sheinbergon opened a new pull request, #29547: URL: https://github.com/apache/flink/pull/29547
## What is the purpose of the change Since JDK 24 the Java Security Manager is permanently disabled ([JEP 486](https://openjdk.org/jeps/486)): `System#setSecurityManager` always throws `UnsupportedOperationException`, even when passed `null`. `FlinkSecurityManager#forceProcessExit` called it unconditionally, so on JDK 24+ the fatal-error paths (`FatalExitExceptionHandler`, `ClusterEntrypoint#onFatalError`, `TaskManagerRunner#terminateJVM`) threw instead of terminating the JVM and left the process running. This is also why `ClusterUncaughtExceptionHandlerITCase` had to be tagged `FailsOnJava25`. This PR makes the exit helpers independent of an installed Security Manager and reports a clear error when the Security Manager based options are enabled on a JVM that cannot install one. Behaviour on JDK 11-23 is unchanged. Full removal of `FlinkSecurityManager` and `cluster.intercept-user-system-exit` (as attempted in #26491) is intentionally out of scope and needs a dev-list discussion first. ## Brief change log - `FlinkSecurityManager#forceProcessExit` / `#checkExit` only unset the Security Manager when one is actually installed, which can never be the case on JDK 24+. - Enabling `cluster.intercept-user-system-exit` or `cluster.processes.halt-on-fatal-error` without Security Manager support (JDK 24+, or JDK 18-23 without `-Djava.security.manager=allow`) fails with a message naming JEP 486 and the options to disable, instead of a misleading "no permission" error. - `ExecutorThreadFactory` no longer consults `System#getSecurityManager` for the thread group (the lookup was a no-op). - Option descriptions document the JDK 24+ limitation; configuration docs regenerated. - `ClusterUncaughtExceptionHandlerITCase` untagged from `FailsOnJava25`; `TestJvmProcess` gained a `getJvmArgs()` hook. ## Verifying this change This change added tests and can be verified as follows: - `FlinkSecurityManagerITCase#testForcedJVMExitWithoutSecurityManager`: a child JVM calls `forceProcessExit` without any Security Manager configured and must exit with the requested code. Fails on JDK 25 without the fix (`UnsupportedOperationException: Setting a Security Manager is not supported`). - `FlinkSecurityManagerITCase#testUnavailableSecurityManagerIsReported`: a child JVM started with `-Djava.security.manager=disallow` must fail with the descriptive `IllegalConfigurationException`. Runs on JDK 12+. - `ClusterUncaughtExceptionHandlerITCase` passes on JDK 25 again (hung before the fix). - Existing `FlinkSecurityManagerTest` and the `FailsOnJava25`-tagged tests are unchanged and pass on JDK 21. Verified locally on JDK 21 and JDK 25 (Zulu). ## Does this pull request potentially affect one of the following parts: - Dependencies (does it add or upgrade a dependency): no - The public API, i.e., is any changed class annotated with `@Public(Evolving)`: no - The serializers: no - The runtime per-record code paths (performance sensitive): no - Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: yes - JobManager/TaskManager fatal-error exit on JDK 24+ now terminates the process as intended - The S3 file system connector: no ## Documentation - Does this pull request introduce a new feature? no - If yes, how is the feature documented? not applicable (option descriptions updated for the JDK 24+ limitation) --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: Claude Code (Claude Fable 5.1) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
