[INFRA-2086] - Switching ci.jenkins.io builds to AdoptOpenJDK

[Oleg Nenashev]

Hi all,

As you may have noticed, last weekend many CI jobs in the core and plugins were failing due to the unavailability of OpenJDK downloads from https://download.java.net (see INFRA-2086). After the discussion with the Jenkins INFRA team, we have a proposal to switch ci.jenkins.io to AdoptOpenJDK by default.

Background: The issue happened due to the misconfigured certificate on the instance. Windows agents on ci.jenkins.io download JDK11 on-demand by accessing the external website (not the best practice for sure). The OpenJDK download site was down for almost 4 days. Although the service is recovered now, this is a concern for the future. It is not a first time when the Oracle's infrastructure impacts Jenkins developers and users (e.g. JDK tool Installers last year). JDK downloads by URL may also break at any moment. Also, there is a constant concern about Oracle changing usage policies (e.g. restricted access to new OpenJDK 8 builds and so on). You can find more context in the INFRA team meeting notes from April 30 .

Why AdoptOpenJDK?

• The releases are distributed from GitHub, so they are more stable even if we continue downloading JDKs by URL. We also already have a lot of dependencies on GitHub services in our infrastructure
• AdoptOpenJDK ships all Java configurations (Linux/Windows, Java 8/11) and the required Docker images
• AdoptOpenJDK passes all standard JVM/JDK certification suites (powered by Jenkins, of course: https://ci.adoptopenjdk.net/ )

So the proposal on the table is to start using AdoptOpenJDK in our build flows, at least for builds outside Docker. Development Docker images and Dockerized Linux agents are also under consideration. Official Jenkins Docker images will stay intact, a separate discovery and JEP would be needed for it.

Before we move forward, it would be great to get feedback from plugin maintainers and other contributors. Any comments and proposals will be much appreciated.

Best regards,

Oleg Nenashev

[Slide]

+1 from me on this, I have switched to AdoptOpenJDK at work for pretty much everything and it seems to work great.

--
You received this message because you are subscribed to the Google Groups "Jenkins Platform SIG" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkins-platform...@googlegroups.com.
To post to this group, send email to jenkins-pl...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkins-platform-sig/CAPfivLDvRFyxYKwMTrTtpd1J-AFD%3Dja6hRVOwsqB1iYovOCf8A%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

--

Website: http://earl-of-code.com

[Mark Waite]

+1 from me.

To view this discussion on the web visit https://groups.google.com/d/msgid/jenkins-platform-sig/CAPiUgVfFSrRuyQa_PM13cfuk7Q3bEp%2BN4cgC6%2BV92gT4HdsYUw%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.

--

Thanks!

Mark Waite

[Jesse Glick]

On Thu, May 2, 2019 at 9:12 AM Oleg Nenashev <o.v.ne...@gmail.com> wrote:
> The releases are distributed from GitHub, so they are more stable even if we continue downloading JDKs by URL.

It ought to be easy to configure the (nginx?) mirror running in Azure
for use by ci.jenkins.io builds to also mirror AdoptOpenJDK releases,
so we are not transferring huge archives from GitHub’s download
servers on every build.

[R. Tyler Croy]

(replies inline)

> so we are not transferring huge archives from GitHub???s download
> servers on every build.


This was discussed a bit during the infra meeting this past Tuesday, and we
will not be mirroring GitHub's CDN. I am not worried about hitting their edge
caches for releases. As Oleg pointed out in a ticket earlier: if GitHub is
down, ci.jenkins.io won't be very useful anyways :)


Of course, the infra team needs less services to babysit, not more.

--
GitHub: https://github.com/rtyler

GPG Key ID: 0F2298A980EE31ACCA0A7825E5C92681BEF6CEA2

[Oleg Nenashev]

By the way, we do caching on the agent level.

Windows agents are not single-shot ones, and download happens only once per agent provisioning.

So it is not that bad at one may expect

On Thursday, May 2, 2019 at 3:56:01 PM UTC+2, R. Tyler Croy wrote:

(replies inline)

On Thu, 02 May 2019, Jesse Glick wrote:

[Matt Sicker]

I'm also +1 for AdoptOpenJDK. Agreed with the GitHub caveats as well.

> --
> You received this message because you are subscribed to the Google Groups "Jenkins Developers" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-de...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-dev/3c0fe7f1-43d1-4b95-bcc2-e5c07856e336%40googlegroups.com.

> For more options, visit https://groups.google.com/d/optout.



--

Matt Sicker
Senior Software Engineer, CloudBees

[Joseph P]

Sounds perfectly reasonable to me 👍
We use AdoptOpenJDK at work too.

[Robert Sandell]

If I read the migration guide on the AdoptOpenJDK correctly it states that there is no Java Web start replacement for Java 8. don't we have some Java Web Start code at least in core for agent launching? Or maybe that's not a compile time dependency?

/B

Den fre 3 maj 2019 kl 08:36 skrev Joseph P <jose...@gmail.com>:

Sounds perfectly reasonable to me 👍
We use AdoptOpenJDK at work too.

--
You received this message because you are subscribed to the Google Groups "Jenkins Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-de...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-dev/4ded0ddd-9966-4467-bae4-df573c17a38e%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Robert Sandell

Software Engineer

CloudBees, Inc.

E: rsan...@cloudbees.com

Twitter: robert_sandell

[Oleg Nenashev]

Hi,

We do not use Java Web Start in the Jenkins infrastructure.

Indeed it may become an issue for some users who want to fully migrate to AdoptOpenJDK and who connect agents from WebUI, but it would not be a big issue for us even if we decided to change the base image for our official Jenkins images.

BR, Oleg

You received this message because you are subscribed to a topic in the Google Groups "Jenkins Developers" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/jenkinsci-dev/ae71SSLtdU4/unsubscribe.
To unsubscribe from this group and all its topics, send an email to jenkinsci-de...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-dev/CALzHZS0O44DTiPBOJCbPX49KHugMGk3HasQghnJd4eXzFCaz9g%40mail.gmail.com.

[Jesse Glick]

On Fri, May 3, 2019 at 4:37 AM Robert Sandell <rsan...@cloudbees.com> wrote:
> If I read the migration guide on the AdoptOpenJDK correctly it states that there is no Java Web start replacement for Java 8. don't we have some Java Web Start code at least in core for agent launching?

Yes, but this is gone in newer Oracle JDKs anyway; you can use IcedTea
if you really want it on _any_ JRE; and you can launch agents without
it easily.

https://github.com/jenkinsci/jenkins/pull/3998

As Oleg says, this has nothing to do with the choice of JDK for
Jenkins’ own builds. There _is_ a `javax.jnlp` API but Jenkins does
not use it.