// What runs on ZooKeeper / flink
Does Apache Flink use ZooKeeper?
One of two HA optionsOnly for high availability. Flink's HA services come in two implementations: ZooKeeper, which works with every deployment, and Kubernetes, which works only on Kubernetes. Flink 1.12 added the Kubernetes option, and the project said at the time that the ZooKeeper dependency would not be dropped. Both are still documented in Flink 2.3. Every Flink release also bundles a ZooKeeper client, and since 1.17 that client comes from the end-of-life 3.7 line.
Trusted globally by enterprises
What Apache Flink uses ZooKeeper for
- JobManager leader election: one JobManager leads, and standbys take over when it fails.
- Service discovery: other components look up the current leader's address in ZooKeeper.
- Pointers to recovery metadata (job graphs and completed checkpoints). The metadata itself goes to high-availability.storageDir, and only the pointer is kept in ZooKeeper.
- The checkpoint ID counter used by HA clusters.
Which ZooKeeper version ships with Apache Flink
From the zookeeper.version property in Flink's root pom.xml at each release tag. Up to 1.16 the client is a separate flink-shaded-zookeeper jar in lib/, with an alternative version in opt/. From 1.17 a single shaded client is built into the flink-dist jar (FLINK-30237), so scanners may report it as flink-shaded-zookeeper or inside flink-dist rather than as a zookeeper jar. Flink's bin/start-zookeeper-quorum.sh starts ZooKeeper servers from that same bundled code, so an ensemble started that way runs the version in this table.
| Release | ZooKeeper | ZooKeeper line status | Open ZooKeeper CVEs |
|---|---|---|---|
| Flink 1.11.6 to 1.14.6A 3.5 client (3.5.6, or 3.5.9 in 1.14) ships in opt/ | 3.4.14 | End of life since 1 June 2020Bundles log4j 1.2.17 | 1 (CVE-2023-44981)2026 advisories not assessed for this line |
| Flink 1.15.4 and 1.16.31.15 dropped ZooKeeper 3.4 support; a 3.6.3 client ships in opt/ | 3.5.9 | End of life since 1 June 2022Bundles log4j 1.2.17 | 1 (CVE-2023-44981)2026 advisories not assessed for this line |
| Flink 1.17.2 to 1.20.51.20 is the 1.x long-term support line | 3.7.1 | End of life since 2 February 2024 | 2 (CVE-2023-44981, CVE-2024-23944)2026 advisories not assessed for this line |
| Flink 2.0.2 to 2.3.0 | 3.7.2 | End of life since 2 February 2024 | 1 (CVE-2024-23944)2026 advisories not assessed for this line |
CVE counts are ZooKeeper's own advisories matched against the upstream version. The Apache ZooKeeper project does not assess end-of-life lines against new advisories, so "not assessed" means unknown, not safe.
What ZooKeeper 3.4.14 is exposed to
CVE-2023-44981 · CVSS 9.1 · fixed in 3.7.2, 3.8.3, 3.9.1
SASL quorum peer authentication bypass, giving full read-write access to the data tree. Applies when quorum.auth.enableSasl=true.
Which HA service and ZooKeeper client is Flink using?
# HA type and quorum (flink-conf.yaml up to 1.20, config.yaml from 1.19) grep -nE 'high-availability|zookeeper' conf/flink-conf.yaml conf/config.yaml 2>/dev/null # Flink 1.16 and older: the client is a separate jar ls lib/ opt/ | grep -i zookeeper # Flink 1.17 and newer: the client is shaded inside flink-dist unzip -l lib/flink-dist*.jar | grep -m1 'shaded/zookeeper3'
Can Apache Flink run without ZooKeeper?
Yes, in two cases. A cluster without high availability needs no ZooKeeper at all. A cluster on Kubernetes can use the Kubernetes HA services (high-availability.type: kubernetes), which keep leader information in ConfigMaps. On YARN and standalone deployments outside Kubernetes, high availability requires ZooKeeper.
Flink 2.3.0 is the latest stable release, and the downloads page marks 1.20 as the long-term support release of the 1.x line. The community fixes bugs in the current and previous minor releases only, so 1.19 and earlier 1.x lines receive nothing further.
Your options
Switch HA to Kubernetes
Where Flink already runs on Kubernetes, Kubernetes HA removes the ZooKeeper ensemble without an application change. The bundled 3.7 client stays inside flink-dist, so scanners still see it.
Upgrade Flink
Moving to 1.20 LTS or 2.x brings Flink itself back under community fixes, but not the ZooKeeper client: 1.20 still builds against 3.7.1, and 2.3.0 against 3.7.2.
Patch the ZooKeeper path
Where Flink runs on YARN or bare metal, ZooKeeper HA stays. OSSeva patches the ensemble and ships a patched flink-shaded-zookeeper, so the client inside Flink is covered too.
Most teams buy this at the product level: keep the Apache Flink estate supported, including the ZooKeeper under it. See Flink extended support.
Frequently asked questions
Does Flink need ZooKeeper?
Only for high availability outside Kubernetes. A Flink cluster without HA does not use it, and on Kubernetes the Kubernetes HA services replace it. On YARN and standalone clusters, HA requires a ZooKeeper quorum.
Which ZooKeeper does Flink 1.20 use?
Flink 1.17 through 1.20.5 build against ZooKeeper 3.7.1. The 3.7 line reached end of life on 2 February 2024, and 3.7.1 is within the affected range of CVE-2023-44981 and CVE-2024-23944.
Does upgrading to Flink 2.x remove the end-of-life ZooKeeper?
No. Flink 2.0.2 through 2.3.0 build against ZooKeeper 3.7.2, still on the 3.7 line. 3.7.2 fixes CVE-2023-44981 but not CVE-2024-23944, which was fixed only in 3.8.4 and 3.9.2.
Why does a scan flag ZooKeeper 3.7 when our ensemble runs 3.8?
Because the scanner is reading the client bundled inside Flink, not the ensemble. Flink ships its own shaded ZooKeeper client whatever server version it connects to.
Can I use Flink's start-zookeeper-quorum.sh in production?
The Flink documentation recommends managing your own ZooKeeper installation in production. The script starts servers from the ZooKeeper code bundled in Flink, so the ensemble runs the bundled version.
Keep Apache Flink and the ZooKeeper under it supported.
Send us your versions; we reply with coverage, exposure and a plan within five working days.