<p>I have apache flink deployed to AWS EKS (1.21) with version 1.17-SNAPSHOT and state storage in AWS S3. This setup works great.</p>
<p>I am now trying to deploy the same version to Azure AKS (1.22 - minimum available version for AKS) and store the state in Azure Blob.</p>
<p>In both cases I use the <a href="https://github.com/apache/flink-kubernetes-operator" rel="nofollow noreferrer">apache flink kubernetes operator</a>, version 1.3.1.</p>
<p>If I disable checkpoints and savepoints my application works great.</p>
<p>Once enabled, I get the following error at job manager startup:</p>
<pre><code>Caused by: java.lang.ClassNotFoundException: Class org.apache.hadoop.security.JniBasedUnixGroupsMappingWithFallback not found
at org.apache.flink.fs.shaded.hadoop3.org.apache.hadoop.conf.Configuration.getClassByName(Configuration.java:2592) ~[?:?]
at org.apache.flink.fs.shaded.hadoop3.org.apache.hadoop.conf.Configuration.getClass(Configuration.java:2686) ~[?:?]
at org.apache.flink.fs.shaded.hadoop3.org.apache.hadoop.conf.Configuration.getClass(Configuration.java:2712) ~[?:?]
at org.apache.flink.fs.shaded.hadoop3.org.apache.hadoop.security.Groups.&lt;init&gt;(Groups.java:107) ~[?:?]
at org.apache.flink.fs.shaded.hadoop3.org.apache.hadoop.security.Groups.&lt;init&gt;(Groups.java:102) ~[?:?]
at org.apache.flink.fs.shaded.hadoop3.org.apache.hadoop.security.Groups.getUserToGroupsMappingService(Groups.java:451) ~[?:?]
at org.apache.flink.fs.shaded.hadoop3.org.apache.hadoop.security.UserGroupInformation.initialize(UserGroupInformation.java:338) ~[?:?]
at org.apache.flink.fs.shaded.hadoop3.org.apache.hadoop.security.UserGroupInformation.ensureInitialized(UserGroupInformation.java:300) ~[?:?]
at org.apache.flink.fs.shaded.hadoop3.org.apache.hadoop.security.UserGroupInformation.getCurrentUser(UserGroupInformation.java:575) ~[?:?]
at org.apache.flink.fs.shaded.hadoop3.org.apache.hadoop.fs.azure.NativeAzureFileSystem.initialize(NativeAzureFileSystem.java:1425) ~[?:?]
at org.apache.flink.fs.azurefs.AbstractAzureFSFactory.create(AbstractAzureFSFactory.java:78) ~[?:?]
at org.apache.flink.core.fs.PluginFileSystemFactory.create(PluginFileSystemFactory.java:62) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.core.fs.FileSystem.getUnguardedFileSystem(FileSystem.java:508) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.core.fs.FileSystem.get(FileSystem.java:409) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.core.fs.Path.getFileSystem(Path.java:274) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.state.filesystem.FsCheckpointStorageAccess.&lt;init&gt;(FsCheckpointStorageAccess.java:67) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.state.storage.FileSystemCheckpointStorage.createCheckpointStorage(FileSystemCheckpointStorage.java:324) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.checkpoint.CheckpointCoordinator.&lt;init&gt;(CheckpointCoordinator.java:333) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.checkpoint.CheckpointCoordinator.&lt;init&gt;(CheckpointCoordinator.java:248) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.executiongraph.DefaultExecutionGraph.enableCheckpointing(DefaultExecutionGraph.java:524) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.executiongraph.DefaultExecutionGraphBuilder.buildGraph(DefaultExecutionGraphBuilder.java:321) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.scheduler.DefaultExecutionGraphFactory.createAndRestoreExecutionGraph(DefaultExecutionGraphFactory.java:163) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.scheduler.SchedulerBase.createAndRestoreExecutionGraph(SchedulerBase.java:365) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.scheduler.SchedulerBase.&lt;init&gt;(SchedulerBase.java:210) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.scheduler.DefaultScheduler.&lt;init&gt;(DefaultScheduler.java:136) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.scheduler.DefaultSchedulerFactory.createInstance(DefaultSchedulerFactory.java:152) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.jobmaster.DefaultSlotPoolServiceSchedulerFactory.createScheduler(DefaultSlotPoolServiceSchedulerFactory.java:119) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.jobmaster.JobMaster.createScheduler(JobMaster.java:371) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.jobmaster.JobMaster.&lt;init&gt;(JobMaster.java:348) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.jobmaster.factories.DefaultJobMasterServiceFactory.internalCreateJobMasterService(DefaultJobMasterServiceFactory.java:123) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.runtime.jobmaster.factories.DefaultJobMasterServiceFactory.lambda$createJobMasterService$0(DefaultJobMasterServiceFactory.java:95) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at org.apache.flink.util.function.FunctionUtils.lambda$uncheckedSupplier$4(FunctionUtils.java:112) ~[flink-dist-1.17-SNAPSHOT.jar:1.17-SNAPSHOT]
at java.util.concurrent.CompletableFuture$AsyncSupply.run(Unknown Source) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) ~[?:?]
at java.lang.Thread.run(Unknown Source) ~[?:?]
</code></pre>
<p>I followed this guide: <a href="https://nightlies.apache.org/flink/flink-docs-release-1.16/docs/deployment/filesystems/azure/" rel="nofollow noreferrer">https://nightlies.apache.org/flink/flink-docs-release-1.16/docs/deployment/filesystems/azure/</a> , the <code>azure-fs-hadoop</code> is properly configured.</p>
<p>I tried settings <code>hadoop.flink.flink.hadoop.hadoop.security.group.mapping: org.apache.flink.fs.shaded.hadoop3.org.apache.hadoop.security.JniBasedUnixGroupsMappingWithFallback</code> in flink_conf.yaml</p>
<p>The checkpoint and savepoint configuration:</p>
<pre><code>state.checkpoints.dir: wasb://checkpoints@&lt;account&gt;.blob.core.windows.net/&lt;cp_path&gt;
state.savepoints.dir: wasb://checkpoints@&lt;account&gt;.blob.core.windows.net/&lt;sp_path&gt;
</code></pre>
<p>If I try to set the properties this way, I get messages about anonymous access:</p>
<pre><code>state.checkpoints.dir: wasb://checkpoints@$&lt;account&gt;.blob.core.windows.net/&lt;cp_path&gt;
state.savepoints.dir: wasb://checkpoints@$&lt;account&gt;.blob.core.windows.net/&lt;sp_path&gt;
</code></pre>
<p>Message:</p>
<pre><code>The account access key is not configured for wasb://checkpoints@$&lt;account&gt;.blob.core.windows.net/&lt;cp_path&gt;. Now try anonymous access.
</code></pre>
<p>any suggestions will be appreciated.</p>

<p>This issue should be fixed in flink 1.17.1 or higher: <a href="https://issues.apache.org/jira/browse/FLINK-31612" rel="nofollow noreferrer">https://issues.apache.org/jira/browse/FLINK-31612</a></p>
