[
https://issues.apache.org/jira/browse/FLINK-40661?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Martijn Visser resolved FLINK-40661.
------------------------------------
Resolution: Fixed
Fixed in apache/flink:release-1.20 16d07d0247e39eb344efcfa47ccd8ea8c312ecb5
> Kerberized and PyFlink YARN Docker e2e tests fail on release-1.20 because the
> KDC image is built from debian:bullseye
> ---------------------------------------------------------------------------------------------------------------------
>
> Key: FLINK-40661
> URL: https://issues.apache.org/jira/browse/FLINK-40661
> Project: Flink
> Issue Type: Bug
> Affects Versions: 1.20.5
> Reporter: Martijn Visser
> Assignee: Martijn Visser
> Priority: Blocker
> Labels: pull-request-available, test-stability
> Fix For: 1.20.6
>
>
> {{flink-end-to-end-tests/test-scripts/docker-hadoop-secure-cluster/kdc/Dockerfile}}
> is {{FROM debian:bullseye}} and has not changed since 2022. Debian 11
> security is being wound down, so the {{kdc}} target no longer builds and
> {{build_image}} gives up after five retries with {{{}ERROR: Could not build
> hadoop image. Aborting...{}}}.
> Until 2026-09-12 it failed at {{{}apt-get -qq update{}}}:
> {code:java}
> #14 2.106 E: Release file for
> http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is
> expired (invalid since 3d 6h 26min 11s). Updates for this repository will not
> be applied.
> #14 ERROR: process "/bin/sh -c apt-get -qq update" did not complete
> successfully: exit code: 100
> {code}
> Debian republished the Release file on 2026-09-12, so since 2026-09-13 it
> fails one line later at {{{}apt-get -qq install{}}}:
> {code:java}
> 0.915 E: Failed to fetch
> http://deb.debian.org/debian-security/pool/updates/main/k/krb5/krb5-user_1.18.3-6%2bdeb11u8_amd64.deb
> 404 Not Found
> 0.915 E: Failed to fetch
> http://deb.debian.org/debian-security/pool/updates/main/i/icu/libicu67_67.1-7%2bdeb11u1_amd64.deb
> 404 Not Found
> 0.915 E: Unable to fetch some archives, maybe run apt-get update or try with
> --fix-missing?
> target kdc: failed to solve: process "/bin/sh -c apt-get -qq install locales
> krb5-kdc krb5-admin-server" did not complete successfully: exit code: 100
> {code}
> The current {{bullseye-security}} package index still advertises
> {{{}krb5-user 1.18.3-6+deb11u8{}}}, but that file is a 404 on
> {{deb.debian.org}} and is not served under the same path on
> {{archive.debian.org}} either, so the index and the pool disagree.
> It takes down {{Running Kerberized YARN per-job on Docker test (default
> input)}} in e2e group 1 and {{PyFlink YARN per-job on Docker test}} in e2e
> group 2. Only release-1.20 runs them, on master, release-2.2 and release-2.3
> those {{run_test}} lines are commented out. Within release-1.20 they are
> guarded by {{{}[[ ${PROFILE} != *"jdk11"* ]]{}}}, so the jdk11 profile is
> green and the other five fail; on the 2026-09-15 nightly 8 of the 12 e2e legs
> are red.
> Last green {{e2e_1_ci}} is build 78687 (2026-09-04), first red is 78750
> (2026-09-05), and every release-1.20 nightly and push run since has failed
> the same way.
> [https://github.com/apache/flink/actions/runs/34919682822]
> [https://dev.azure.com/apache-flink/apache-flink/_build/results?buildId=79075]
> [https://dev.azure.com/apache-flink/apache-flink/_build/results?buildId=78750]
> [https://dev.azure.com/apache-flink/apache-flink/_build/results?buildId=78687]
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
