[
https://issues.apache.org/jira/browse/FLINK-40088?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18137947#comment-18137947
]
Rui Fan edited comment on FLINK-40088 at 11/4/26, 11:33 AM:
------------------------------------------------------------
Fixed:
- 1.20.6: 3394eda2e7aad054c0efe0a9285b8d6b58437343
- 2.2.2: d93c8dd1a138b1ba8c0666ad5ca47e70bc881714
- 2.3.1: 22d775e72bc71e4689f95d50949894fc419d65d8
was (Author: fanrui):
Fixed:
- 1.20.6: 3394eda2e7aad054c0efe0a9285b8d6b58437343
- 2.2.2: d93c8dd1a138b1ba8c0666ad5ca47e70bc881714
> RestClientITCase.testHttpsConnectionWithDefaultCerts is flaky due to GitHub
> rate limiting (HTTP 429)
> ----------------------------------------------------------------------------------------------------
>
> Key: FLINK-40088
> URL: https://issues.apache.org/jira/browse/FLINK-40088
> Project: Flink
> Issue Type: Bug
> Components: Runtime / REST
> Reporter: Martijn Visser
> Assignee: Martijn Visser
> Priority: Major
> Labels: pull-request-available
> Fix For: 2.2.2, 1.20.6, 2.4.0
>
>
> RestClientITCase#testHttpsConnectionWithDefaultCerts
> (flink-end-to-end-tests-restclient) verifies that RestClient completes a TLS
> handshake against a public CA-signed endpoint using the default JDK
> truststore. It does so by fetching a JSON file from raw.githubusercontent.com
> and requiring the response to be valid JSON.
> On GitHub Actions the runners share egress IPs, so GitHub periodically
> returns "429 Too Many Requests" as a plain-text body. RestClient then fails
> with:
> {code:java}
> org.apache.flink.runtime.rest.util.RestClientException: Response was not
> valid JSON, but plain-text: 429: Too Many Requests
> at
> org.apache.flink.runtime.rest.RestClientITCase.testHttpsConnectionWithDefaultCerts(RestClientITCase.java:61)
> {code}
> even though the TLS handshake - the thing under test - succeeded. Example:
> master run [https://github.com/apache/flink/actions/runs/28791132983]
> (2026-07-06, commit 9661ab549b, leg "Default (Java 17) / E2E (group 4)").
> A 429 (or any HTTP error response) is produced in RestClient#readRawResponse
> only after a full HTTP response has been received, i.e. after a successful
> handshake. A genuine certificate/trust failure instead surfaces as an
> SSLException from Netty's SslHandler and never produces a
> RestClientException. The two cases are cleanly distinguishable.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
