Resolve env-var placeholders in Flink config.yaml

[velo]

Summary

BaseRunner.initConfiguration() now runs the loaded config.yaml values through the existing EnvVarResolver (the same ${VAR} mechanism already applied to the SQL script and compiled plan). This lets secrets be injected into Flink config via env vars instead of landing in the plaintext config.yaml ConfigMap.

Motivating use: Iceberg auto-maintenance wires a JDBC lock store whose credentials must not sit in a ConfigMap. cloud-compilation emits flink-maintenance.lock.jdbc.user: ${ICEBERG_LOCK_USER} / ...password: ${ICEBERG_LOCK_PASSWORD} placeholders; the flink pod mounts them from the iceberg-maintainance-locktable secret, and this change resolves them at runtime.

Configuration.toMap() returns a copy, so mutating conf while iterating is safe. Values without ${...} are untouched.

Test

CliRunnerTest.initConfiguration_shouldResolveEnvVarPlaceholdersInConfig — asserts a ${VAR} config value resolves from env and literals pass through. Full CliRunnerTest green (14/14, under Java 17).

Related

• Pairs with cloud-compilation PR (branch feat/iceberg-auto-maintenance) which emits the config.
• Wayfinder ticket: DataSQRL/cloud-compilation-wayfinder#13

🤖 Generated with Claude Code

[ferenc-csaky]

Added 2 comments, but the core logic looks good.