CMF 2.4.2 Unable to Access Flink Web UI over TLS (HTTPS) / Redirected to Internal Kubernetes URL

Stream Processing Apache Flink®
1

Hi

I’m having an issue accessing the Flink Web UI when both CMF and the Flink cluster are secured with TLS (P-256 certificates).

It looks like CMF is not correctly proxying the Flink Web UI and redirects users to the Flink cluster’s internal Kubernetes URL, which is not reachable from the browser.

Issue Description

When I click on the Flink Dashboard from the CMF UI, the following URL is opened:

http://localhost:30080/cmf/api/v1/environments/flink-report-local-test-env/applications/basic-example-tls/flink-web-ui/#/overview

CMF then redirects the browser to:

https://basic-example-tls.flink-report-local-test:8081/#/overview

This is the internal Kubernetes DNS name of the Flink cluster, so the browser cannot resolve or connect to it.

CLI Behavior

I also tried using the Confluent CLI:

confluent flink application web-ui-forward basic-example-tls \
  --environment flink-report-local-test-env \
  --port 8081 \
  --url https://localhost:30080 \
  --certificate-authority-path ./ca.crt

Output:

Starting web UI at http://localhost:8081/ ... (Press Ctrl-C to stop)

However, opening:

http://localhost:8081

results in the same redirect:

https://basic-example-tls.flink-report-local-test:8081

What Works

If I bypass CMF completely and port-forward the Flink REST service directly:

kubectl -n flink-report-local-test port-forward svc/basic-example-tls-rest 8081:8081

Output:

Forwarding from 127.0.0.1:8081 -> 8081
Forwarding from \[::1\]:8081 -> 8081

I can successfully access the Flink Dashboard at:

https://localhost:8081

without any issue.

Question

Has anyone encountered this behavior before?

Is there any known limitation or configuration required when using TLS-enabled Flink clusters with CMF?

More specifically:

  • Is CMF expected to proxy HTTPS traffic to the Flink Web UI?
  • Why is the browser being redirected to the internal Kubernetes URL instead of staying behind the CMF/CLI proxy?
  • Are there specific Flink or CMF settings required when TLS is enabled on the Flink REST endpoint?

Environment

  • CMF 2.4.2
  • Flink Image Version: v2_0
  • CMF secured with TLS (P-256)
  • Flink secured with TLS (P-256)

Any troubleshooting tips or guidance would be greatly appreciated.

Thanks in advance!

Disclaimer:
I used an AI assistant to help structure and refine this post. The issue, observations, commands, and test results described above come from my own environment.

2

Thanks for this report – we are looking into it.

3

This is a known limitation in CMF: We don’t support the Flink UI forwarding when security.ssl.rest.enabled: true.

security.ssl.internal.enabled: true should work.

We can add an initial implementation / fix for this into the upcoming CP Flink 2.5 release by allowing to configure a single, CMF-wide truststore and client keystore. This is similar to what Flink kubernetes operator does already (which I assume you have configured accordingly). Would that fix work for you?
If this is a blocker, we can provide you a private preview image of CMF that fixes this issue.

4

Hello,
Thank you for your response. The proposed fix looks good to me. As this is not a blocking issue, we can wait until the next CP Flink release.