# Confluent Platform for Apache Flink FAQ The following sections provide answers to some of the most common questions about Confluent Platform for Apache Flink®. ## What is Confluent Platform for Apache Flink? Confluent Platform for Apache Flink is a stream processing component of Confluent Platform that runs Apache Flink® applications on-premises. Use it to run and manage Flink applications alongside other Confluent Platform components. ## What is the relationship between Confluent Platform for Apache Flink and Flink on Confluent Cloud? Confluent Platform for Apache Flink and Confluent Cloud for Apache Flink are two separate products that have different deployment models: * Confluent Platform for Apache Flink is designed for on-premises deployments, providing a managed experience for running Flink applications alongside other Confluent Platform components. * Confluent Cloud for Apache Flink provides a cloud-native, serverless service for Flink that enables simple and scalable stream processing that easily integrates with Kafka. ## How do I install Confluent Platform for Apache Flink? You can install Confluent Platform for Apache Flink using Helm. For more details, see [Install Confluent Manager for Apache Flink with Helm](installation/helm.md#install-cmf-helm). ## What license do I need for Confluent Platform for Apache Flink? Confluent Platform for Apache Flink is an Confluent Enterprise feature. You need a Confluent Platform for Apache Flink license to use Confluent Platform for Apache Flink. ## What is the advantage of using Confluent Platform for Apache Flink over Apache Flink? Confluent provides support and security patches for Confluent Platform for Apache Flink just like other Confluent Platform components. For more information, see [Versions and Interoperability for Confluent Manager for Apache Flink](installation/versions-interoperability.md#cmf-interop). ## What is Confluent Manager for Apache Flink (CMF)? CMF is the central management component that enables users to securely manage a fleet of Flink applications across multiple environments. CMF sits next to other Confluent Platform components (like Confluent Server and Kafka Connect), and exposes functionality primarily through a REST API, which is also used by the Confluent CLI and Confluent Control Center. ## How do I get started? To get started with Confluent Platform for Apache Flink, you can either create and submit a Flink SQL statement or deploy a Flink application. - To learn how to submit a Flink SQL statement with Confluent Manager for Apache Flink (CMF), see [Submit Flink SQL Statement with Confluent Manager for Apache Flink](get-started/get-started-statement.md#get-started-flinksql). - To learn how to deploy a Flink application with CMF, see [Get Started with Applications in Confluent Manager for Apache Flink](get-started/get-started-application.md#cpf-get-started). ## Can CMF manage Flink workloads across multiple Kubernetes clusters? Yes. A single CMF instance can manage Flink workloads across multiple Kubernetes clusters. CMF runs on the hub cluster and registers spoke clusters through `kubeconfig` files. Environments can target any registered cluster. For details on registering, monitoring, and decommissioning clusters, see [Manage Multiple Kubernetes Clusters in Confluent Manager for Apache Flink](configure/kubernetes-clusters.md#cmf-kubernetes-clusters). ## What is the purpose of a Flink environment in CMF? Flink environments provide isolation and shared configuration. Isolation enables logical access control with role-based access control (RBAC) (RBAC) and physical isolation with Kubernetes namespaces. Shared configuration allows platform operators to set defaults such as observability settings or checkpoint storage location, which take precedence over individual application settings. This separates platform concerns from developer concerns. RBAC isolates which applications and statements each team can access within a shared environment, but statements that run in the same environment use the same mapped credentials for a given catalog or database, so credential isolation between teams requires separate environments. For what an environment can and cannot isolate, see [Environment isolation](configure/access-control.md#cmf-resource-isolation). ## What are Flink applications in CMF? CMF applications are resources consisting of a Flink job (packaged as a Java JAR file or a PyFlink job), a Flink configuration, the specification of a Flink Kubernetes cluster, and status information. Every application runs on its own cluster, providing isolation between all applications. ## What are Flink application instances? Application instances track deployed Flink applications with unique identifiers (UIDs). Every specification change creates a new instance. Application instances provide the following benefits: * Understand the effective specification of the application after environment defaults have been applied. * Track changes made to the application over time. * Correlate Flink application activity with centralized logging systems, as the instance name is provided as an annotation on Kubernetes pods. * Track the status of the underlying Flink job, which is especially useful for finite streaming workloads (batch processing). ## How can I manage CMF resources? Confluent provides a number of ways to manage CMF resources. You can use: - The Confluent CLI. To manage Flink resources with the Confluent CLI, you must be running version 4.7.0 or later and should be logged out of Confluent Cloud to access these on-premises commands. For more information, see [CLI Operations for Confluent Manager for Apache Flink](clients-api/cli.md#cmf-flink-cli). - REST APIs. To use REST APIs to manage Flink environments and applications. For more information, see [REST APIs for Confluent Manager for Apache Flink](clients-api/rest.md#af-rest-api). - Confluent for Kubernetes to manage Flink resources in Kubernetes. To manage Flink environments and applications in Kubernetes, see [Manage Flink With Confluent for Kubernetes](clients-api/flink-cfk.md#cmf-cfk). - The built-in CMF UI, which provides a graphical interface and is available by default with no separate installation. For more information, see [Configure the Confluent Manager for Apache Flink UI](installation/ui.md#cmf-ui-config). - In earlier releases, you could manage some Flink resources in Confluent Control Center, which also provides a graphical interface. This integration is now deprecated but continues to work with your existing configuration. To manage Flink environments and applications in Confluent Control Center, see [Use Control Center with Confluent Manager for Apache Flink](/control-center/current/cmf). ## What are Flink statements and their limitations in CMF? Statements are Flink SQL queries represented as CMF resources. These are the main types of statements: * Statements reading catalog metadata, for example `SHOW TABLES`: Immediately executed by CMF without creating a Flink deployment, typically for interactive scenarios. * Table operation statements (`CREATE TABLE`, `ALTER TABLE`, `DROP TABLE`): Executed by CMF without creating a Flink deployment. For details, see [Table Operations in Confluent Manager for Apache Flink](jobs/sql-statements/table-operations.md#flink-sql-table-operations). * Interactive `SELECT` statements: Executed on Flink clusters, collecting results retrievable with the Statement Results endpoint (ad-hoc data exploration). * Detached `INSERT INTO` statements: Executed on Flink clusters to deploy data pipeline jobs in production, writing results into a table, typically backed by a Kafka topic. Statements don’t support `EXPLAIN`. For details on what is and is not supported, see [Features & Support for Statements in Confluent Manager for Apache Flink](jobs/sql-statements/features-support.md#flink-sql-features-support). ## How are data sources connected for Flink SQL Statements? Flink SQL uses catalogs to connect to external storage systems. Confluent Manager for Apache Flink features built-in Kafka catalogs that expose Kafka topics as tables and derive their schemas from Schema Registry. When configuring a catalog: * A catalog references a Schema Registry instance and one or more Kafka clusters. * Each Kafka cluster is represented as a DATABASE, and each topic of a cluster is a TABLE in that database. * Sensitive connection properties (like credentials) must be stored separately in Flink Secrets. ## What is a compute pool? A compute pool defines the compute resources used to execute a SQL statement. Each statement must reference a compute pool, which defines the Flink cluster that runs the query. * With `DEDICATED`, each statement runs on its own dedicated Flink cluster in application mode. * With `SHARED`, statements run on a single long-lived Flink session cluster. * The compute pool configuration includes the Flink version, image (must use a `confluentinc/cp-flink-sql` image), and resource specifications for the JobManager and TaskManagers. ## Can I configure logging and metrics for Flink applications? Yes, you can configure both logging and metrics. For Flink logging configurations, you use the Log4j 2 configuration file, exposed through the application and environment APIs. For more information, see [Logging with Confluent Manager for Apache Flink](jobs/configure/logging.md#cmf-logging). Flink metrics collection leverages Flink’s metrics system. For more information, see [Collect Metrics for Confluent Manager for Apache Flink](jobs/configure/metrics.md#cmf-metrics). ## What are the risks associated with deploying Flink jobs with CMF? Apache Flink executes user-provided code, which can access networked systems and data. Key risks include unauthorized data access, lateral network movement, and resource exhaustion. Mitigate with RBAC, network policies, and never deploy unconfigured clusters in internet-facing environments. ## What security features are offered with Confluent Platform for Apache Flink? Confluent Manager for Apache Flink provides the following key security features: - Authentication with Mutual TLS (mTLS) authentication and OAuth authentication. For more information, see [Configure Authentication for Confluent Manager for Apache Flink](installation/authentication.md#cmf-authenticate). - Authorization with Role-Based Access Control (RBAC) for fine-grained access control to CMF resources. For more information, see [Configure Authorization for Confluent Manager for Apache Flink](installation/authorization.md#cmf-authorize) and [How to Secure a Flink Job with Confluent Manager for Apache Flink](jobs/configure/security.md#cmf-security). - Encryption of secrets. For more information, see [Data Encryption in Confluent Manager for Apache Flink](installation/encryption.md#cmf-encrypt).