JDK 11.0.17+8

[Damien Duportal]

Hello dear contributors,

The Jenkins Infrastructure team received automatic notification of a new JDK11 version: 11.0.17+8 (changelog at https://foojay.io/java-11/?version=11.0.17&quarter=102022&tab=component).

Our usual process is to upgrade the JDK on the next update of the agent templates for ci.jenkins.io.

However last time we bumped the JDK, it created regressions and unexpected work on some Jenkins Core change requests (not mentioning thet 11.0.16 line had to be patched because of memory issues to 11.0.16.1).

In order to avoid as much disruption as posible, we are seeking your feedbacks on this upgrade.

Here is the timeline proposal: 

We would want to upgrade the JDK11 on the ci.jenkins.io agents for the Thursday 03 of November (The next LTS release is the 2nd).

Is there any voice against this timeline for change?

Thanks in advance

Damien, for the infrastructure team

[Basil Crow]

Checking the release notes at
https://www.oracle.com/java/technologies/javase/11-0-17-relnotes.html
I see 11.0.17 contains fixes for JDK-8231454 and JDK-8268773, which
are relevant to Jenkins. The update of tzdata will also resolve
JENKINS-69635. The fix for JDK-8231454 was already worked around in
Pipeline: Groovy and Script Security, and I manually stepped through
the workaround code on 11.0.17 to verify that it was harmless (though
unnecessary) on an 11.0.17 JVM with the fix for JDK-8231454. The fix
for JDK-8268773 should not be needed as of recent versions of
Remoting. I ran my local development Jenkins controller on 11.0.17 and
did not experience any problems running various job types
interactively. I also ran the following test suites on 11.0.17
successfully:

- Jenkins core smoke tests
- Pipeline: Groovy
- Script Security
- Remoting

A quick perusal of
https://mail.openjdk.org/pipermail/jdk-updates-dev/2022-October/ does
not appear to show any major regressions in the past week since the
release took place, unlike 11.0.16 (where
https://mail.openjdk.org/pipermail/jdk-updates-dev/2022-August/016460.html
was being actively discussed).

Based on the above, I do not anticipate any problems with the C2 JIT
compiler, the metaspace, or container awareness for cgroups v2 (which
are the three categories where we experienced issues with 11.0.16). If
it is feasible without too much effort to run the BOM test suite
against 11.0.17 before our agents are upgraded, I think that would be
safest. But if that is not practical, I think it would be fine to
upgrade our agents and merely monitor core and BOM builds afterward to
ensure no new failures are introduced.

[Damien Duportal]

First of all, thanks a lot Basil for this thorough check and feedback!

Second, we are adding JDK17 17.0.5+8 to this deadline (just popped in our system).

Finally, if it helps, we can totally add these 2 new JDK as tools in ci.jenkins.io, with a new such as 'jdk11-next' and 'jdk17-next' to allow easy testing for BOM or any other project: does that make sense?

Damien

[Basil Crow]

You are welcome. Java 17.0.5 does not seem to contain any fixes that
are relevant to Jenkins. Adding 11.0.17 and 17.0.5 as JDK tools on
ci.jenkins.io might help as you test the upgrade but would likely not
be of much use once the upgrade has been completed. However, I could
think of a use case for a permanent JDK tool for the bleeding edge
version of Java (e.g., Java 18 yesterday, Java 19 today, or Java 20
tomorrow): setting up some CI build (not on the critical path) to run
speculative tests of Jenkins core or plugin builds on the latest Java
runtime to proactively discover new issues as soon as they are
introduced.

[Damien Duportal]

For information, we have triggered the deployment of these new JDK11 and JDK17 versions in https://github.com/jenkins-infra/jenkins-infra/pull/2463 for agents, and https://github.com/jenkins-infra/jenkins-infra/pull/2455 + https://github.com/jenkins-infra/jenkins-infra/pull/2456 for ci.jenkins.io's tools.

We're going to open an issue to track the work on providing a "edge version" of these tools. Thanks a lot!