The behavior since
FLINK-3929 has been to fail if Hadoop security is enabled but a Kerberos credential (or delegation token) isn't available. It should proceed with a warning that a credential isn't available.
For example, say your shell has a HADOOP_CONF_DIR variable that points to a secure Hadoop installation. Say you'd like to use Flink for a completely unrelated reason (not involving Hadoop). The Flink CLI will fail at startup with a message to the effect that a kerberos ticket is needed. A ticket should not be needed in this scenario.