This is an automated email from the ASF dual-hosted git repository.
MartijnVisser pushed a commit to branch release-1.20
in repository https://gitbox.apache.org/repos/asf/flink.git
The following commit(s) were added to refs/heads/release-1.20 by this push:
new 16d07d0247e [FLINK-40661][e2e] Build the test KDC image from
debian:bookworm
16d07d0247e is described below
commit 16d07d0247e39eb344efcfa47ccd8ea8c312ecb5
Author: Martijn Visser <[email protected]>
AuthorDate: Tue Sep 15 10:07:06 2026 +0200
[FLINK-40661][e2e] Build the test KDC image from debian:bookworm
Debian 11 (bullseye) is oldoldstable and its security pool has been
emptied: the bullseye-security package index still advertises
krb5 1.18.3-6+deb11u8, but the .deb itself is a 404 on deb.debian.org and
is not served under the same path on archive.debian.org. Building the KDC
image therefore fails in "apt-get install locales krb5-kdc
krb5-admin-server", and with it the Kerberized and PyFlink YARN Docker
e2e tests, which have not been able to build their cluster since
2026-09-05. release-1.20 is the only branch that still runs them.
Move one Debian major version, to bookworm (12), rather than to the
current stable trixie (13), to keep the jump as small as possible:
krb5 goes 1.18.3 to 1.20.1 and glibc 2.31 to 2.36. bookworm is oldstable
and still served, so this will need revisiting, but the image installs
only locales, krb5-kdc and krb5-admin-server and the entrypoint uses
kdb5_util, kadmin.local, krb5kdc and kadmind, all unchanged across both.
The Hadoop containers are built from eclipse-temurin:8-jdk-jammy and so
run a krb5 1.19.2 client against this KDC; that client still gets a TGT,
and a JDK 8 Krb5LoginModule keytab login does too.
Generated-by: Claude Code (Claude Opus 5)
---
.../test-scripts/docker-hadoop-secure-cluster/kdc/Dockerfile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git
a/flink-end-to-end-tests/test-scripts/docker-hadoop-secure-cluster/kdc/Dockerfile
b/flink-end-to-end-tests/test-scripts/docker-hadoop-secure-cluster/kdc/Dockerfile
index e052a3f6bd2..82a5c66fb1e 100644
---
a/flink-end-to-end-tests/test-scripts/docker-hadoop-secure-cluster/kdc/Dockerfile
+++
b/flink-end-to-end-tests/test-scripts/docker-hadoop-secure-cluster/kdc/Dockerfile
@@ -16,7 +16,7 @@
# limitations under the License.
################################################################################
-FROM debian:bullseye
+FROM debian:bookworm
ENV DEBIAN_FRONTEND noninteractive
# The -qq implies --yes
