This is an automated email from the ASF dual-hosted git repository.
rmetzger pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/flink-kubernetes-operator.git
The following commit(s) were added to refs/heads/main by this push:
new 5ca04ac7 [FLINK-40246] Migrate logging stack to SLF4J 2.x and bump
Logback to 1.5.34 (#1170)
5ca04ac7 is described below
commit 5ca04ac7ebfb3d1d3358aa9b5dd613755cd12579
Author: Purushottam Sinha <[email protected]>
AuthorDate: Thu Aug 13 21:28:16 2026 +0530
[FLINK-40246] Migrate logging stack to SLF4J 2.x and bump Logback to 1.5.34
(#1170)
* [FLINK-40246] Migrate logging stack to SLF4J 2.x and bump Logback to
1.5.34
Logback 1.2.13 is the terminal release of an EOL line, so the CVEs filed
against it (CVE-2024-12798, CVE-2024-12801, CVE-2025-11226, CVE-2026-1225,
CVE-2026-9828, CVE-2026-10532) have no fix on that branch. Every patched
Logback release targets SLF4J 2.x, so clearing them requires moving the
whole logging stack off slf4j-api 1.7.36.
The 1.7.36 pin is independently incorrect. JOSDK 5.5.0 and fabric8 7.8.0
both declare slf4j-api 2.0.18, and JOSDK's
ReconciliationDispatcher.handleErrorStatusHandler calls
Logger.atLevel(Level), which does not exist in 1.7.36. A FlinkStateSnapshot
whose reconcile fails and whose error-status patch then also fails throws
NoSuchMethodError from inside the error handler, masking the original
failure.
- slf4j-api 1.7.36 -> 2.0.18, logback 1.2.13 -> 1.5.34
- log4j-slf4j-impl -> log4j-slf4j2-impl across all modules, including the
dependency-plugin item that stages the binding into the image
- drop log4j-slf4j-impl from the operator NOTICE (provided since
FLINK-39501, so never bundled) and refresh the slf4j-api versions
- drop the "Logging Library Version Overrides" hint from the logging docs:
swapping the shipped logging jars is not a supported user operation
* [FLINK-40246] Pin slf4j-api and prune Flink's SLF4J 1.7 binding
Flink brings slf4j-api 1.7.36 in transitively, and without a
dependencyManagement pin four modules resolve it rather than 2.0.18:
flink-kubernetes-standalone, flink-kubernetes-operator-api,
flink-autoscaler and flink-autoscaler-plugin-jdbc.
The first two then pair 1.7.36 with the 2.x-only log4j-slf4j2-impl. SLF4J
does not fail on a binding/API mismatch: it installs a NOP logger and
discards every log line, so their test output was silently dead. The other
two silently stayed on the complete 1.7 stack, because
flink-test-utils-junit supplies the matching 1.7 binding - which is why the
migration appeared to have succeeded there.
Excluding Flink's log4j-slf4j-impl belongs to the same change rather than
being cleanup: once the pin moves those modules to 2.0.18, the 1.7 binding
inherited from the Flink test utils would be the only one left, flipping
them from working-on-1.7 to NOP.
The shipped image was not affected. flink-kubernetes-operator declares
slf4j-api directly, so the shaded jar always bundled 2.0.18, and the other
modules' classes are caller-side compatible at runtime.
- pin slf4j-api in dependencyManagement
- exclude Flink's log4j-slf4j-impl where flink-test-utils(-junit) puts it on
a test classpath, and declare log4j-slf4j2-impl there instead
- test_logback_logging.sh: fail on the NOP fallback ("No SLF4J providers
were found", "Failed to load class StaticLoggerBinder") and match SLF4J
2.x's "providers" wording alongside 1.7.x's "bindings"
All 14 reactor modules now resolve slf4j-api 2.0.18, and none resolves the
1.7 binding.
* [FLINK-40246] Empty commit to re-trigger CI
The e2e_ci matrix failed on a Maven Central 403 while fetching the ASF
parent POM inside the Docker build, unrelated to this change. The re-run
carried the old result forward instead of rebuilding, so this triggers a
fresh run.
---
docs/content.zh/docs/operations/logging.md | 6 +-----
docs/content/docs/operations/logging.md | 6 +-----
e2e-tests/test_logback_logging.sh | 16 ++++++++++++----
examples/autoscaling/pom.xml | 2 +-
examples/flink-beam-example/pom.xml | 2 +-
examples/flink-sql-runner-example/pom.xml | 2 +-
flink-autoscaler-plugin-jdbc/pom.xml | 13 +++++++++++++
flink-autoscaler-standalone/pom.xml | 2 +-
.../src/main/resources/META-INF/NOTICE | 4 ++--
flink-autoscaler/pom.xml | 13 +++++++++++++
flink-kubernetes-operator-api/pom.xml | 2 +-
flink-kubernetes-operator/pom.xml | 20 ++++++++++++++++----
.../src/main/resources/META-INF/NOTICE | 3 +--
flink-kubernetes-standalone/pom.xml | 2 +-
pom.xml | 13 +++++++++++--
15 files changed, 76 insertions(+), 30 deletions(-)
diff --git a/docs/content.zh/docs/operations/logging.md
b/docs/content.zh/docs/operations/logging.md
index 7dc36b63..3a6cdfd5 100644
--- a/docs/content.zh/docs/operations/logging.md
+++ b/docs/content.zh/docs/operations/logging.md
@@ -115,11 +115,7 @@ Logback XML overrides replace the entire default
configuration. Unlike Log4j2 `.
## Logging Library Version Overrides
-The operator ships with Logback 1.2.x and SLF4J 1.7.x. These versions are
bundled in the Docker image and the SLF4J 1.7.x API is shaded into the operator
JAR.
-
-{{< hint warning >}}
-Upgrading to Logback 1.4+/1.5+ or SLF4J 2.x is not supported. SLF4J 2.x uses a
`ServiceLoader`-based binding mechanism that is incompatible with the SLF4J
1.7.x API shaded inside the operator. Replacing the JARs at runtime will result
in `ClassNotFoundException: org.slf4j.impl.StaticLoggerBinder`.
-{{< /hint >}}
+The operator ships with Logback 1.5.x and SLF4J 2.0.x. These versions are
bundled in the Docker image and the SLF4J 2.0.x API is shaded into the operator
JAR.
## FlinkDeployment Logging Configuration
diff --git a/docs/content/docs/operations/logging.md
b/docs/content/docs/operations/logging.md
index 7dc36b63..3a6cdfd5 100644
--- a/docs/content/docs/operations/logging.md
+++ b/docs/content/docs/operations/logging.md
@@ -115,11 +115,7 @@ Logback XML overrides replace the entire default
configuration. Unlike Log4j2 `.
## Logging Library Version Overrides
-The operator ships with Logback 1.2.x and SLF4J 1.7.x. These versions are
bundled in the Docker image and the SLF4J 1.7.x API is shaded into the operator
JAR.
-
-{{< hint warning >}}
-Upgrading to Logback 1.4+/1.5+ or SLF4J 2.x is not supported. SLF4J 2.x uses a
`ServiceLoader`-based binding mechanism that is incompatible with the SLF4J
1.7.x API shaded inside the operator. Replacing the JARs at runtime will result
in `ClassNotFoundException: org.slf4j.impl.StaticLoggerBinder`.
-{{< /hint >}}
+The operator ships with Logback 1.5.x and SLF4J 2.0.x. These versions are
bundled in the Docker image and the SLF4J 2.0.x API is shaded into the operator
JAR.
## FlinkDeployment Logging Configuration
diff --git a/e2e-tests/test_logback_logging.sh
b/e2e-tests/test_logback_logging.sh
index a557b26d..da57d8ca 100755
--- a/e2e-tests/test_logback_logging.sh
+++ b/e2e-tests/test_logback_logging.sh
@@ -42,10 +42,18 @@ operator_namespace=$(get_operator_pod_namespace)
operator_pod=$(get_operator_pod_name)
echo "Current operator pod is ${operator_pod} in namespace
${operator_namespace}"
-# Check that there are no SLF4J multiple-bindings warnings
-echo "Checking for SLF4J multiple bindings warnings..."
-if kubectl logs "${operator_pod}" -c flink-kubernetes-operator -n
"${operator_namespace}" | grep -q "SLF4J: Class path contains multiple SLF4J
bindings"; then
- echo "ERROR: Found SLF4J multiple bindings warning"
+# Check that there are no SLF4J provider problems. SLF4J 2.x reports
"providers"
+# where 1.7.x reported "bindings", so both wordings are matched. The
no-provider
+# case is checked too: SLF4J does not fail on a missing backend, it installs a
NOP
+# logger and silently discards every log line.
+echo "Checking for SLF4J provider warnings..."
+operator_logs=$(kubectl logs "${operator_pod}" -c flink-kubernetes-operator -n
"${operator_namespace}")
+if echo "${operator_logs}" | grep -qE "Class path contains multiple SLF4J
(providers|bindings)"; then
+ echo "ERROR: Found SLF4J multiple providers warning"
+ passed=false
+fi
+if echo "${operator_logs}" | grep -qE "No SLF4J providers were found|Failed to
load class \"org.slf4j.impl.StaticLoggerBinder\""; then
+ echo "ERROR: SLF4J found no provider and fell back to the NOP logger"
passed=false
fi
diff --git a/examples/autoscaling/pom.xml b/examples/autoscaling/pom.xml
index 6c552827..2772cf6b 100644
--- a/examples/autoscaling/pom.xml
+++ b/examples/autoscaling/pom.xml
@@ -64,7 +64,7 @@ under the License.
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
- <artifactId>log4j-slf4j-impl</artifactId>
+ <artifactId>log4j-slf4j2-impl</artifactId>
<version>${log4j.version}</version>
<scope>runtime</scope>
</dependency>
diff --git a/examples/flink-beam-example/pom.xml
b/examples/flink-beam-example/pom.xml
index af234187..92babdc7 100644
--- a/examples/flink-beam-example/pom.xml
+++ b/examples/flink-beam-example/pom.xml
@@ -95,7 +95,7 @@ under the License.
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
- <artifactId>log4j-slf4j-impl</artifactId>
+ <artifactId>log4j-slf4j2-impl</artifactId>
<version>${log4j.version}</version>
<scope>runtime</scope>
</dependency>
diff --git a/examples/flink-sql-runner-example/pom.xml
b/examples/flink-sql-runner-example/pom.xml
index 41c4a3e0..a141f5d8 100644
--- a/examples/flink-sql-runner-example/pom.xml
+++ b/examples/flink-sql-runner-example/pom.xml
@@ -66,7 +66,7 @@ under the License.
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
- <artifactId>log4j-slf4j-impl</artifactId>
+ <artifactId>log4j-slf4j2-impl</artifactId>
<version>${log4j.version}</version>
<scope>runtime</scope>
</dependency>
diff --git a/flink-autoscaler-plugin-jdbc/pom.xml
b/flink-autoscaler-plugin-jdbc/pom.xml
index 4bee527c..10709ef5 100644
--- a/flink-autoscaler-plugin-jdbc/pom.xml
+++ b/flink-autoscaler-plugin-jdbc/pom.xml
@@ -96,12 +96,25 @@ under the License.
<scope>test</scope>
</dependency>
+ <!-- The only SLF4J binding on the test classpath, since
flink-test-utils-junit
+ brings the SLF4J 1.7 binding which SLF4J 2.x ignores. -->
+ <dependency>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-slf4j2-impl</artifactId>
+ <version>${log4j.version}</version>
+ <scope>test</scope>
+ </dependency>
+
<dependency>
<groupId>org.apache.flink</groupId>
<artifactId>flink-test-utils-junit</artifactId>
<version>${flink.version}</version>
<scope>test</scope>
<exclusions>
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-slf4j-impl</artifactId>
+ </exclusion>
<exclusion>
<artifactId>slf4j-api</artifactId>
<groupId>org.slf4j</groupId>
diff --git a/flink-autoscaler-standalone/pom.xml
b/flink-autoscaler-standalone/pom.xml
index 3d3fbde5..d07d9e4f 100644
--- a/flink-autoscaler-standalone/pom.xml
+++ b/flink-autoscaler-standalone/pom.xml
@@ -116,7 +116,7 @@ under the License.
<dependency>
<groupId>org.apache.logging.log4j</groupId>
- <artifactId>log4j-slf4j-impl</artifactId>
+ <artifactId>log4j-slf4j2-impl</artifactId>
<version>${log4j.version}</version>
</dependency>
diff --git a/flink-autoscaler-standalone/src/main/resources/META-INF/NOTICE
b/flink-autoscaler-standalone/src/main/resources/META-INF/NOTICE
index 41f0ea55..1c6a67f0 100644
--- a/flink-autoscaler-standalone/src/main/resources/META-INF/NOTICE
+++ b/flink-autoscaler-standalone/src/main/resources/META-INF/NOTICE
@@ -20,7 +20,7 @@ This project bundles the following dependencies under the
Apache Software Licens
- org.apache.logging.log4j:log4j-1.2-api:jar:2.25.4
- org.apache.logging.log4j:log4j-api:jar:2.25.4
- org.apache.logging.log4j:log4j-core:jar:2.25.4
-- org.apache.logging.log4j:log4j-slf4j-impl:jar:2.25.4
+- org.apache.logging.log4j:log4j-slf4j2-impl:jar:2.25.4
- org.javassist:javassist:jar:3.24.0-GA
- org.jetbrains.kotlin:kotlin-stdlib-common:jar:1.9.10
- org.jetbrains.kotlin:kotlin-stdlib-jdk7:jar:1.8.21
@@ -29,7 +29,7 @@ This project bundles the following dependencies under the
Apache Software Licens
- org.jetbrains:annotations:jar:13.0
- org.objenesis:objenesis:jar:2.1
- org.quartz-scheduler:quartz:jar:2.4.0
-- org.slf4j:slf4j-api:jar:1.7.36
+- org.slf4j:slf4j-api:jar:2.0.18
- org.snakeyaml:snakeyaml-engine:jar:2.6
- tools.profiler:async-profiler:jar:2.9
diff --git a/flink-autoscaler/pom.xml b/flink-autoscaler/pom.xml
index 3e96f325..19e84f70 100644
--- a/flink-autoscaler/pom.xml
+++ b/flink-autoscaler/pom.xml
@@ -83,12 +83,25 @@ under the License.
<artifactId>guava</artifactId>
</dependency>
+ <!-- The only SLF4J binding on the test classpath, since
flink-test-utils-junit
+ brings the SLF4J 1.7 binding which SLF4J 2.x ignores. -->
+ <dependency>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-slf4j2-impl</artifactId>
+ <version>${log4j.version}</version>
+ <scope>test</scope>
+ </dependency>
+
<dependency>
<groupId>org.apache.flink</groupId>
<artifactId>flink-test-utils-junit</artifactId>
<version>${flink.version}</version>
<scope>test</scope>
<exclusions>
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-slf4j-impl</artifactId>
+ </exclusion>
<exclusion>
<groupId>org.junit.vintage</groupId>
<artifactId>junit-vintage-engine</artifactId>
diff --git a/flink-kubernetes-operator-api/pom.xml
b/flink-kubernetes-operator-api/pom.xml
index 823627dd..88bc728a 100644
--- a/flink-kubernetes-operator-api/pom.xml
+++ b/flink-kubernetes-operator-api/pom.xml
@@ -103,7 +103,7 @@ under the License.
<!-- Logging -->
<dependency>
<groupId>org.apache.logging.log4j</groupId>
- <artifactId>log4j-slf4j-impl</artifactId>
+ <artifactId>log4j-slf4j2-impl</artifactId>
<version>${log4j.version}</version>
</dependency>
diff --git a/flink-kubernetes-operator/pom.xml
b/flink-kubernetes-operator/pom.xml
index d1ef1322..76946306 100644
--- a/flink-kubernetes-operator/pom.xml
+++ b/flink-kubernetes-operator/pom.xml
@@ -123,8 +123,13 @@ under the License.
</dependency>
<!-- Logging: SLF4J API and Log4j2 implementation are shaded into the
operator JAR.
- Only the SLF4J bindings (log4j-slf4j-impl / logback-classic) are
excluded
- and shipped as separate JARs so the entrypoint can pick one. -->
+ Only the SLF4J bindings (log4j-slf4j2-impl / logback-classic +
logback-core)
+ are excluded and shipped as separate JARs so the entrypoint can
pick one.
+ SLF4J 2.x is required: JOSDK and the fabric8 client are compiled
against it.
+
+ The binding artifacts are declared provided purely so their
versions are
+ resolved and recorded here; the maven-dependency-plugin below
stages them
+ into the image from its own artifactItems, independently of this
graph. -->
<dependency>
<groupId>org.slf4j</groupId>
@@ -134,7 +139,7 @@ under the License.
<dependency>
<groupId>org.apache.logging.log4j</groupId>
- <artifactId>log4j-slf4j-impl</artifactId>
+ <artifactId>log4j-slf4j2-impl</artifactId>
<version>${log4j.version}</version>
<scope>provided</scope>
</dependency>
@@ -212,6 +217,13 @@ under the License.
<artifactId>flink-test-utils</artifactId>
<version>${flink.version}</version>
<scope>test</scope>
+ <exclusions>
+ <!-- SLF4J 1.7 binding; the module already provides
log4j-slf4j2-impl. -->
+ <exclusion>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-slf4j-impl</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<dependency>
@@ -318,7 +330,7 @@ under the License.
<!-- Log4j2 SLF4J binding (default logging framework)
-->
<artifactItem>
<groupId>org.apache.logging.log4j</groupId>
- <artifactId>log4j-slf4j-impl</artifactId>
+ <artifactId>log4j-slf4j2-impl</artifactId>
<version>${log4j.version}</version>
<outputDirectory>${project.build.directory}/log4j</outputDirectory>
</artifactItem>
diff --git a/flink-kubernetes-operator/src/main/resources/META-INF/NOTICE
b/flink-kubernetes-operator/src/main/resources/META-INF/NOTICE
index e0bb053f..50efa3ae 100644
--- a/flink-kubernetes-operator/src/main/resources/META-INF/NOTICE
+++ b/flink-kubernetes-operator/src/main/resources/META-INF/NOTICE
@@ -63,7 +63,6 @@ This project bundles the following dependencies under the
Apache Software Licens
- org.apache.logging.log4j:log4j-1.2-api:jar:2.25.4
- org.apache.logging.log4j:log4j-api:jar:2.25.4
- org.apache.logging.log4j:log4j-core:jar:2.25.4
-- org.apache.logging.log4j:log4j-slf4j-impl:jar:2.25.4
- org.checkerframework:checker-qual:jar:3.43.0
- org.javassist:javassist:jar:3.24.0-GA
- org.jetbrains.kotlin:kotlin-stdlib-common:jar:1.8.21
@@ -73,7 +72,7 @@ This project bundles the following dependencies under the
Apache Software Licens
- org.jetbrains:annotations:jar:13.0
- org.objenesis:objenesis:jar:2.1
- org.quartz-scheduler:quartz:jar:2.4.0
-- org.slf4j:slf4j-api:jar:1.7.36
+- org.slf4j:slf4j-api:jar:2.0.18
- org.snakeyaml:snakeyaml-engine:jar:2.6
- org.xerial.snappy:snappy-java:jar:1.1.10.4
- org.yaml:snakeyaml:jar:2.5
diff --git a/flink-kubernetes-standalone/pom.xml
b/flink-kubernetes-standalone/pom.xml
index 7c41c57c..65104324 100644
--- a/flink-kubernetes-standalone/pom.xml
+++ b/flink-kubernetes-standalone/pom.xml
@@ -99,7 +99,7 @@ under the License.
<dependency>
<groupId>org.apache.logging.log4j</groupId>
- <artifactId>log4j-slf4j-impl</artifactId>
+ <artifactId>log4j-slf4j2-impl</artifactId>
<version>${log4j.version}</version>
<scope>test</scope>
</dependency>
diff --git a/pom.xml b/pom.xml
index 5e854e03..8da0c1c6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -85,9 +85,9 @@ under the License.
<flink.version>1.20.4</flink.version>
<guava.version>33.4.0-jre</guava.version>
- <slf4j.version>1.7.36</slf4j.version>
+ <slf4j.version>2.0.18</slf4j.version>
<log4j.version>2.25.4</log4j.version>
- <logback.version>1.2.13</logback.version>
+ <logback.version>1.5.34</logback.version>
<spotless.version>2.40.0</spotless.version>
<it.skip>true</it.skip>
@@ -120,6 +120,15 @@ under the License.
<dependencyManagement>
<dependencies>
+ <!-- Pinned so that modules which pick up slf4j-api transitively
from Flink
+ (1.7.36) still get the 2.x API that the log4j-slf4j2-impl and
logback
+ bindings require. A mismatch is silent: SLF4J falls back to a
NOP
+ logger and discards all output. -->
+ <dependency>
+ <groupId>org.slf4j</groupId>
+ <artifactId>slf4j-api</artifactId>
+ <version>${slf4j.version}</version>
+ </dependency>
<dependency>
<groupId>com.fasterxml.jackson</groupId>
<artifactId>jackson-bom</artifactId>
