[Bug] FlinkClient#submit fails with UnsupportedOperationException on JDK 18+ (Security Manager) #4482

Search before asking

• I had searched in the issues and found no similar issues referencing SecurityManager, ExitSecurityManager, or FlinkClient#submit.

Java Version

Temurin 21.0.11

Scala Version

2.12.x

StreamPark Version

3.0.0-SNAPSHOT (dev branch, commit f89652b67)

Flink Version

2.2.1 (official binary distribution, standalone/remote cluster)

Deploy mode

remote

What happened

Starting any Flink application (POST /flink/app/start) is accepted (HTTP 200), but the application flips to FAILED a few seconds later with no visible error anywhere in logs/error.*.log or logs/streampark.out — the failure is only visible via POST /flink/app/opt_log (t_flink_app_log, the operation-log table), which the REST API and UI do surface, but it's easy to miss since nothing is printed to the process's own logs.

Root cause: FlinkClient#submit() installs a custom ExitSecurityManager via System.setSecurityManager(...) before invoking the Flink CLI in-process, purely to intercept System.exit() calls the CLI makes on completion (turning them into a catchable SecurityException instead of killing the whole console JVM).

JEP 411 deprecated the Security Manager in Java 17, and starting Java 18, System.setSecurityManager() throws UnsupportedOperationException unless the java.security.manager system property is explicitly set to allow (or a manager class name) at JVM startup — it can no longer be enabled dynamically without that flag. The console's own startup scripts don't set this flag, so on any JDK 18+ (this environment: JDK 21) every start attempt fails immediately.

Error Exception

java.util.concurrent.CompletionException: java.lang.UnsupportedOperationException: The Security Manager is deprecated and will be removed in a future release
	at java.base/java.util.concurrent.CompletableFuture.encodeThrowable(CompletableFuture.java:315)
	at java.base/java.util.concurrent.CompletableFuture.completeThrowable(CompletableFuture.java:320)
	at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1770)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
	at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: java.lang.UnsupportedOperationException: The Security Manager is deprecated and will be removed in a future release
	at java.base/java.lang.System.setSecurityManager(System.java:431)
	at org.apache.streampark.flink.client.FlinkClient.submit(FlinkClient.java:63)
	at org.apache.streampark.console.core.service.application.impl.FlinkApplicationActionServiceImpl.lambda$start$2(FlinkApplicationActionServiceImpl.java:486)
	at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1768)
	... 3 more

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct