Store sensitive values—such as AccessKey pairs and passwords—as variables instead of writing them in plaintext. Variables also let you reuse values across configurations without repeating them. This topic describes how to create and use variables in Realtime Compute for Apache Flink.
Variable types
Realtime Compute for Apache Flink supports two variable types with different scopes:
| Type | Scope | Reference format | Supported scenarios |
|---|---|---|---|
| Deployment variable | Single deployment | ${Variable name} | SQL drafts, JAR/Python deployment entry point arguments |
| Namespace variable | Entire namespace | ${secret_values.Variable name} | SQL drafts, data ingestion, data query, JAR/Python deployment entry point arguments, deployment parameter configuration, log configuration, UI-based parameter configuration (e.g., catalogs) |
Usage notes
A variable name can have only one value.
Do not use a SQL keyword as the variable name.
In SQL drafts, reference variables only in temporary tables (created with
CREATE TEMPORARY TABLE). Referencing a variable in a persistent table (created withCREATE TABLE) makes that table unusable.
Deployment variables
Deployment variable names must be unique within a single deployment.
Reference a variable in an SQL draft
Use variables in SQL drafts to avoid hardcoding values—for example, as input parameters for a custom function. After the deployment starts, you can update variable values without modifying the draft.
In the left-side navigation pane of the Realtime Compute for Apache Flink console, choose Development > ETL.
In the SQL editor, define variables in the
${Variable name}format. Follow these rules: Example:Variables in a
WITHclause: wrap in single quotation marks —'${Variable name}'Variables as a table name or field name: wrap in grave accents — `
${Variable name}`
create temporary table `${source_name}`( id varchar, name varchar ) with ( 'connector' = 'datagen' ); create temporary table blackhole( id varchar, `${test_name}` varchar ) with ( 'connector' = '${blackhole}' ); insert into blackhole select * from `${source_name}`;Realtime Compute for Apache Flink automatically detects variables in the draft. Set values using either method:
Variables panel: enter values directly in the Variables panel of the SQL editor.

Configurations tab: click the Configurations tab on the right side of the SQL editor, then enter values in the Variables section.

After deploying the draft, verify the referenced variables on the Configuration tab of the Deployments page.

On the Deployments page, find the target deployment and click Start in the Actions column. In the Start Job panel, update variable values as needed.
ImportantUpdated values apply only to this particular job start. The values defined in the SQL draft remain unchanged.

Reference a variable in a JAR or Python deployment
Use deployment variables as entry point arguments in the Main function of a JAR or Python deployment. Two methods are available.
Method 1: Reference a namespace variable in the entry point arguments
In the left-side navigation pane, choose Security > Variables, then create a namespace variable.
Choose O&M > Deployments, then click Create Deployment.
In the Entry Point Main Arguments field, enter variable names in the following format:
To manage variables in the console, go to Security > Variables. If the variable name contains a special character, see What do I do if I want to specify a special character in the value of the Entry Point Main Arguments parameter?
--<Variable name in code> ${secret_values.<Variable name in console>}Example:
--akid ${secret_values.test1}
Click Deploy.
Find the deployment and click Start in the Actions column.
Method 2: Define variables inline in the deployment dialog
In the left-side navigation pane, choose O&M > Deployments, then click Create Deployment.
In the dialog box, enter variable names in the Entry Point Main Arguments field, then enter variable values in the Variables section. If the variable name contains a special character, see What do I do if I want to specify a special character in the value of the Entry Point Main Arguments parameter? For other deployment parameters, see Create a deployment.

Click Deploy.
Choose O&M > Deployments. Find the target deployment and click Start in the Actions column. In the Start Job panel, update variable values for this job start if needed.

Namespace variables
Namespace variables are available across an entire namespace. Reference them in the ${secret_values.Variable name} format.
Create a variable
Only members with editor or higher permissions, or members with the variable creation permission, can create variables.
Log on to the Realtime Compute for Apache Flink console. Find the workspace and click Console in the Actions column.
In the left-side navigation pane, choose Security > Variables, then click Add Variable and configure the following parameters:
Parameter Description Variable name Must be unique within the namespace. Cannot be changed after creation. Variable value Case-sensitive. Can be updated after creation. For details, see Edit or delete a variable. Type Cannot be changed after creation. Plaintext: the value is visible on the Variables page. Ciphertext: the value is hidden. Click OK.
Reference a variable
After creating a variable, reference it in the ${secret_values.Variable name} format. The following examples show how to reference namespace variables in different scenarios.
SQL draft
In the DDL statement of an SQL draft, use the ${secret_values.Variable name} format. Follow these rules:
Variables in a
WITHclause: wrap in single quotation marks —'${secret_values.Variable name}'Variables as a table name or field name: wrap in grave accents — `
${secret_values.Variable name}`
Example:
create temporary table `${secret_values.source_name}`(
id varchar,
name varchar
) with (
'connector' = 'datagen'
);
create temporary table blackhole(
id varchar,
`${secret_values.test_name}` varchar
) with (
'connector' = '${secret_values.blackhole}'
);
insert into blackhole select * from `${secret_values.source_name}`;Data ingestion
Reference variables in YAML-based data ingestion configurations to avoid storing credentials in plaintext. Example:
source:
type: mysql
name: Mysql Source
hostname: localhost
port: 3306
username: test
password: ${secret_values.mysqlpw}
tables: app_db.\.*
server-id: 5400-5404
···Data query
Reference variables in script-based queries. Example:
USE CATALOG paimon;
CREATE DATABASE IF NOT EXISTS `${secret_values.test_name}`;
CREATE TABLE paimon.`${secret_values.test_name}`.ods_user_log
(
item_id int NOT NULL,
`${secret_values.user}` varchar(50) NOT NULL,
action varchar(20) NOT NULL,
vtime timestamp,
ds varchar(10) NOT NULL
)
PARTITIONED BY (ds);
SELECT * from paimon.`${secret_values.test_name}`.ods_user_log LIMIT 10;JAR or Python deployment
Reference namespace variables as entry point arguments in JAR or Python deployments.
In the left-side navigation pane, choose O&M > Deployments, then click Create Deployment.
Enter a variable name in the Entry Point Main Arguments field. For other deployment parameters, see Create a deployment.

Click Deploy.
Deployment parameter configuration
Reference namespace variables in the parameter configuration of a deployment.
In the left-side navigation pane, choose O&M > Deployments, then click the target deployment.
On the Configuration tab, click Edit in the upper-right corner of the Parameters section. Enter variable references as parameter values.

Click Save.
Log configuration
Reference namespace variables in log export configurations to avoid storing credentials in log config files.
Go to the logging configuration:
To configure log export for a single deployment, see Configure parameters to export the logs of a deployment.
To configure log export for all deployments in a namespace, see Configure parameters to export the logs of all deployments in a namespace.
Reference variables in the logging configuration. The following example uses the
accessKeyIdandaccessKeySecretvariables to export logs to Simple Log Service:<Appender name="SLS" type="SLS"> <Layout pattern="%d{yyyy-MM-dd HH:mm:ss,SSS}{GMT+8} %-5p %-60c %x - %m%n" type="PatternLayout" charset="UTF-8"/> <!-- The final effective log path is: ${baseUri}/logs/${namespace}/${deploymentId}/{jobId}/ --> <Property name="namespace">{{ namespace }}</Property> <!-- Do not modify this line --> <Property name="project">YOUR-SLS-PROJECT</Property> <Property name="logStore">YOUR-SLS-LOGSTORE</Property> <Property name="endpoint">YOUR-SLS-ENDPOINT</Property> <Property name="accessKeyId">${secret_values.accessKeyId}</Property> <Property name="accessKeySecret">${secret_values.accessKeySecret}</Property> <Property name="topic">{{ namespace }}:{{ deploymentId }}:{{ jobId }}</Property> <Property name="deploymentName">{{ deploymentName }}</Property> <Property name="flushIntervalSeconds">10</Property> <Property name="flushIntervalEventCount">100</Property> </Appender>For the complete configuration, see Configure parameters to export logs of a deployment.
UI-based parameter configuration
Reference namespace variables when configuring UI-based parameters such as catalog credentials.
In the left-side navigation pane, click Catalogs.
In the Create Catalog dialog box, reference a variable in the relevant configuration field. The following example uses the
mysqlpasswordvariable for the password parameter of a MySQL catalog.
Edit or delete a variable
Editing or deleting variables can cause deployment failures or require redeployment. Deleting a variable does not affect deployments that are already running.
Log on to the Realtime Compute for Apache Flink console. Find the workspace and click Console in the Actions column.
In the left-side navigation pane, choose Security > Variables. Find the target variable and click Edit or Delete in the Actions column.
Edit: change the variable value. Only members with editor or higher permissions can edit variables.
Delete: remove the variable. Only members with editor or higher permissions, or members with the variable deletion permission, can delete variables.