JDK patch upgrade campaign (April 2024)

[dduportal]

Service(s)

cert.ci.jenkins.io, ci.jenkins.io, infra.ci.jenkins.io, release.ci.jenkins.io, trusted.ci.jenkins.io, weekly.ci.jenkins.io

Summary

As per https://www.java.com/releases/, all JDKs we are using (8, 11, 17 and 21) received a patch upgrade the 16 April 2024.
This issue tracks the steps required to upgrade all JDKs across the platform for our developers.

The scope is for JDK tools, Jenkins agent JDKs and Jenkins controllers JDKs. Note that we accept a patch-difference between controller and agent JDks.

New JDK versions:

• 21.0.3, Available on adoptium: https://github.com/adoptium/temurin21-binaries/releases/tag/jdk-21.0.3%2B9
• 17.0.11, Available on adoptium: https://github.com/adoptium/temurin17-binaries/releases/tag/jdk-17.0.11%2B9
• 11.0.23, Available on adoptium: https://github.com/adoptium/temurin11-binaries/releases/tag/jdk-11.0.23%2B9
• 8u412, Available on adoptium: https://github.com/adoptium/temurin8-binaries/releases/tag/jdk8u412-b08

Elements to be updated:

• Jenkins controller images:
  • Weekly 2.455 (23 April 2024) use the new JDKs 21.0.3 and 17.0.11(for infra.ci and weekly.ci controllers)
  • Weekly 2.456 (30 April 2024) is expected to use new JDK 11.0.23 for containers
  • Next LTS 2.452.1 (15 May 2024) is expected to use the new JDKs (for all the other controllers)
• Jenkins agent images:
  • Packer Image, aka. "all-in-one" images for Linux VM agents, Windows VM agents and most of the Linux container agents.
    • JDK8: Bump JDK8 version to 8u412-b08 packer-images#1139
    • JDK11: Bump JDK11 version to 11.0.23+9 packer-images#1142
    • JDK17: Bump JDK17 version to 17.0.11+9 packer-images#1137
    • JDK21: Bump JDK8 version to 8u412-b08 packer-images#1139
    • Release: https://github.com/jenkins-infra/packer-images/releases/tag/1.65.0
    • Deployment: Bump Packer Agent Templates (All-In-One) Version to 1.65.0 jenkins-infra#3396
  • Windows Container agent
    • JDK8: Bump JDK8 version to jdk8u412-b08 docker-inbound-agents#161
    • JDK11: Bump JDK11 version to jdk-11.0.23+9 docker-inbound-agents#158
    • JDK17: Bump JDK17 version to jdk-17.0.11+9 docker-inbound-agents#159
    • JDK21: Bump JDK21 version to jdk-21.0.3+9 docker-inbound-agents#160
    • Deployment: Bump non-packer container agent templates version on all controllers jenkins-infra#3399
  • Web-builder aka. "docker-builder"
  • Packaging aka. "docker-packaging"
• JDK tools:
  • Puppet-managed controllers:
    • ci.jenkins.io
    • trusted.ci.jenkins.io
    • cert.ci.jenkins.io
    • PRs:
      • JDK8: Bump JDK8 version (Jenkins tools) on all controllers to 8u412-b08 jenkins-infra#3386
      • JDK11: Bump JDK11 version (Jenkins tools) on all controllers to 11.0.23+9 jenkins-infra#3391
      • JDK17: Bump JDK17 version (Jenkins tools) on all controllers to 17.0.11+9 jenkins-infra#3392
      • JDK21: Bump JDK21 version (Jenkins tools) on all controllers to 21.0.3+9 jenkins-infra#3387
  • Kubernetes-managed controllers:
    • infra.ci.jenkins.io
      • JDK8: Bump JDK8 version (Jenkins tools) on all controllers to jdk8u412-b08 kubernetes-management#5148
      • JDK11: Bump JDK11 version (Jenkins tools) on all controllers to jdk-11.0.23+9 kubernetes-management#5149
      • JDK17: Bump JDK17 version (Jenkins tools) on all controllers to jdk-17.0.11+9 kubernetes-management#5173
      • JDK21: Bump JDK21 version (Jenkins tools) on all controllers to jdk-21.0.3+9 kubernetes-management#5174

Reproduction steps

No response

[MarkEWaite]

I have submitted a pull request that should allow updatecli to run for the controller container images:

• Check for Windows JDK releases, same as Linux jenkinsci/docker#1852

Refer to jenkinsci/docker#1852 (comment) that describes why Java 21.0.3 and Java 17.0.11 are expected to be included in an update but Java 11.0.23 won't be included (hint: No Alpine version of 11.0.23 yet).

[MarkEWaite]

Confirmed that JDK 21.0.3 and JDK 17.0.11 are included in the containers for the weekly release 2.455 and that JDK 11.0.22 containers in the weekly release 2.455.

[dduportal]

Update:

• All JDK tools on Puppet-based controllers (ci.jenkins.io/trusted.ci.jenkins.io/cert.ci.jenkins.io) have been upgraded with no problem using the automatic detection with updatecli
• All JDK installations have been upgraded on the "all in one" templates for agents (Linux VM, Windows VM and Linux containers) and the new image has been deployed
• JDK tools for infra.ci.jenkins.io (kubernetes-manegement) have only been upgraded partially: only JDK8 and JDK11. As underlined in updatecli jdk tools kubernetes-management#4998, we have to fix the updatecli manifest to ensure JDK17 and JDK21 are upgraded => WiP
• Windows container image are WiP:
  • JDK8, JDK11 and JDK17 upgrades had been detected by the updatecli automation but are blocked by [infra.ci.jenkins.io] Build of the jenkins/docker-inbound-agents are failing since 20 March 2024 #4048 => WiP
  • JDK21 upgrade had NOT been detected by the automation => WiP to add /fix the automation

[dduportal]

Update on the Windows Container agents:

• [infra.ci.jenkins.io] Build of the jenkins/docker-inbound-agents are failing since 20 March 2024 #4048 is now fixed allowing to work on the JDK upgrades
• JDK upgrades are not available yet as Docker images. fix: switch to Adoptium Temurin installer instead of Docker image  docker-inbound-agents#154 opened to switch from parent Docker image to using the Temurin installed like we did/are doing for the official Jenkins images => WiP

[dduportal]

• Update of the JDK17 of the (parent image of docker/packaging and docker/webbuilder) jenkinsci/agent Docker image is on hold: Bump JDK17 version to 17.0.11_9 jenkinsci/docker-agent#796 because of feat(Linux): switch from temurin base images to temurin installer jenkinsci/docker-agent#786
• Jenkins LTS is next week

[dduportal]

• Docker agents have been updated with latest JDK:
  • https://github.com/jenkinsci/docker-agent/releases/tag/3206.vb_15dcf73f6a_9-11
  • Deployed to ci.jenkins.io with Bump JNLP Container Agent Image jenkins/inbound-agent (JDK17) to latest-jdk17@sha256:9d236ada05eb9c538319d3597783a3fb1e04520186cf38920c03e81a831a3774 jenkins-infra#3411
• Docker packaging has been updated:
  • https://github.com/jenkins-infra/docker-packaging/releases/tag/4.0.65
  • Bump jenkinsciinfra/packaging Docker image version to 4.0.65 release#537
• Docker webbuilder has been updated:
  • https://github.com/jenkins-infra/docker-builder/releases/tag/3.1.49
  • Bump non-packer container agent templates version on all controllers jenkins-infra#3412