feat(flink): Terraform-managed Flink Kubernetes Operator, dedicated N…

[meetreks]

…odePool, tuned storage

Add an in-workshop Apache Flink lab that sits alongside the Spark labs (and, when enabled, the Kafka and ClickHouse labs) on the same EKS Auto Mode cluster created by analytics/terraform/spark-k8s-operator/.

Terraform side (behind var.enable_flink_lab, default true):

• flink-operator.tf — Apache Flink Kubernetes Operator via the Helm chart at https://downloads.apache.org/flink/flink-kubernetes-operator-/ (repository URL is templated from the version so both stay in sync), pinned to 1.15.0 — the current stable release published May 2026. Includes a tuned flink-gp3 StorageClass at 6000 IOPS / 500 MiB/s with reclaimPolicy: Retain and allowVolumeExpansion: true, ready for the moment a participant graduates from in-memory state to RocksDB.
• variables.tf — new vars: enable_flink_lab (bool) and flink_operator_version (string, defaults to 1.15.0).
• manifests/automode/nodepool-flink.yaml — dedicated Karpenter NodePool with workload=flink:NoSchedule taint. m/r Gen 5+ Nitro, On-Demand only, sizes 2xlarge..8xlarge. Auto-discovered by the existing fileset('nodepool*.yaml') pattern in eks.tf.

Cert-manager (required for the Flink operator's admission webhooks) is already installed on the workshop cluster by the addon stack, so no extra prep is needed to install the operator.

Lab manifests + scripts (analytics/flink/):

• flink-cluster.yaml — FlinkDeployment CR running the built-in StateMachineExample from the official flink:1.20 image. Application mode (one JobManager per job — the modern operator-native pattern), parallelism 2, HashMap state backend with filesystem checkpoints on ephemeral /tmp for the demo. nodeSelector + toleration pin JM and TM pods to the dedicated NodePool. Uses the current state.backend.type config key (not the deprecated state.backend alias that Flink still accepts with a warning).
• deploy-flink.sh — preflight-checks the operator, StorageClass, and NodePool, applies the FlinkDeployment and waits for status.lifecycleState=STABLE.
• cleanup.sh — deletes the FlinkDeployment and any PVCs it created, leaves the operator, StorageClass, and NodePool for Terraform to reclaim on destroy.
• README.md — architecture overview, deploy/verify/cleanup walkthrough, storage tier and sizing sections mirroring the Kafka and ClickHouse labs' shape. Verify section explicitly recommends CR status + checkpoint counts over stdout tail — Flink is a streaming pattern, not a batch one.

Verified end-to-end against a scratch spike on the workshop's Auto Mode cluster: Karpenter provisioned 1x m5a.2xlarge in us-west-2b, bin-packed the JobManager and both TaskManagers onto it. Job reached status.jobStatus.state=RUNNING within ~3 minutes of apply, all 4 tasks in the execution graph running, checkpoint counter climbing steadily (74 completed at spike snapshot time). The Flink Web UI on http://state-machine-rest.flink.svc:8081 returned the expected job overview and checkpoint history via the REST API.

What does this PR do?

🛑 Please open an issue first to discuss any significant work and flesh out details/direction. When we triage the issues, we will add labels to the issue like "Enhancement", "Bug" which should indicate to you that this issue can be worked on and we are looking forward to your PR. We would hate for your time to be wasted.
Consult the CONTRIBUTING guide for submitting pull-requests.

Motivation

More

• Yes, I have tested the PR using my local account setup (Provide any test evidence report under Additional Notes)
• Mandatory for new blueprints. Yes, I have added a example to support my blueprint PR
• Mandatory for new blueprints. Yes, I have updated the website/docs or website/blog section for this feature
• Yes, I ran pre-commit run -a with this PR. Link for installing pre-commit locally

For Moderators

• E2E Test successfully complete before merge?

Additional Notes