Martijn Visser created FLINK-40661:
--------------------------------------
Summary: Kerberized and PyFlink YARN Docker e2e tests fail on
release-1.20 because the KDC image is built from debian:bullseye
Key: FLINK-40661
URL: https://issues.apache.org/jira/browse/FLINK-40661
Project: Flink
Issue Type: Bug
Affects Versions: 1.20.5
Reporter: Martijn Visser
{{flink-end-to-end-tests/test-scripts/docker-hadoop-secure-cluster/kdc/Dockerfile}}
is {{FROM debian:bullseye}} and has not changed since 2022. Debian 11 security
is being wound down, so the {{kdc}} target no longer builds and {{build_image}}
gives up after five retries with {{{}ERROR: Could not build hadoop image.
Aborting...{}}}.
Until 2026-09-12 it failed at {{{}apt-get -qq update{}}}:
{code:java}
#14 2.106 E: Release file for
http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is
expired (invalid since 3d 6h 26min 11s). Updates for this repository will not
be applied.
#14 ERROR: process "/bin/sh -c apt-get -qq update" did not complete
successfully: exit code: 100
{code}
Debian republished the Release file on 2026-09-12, so since 2026-09-13 it fails
one line later at {{{}apt-get -qq install{}}}:
{code:java}
0.915 E: Failed to fetch
http://deb.debian.org/debian-security/pool/updates/main/k/krb5/krb5-user_1.18.3-6%2bdeb11u8_amd64.deb
404 Not Found
0.915 E: Failed to fetch
http://deb.debian.org/debian-security/pool/updates/main/i/icu/libicu67_67.1-7%2bdeb11u1_amd64.deb
404 Not Found
0.915 E: Unable to fetch some archives, maybe run apt-get update or try with
--fix-missing?
target kdc: failed to solve: process "/bin/sh -c apt-get -qq install locales
krb5-kdc krb5-admin-server" did not complete successfully: exit code: 100
{code}
The current {{bullseye-security}} package index still advertises {{{}krb5-user
1.18.3-6+deb11u8{}}}, but that file is a 404 on {{deb.debian.org}} and is not
served under the same path on {{archive.debian.org}} either, so the index and
the pool disagree.
It takes down {{Running Kerberized YARN per-job on Docker test (default
input)}} in e2e group 1 and {{PyFlink YARN per-job on Docker test}} in e2e
group 2. Only release-1.20 runs them, on master, release-2.2 and release-2.3
those {{run_test}} lines are commented out. Within release-1.20 they are
guarded by {{{}[[ ${PROFILE} != *"jdk11"* ]]{}}}, so the jdk11 profile is green
and the other five fail; on the 2026-09-15 nightly 8 of the 12 e2e legs are red.
Last green {{e2e_1_ci}} is build 78687 (2026-09-04), first red is 78750
(2026-09-05), and every release-1.20 nightly and push run since has failed the
same way.
[https://github.com/apache/flink/actions/runs/34919682822]
[https://dev.azure.com/apache-flink/apache-flink/_build/results?buildId=79075]
[https://dev.azure.com/apache-flink/apache-flink/_build/results?buildId=78750]
[https://dev.azure.com/apache-flink/apache-flink/_build/results?buildId=78687]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
