.

PW=$(sudo grep '^STREAMPARK_ADMIN_PASSWORD=' /root/streampark-credentials.txt | cut -d= -f2-)
signin() { curl -s -X POST http://127.0.0.1/passport/signin -H 'Content-Type: application/x-www-form-urlencoded' --data-urlencode username=admin --data-urlencode "password=$1" --data-urlencode loginType=PASSWORD; }
echo "health        -> $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/health)"
echo "default admin -> $(signin streampark | jq -r 'if .data.token then "ACCEPTED" else "rejected" end')"
echo "per-VM admin  -> $(signin "$PW" | jq -r 'if .data.token then "signed in" else "rejected" end')"

health        -> 200
default admin -> rejected
per-VM admin  -> signed in

The vendor default admin/streampark is rejected, and only the per VM password signs in. The Flink cluster is bound to loopback only, so it is never reachable from the network, and the NSG needs to open only ports 22 and 80.

Step 10 - Base image and versions

The base is a hardened, fully patched Ubuntu 24.04 LTS with unattended security upgrades enabled, so the image keeps receiving security updates on your VMs. You can confirm the bundled software versions:

echo "kernel:     $(uname -r)"
echo "streampark: $(basename "$(readlink -f /opt/streampark)" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')"
echo "flink:      $(basename "$(readlink -f /opt/flink)" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')"
java -version 2>&1 | head -1

Apache StreamPark 2.1.7 and Apache Flink 1.20.5 both run on OpenJDK 17. A first boot service rotates the administrator password and registers the Flink runtime and cluster before the console opens to the network, so ordering is deterministic on every boot.

Managing the services

Restart the console, the Flink cluster or the proxy with systemd:

sudo systemctl restart streampark
sudo systemctl restart flink-jobmanager flink-taskmanager
sudo systemctl restart nginx

StreamPark keeps its metadata in an embedded H2 database under /var/lib/streampark/h2-data and its workspace under /var/lib/streampark/workspace; the Flink cluster configuration is at /opt/flink/conf/config.yaml. For production, repoint StreamPark's datasource at an external MySQL or PostgreSQL database in /opt/streampark/conf/config.yaml and restart the console.

Support

Every cloudimg image is backed by 24/7 support. If you have any questions about this deployment, contact the cloudimg team at support@cloudimg.co.uk.