BFD-3050: Upgrade JDK to version 21 (#2066)

.github/workflows/ci-base-container-image.yml

@@ -6,7 +6,6 @@ on:
     paths:
       - ops/Dockerfile
       - .github/workflows/ci-base-container-image.yml
-
 jobs:
   build-container:
     name: Build and Deliver Container

.github/workflows/ci-java.yml

@@ -18,7 +18,7 @@ env:
   ^ops/ansible/roles/bfd-pipeline/|\
   ^ops/ansible/roles/bfd-server/|\
   ^.github/workflows/ci-ansible.yml|\
-  ^.github/workflows/ci-java.yml\
+  ^.github/workflows/yml\
   )"
 
 jobs:
@@ -48,7 +48,7 @@ jobs:
       - name: 'Setup JDK'
         uses: actions/setup-java@v3
         with:
-          java-version: '17'
+          java-version: '21'
           distribution: 'corretto'
       - name: 'Generate maven toolchain config'
         run: |
@@ -57,7 +57,7 @@ jobs:
             <toolchain>
               <type>jdk</type>
               <provides>
-                <version>17</version>
+                <version>21</version>
                 <vendor>OpenJDK</vendor>
               </provides>
               <configuration>
@@ -80,7 +80,7 @@ jobs:
       - name: 'Setup JDK'
         uses: actions/setup-java@v3
         with:
-          java-version: '17'
+          java-version: '21'
           distribution: 'corretto'
       - name: 'Generate Maven Config'
         run: |
@@ -89,7 +89,7 @@ jobs:
             <toolchain>
               <type>jdk</type>
               <provides>
-                <version>17</version>
+                <version>21</version>
                 <vendor>OpenJDK</vendor>
               </provides>
               <configuration>

Jenkinsfile

@@ -125,7 +125,7 @@ try {
 		containers: [
 			containerTemplate(
 				name: 'bfd-cbc-build',
-				image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk17-mvn3-tfenv3-kt1.9-latest', // TODO: consider a smarter solution for resolving this image
+				image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk21-mvn3-tfenv3-kt1.9-latest', // TODO: consider a smarter solution for resolving this image
 				command: 'cat',
 				ttyEnabled: true,
 				alwaysPullImage: false, // NOTE: This implies that we observe immutable container images

apps/pom.xml

@@ -62,7 +62,7 @@
         <project.reporting.outputEncoding>${project.build.sourceEncoding}</project.reporting.outputEncoding>
 
         <!-- The version of Java that we'll use for everything. -->
-        <javaSourceVersion>17</javaSourceVersion>
+        <javaSourceVersion>21</javaSourceVersion>
 
         <!-- Create a standard (but fake) timestamp for use in creating build artifacts so that
             they are reproducible bit-by-bit no matter when/where they are generated.
@@ -128,7 +128,8 @@
 
         <logback.jackson.version>0.1.5</logback.jackson.version>
         <logback.json.classic.version>0.1.5</logback.json.classic.version>
-        <mockito.version>5.6.0</mockito.version>
+        <mockito.version>5.7.0</mockito.version>
+        <byte-buddy.version>1.14.9</byte-buddy.version>
         <mockito-inline.version>5.2.0</mockito-inline.version>
         <rest-assured.version>5.3.2</rest-assured.version>
         <assertj.version>3.24.2</assertj.version>
@@ -148,19 +149,19 @@
         <reflections.version>0.10.2</reflections.version>
         <itextpdf.version>5.5.13.3</itextpdf.version>
         <auto-service.version>1.1.1</auto-service.version>
-        <maven-plugin-api.version>3.9.4</maven-plugin-api.version>
+        <maven-plugin-api.version>3.9.5</maven-plugin-api.version>
         <maven-core.version>3.9.4</maven-core.version>
-        <maven-plugin-annotations.version>3.9.0</maven-plugin-annotations.version>
-        <maven.plugin.version>3.7.1</maven.plugin.version>
+        <maven-plugin-annotations.version>3.10.2</maven-plugin-annotations.version>
+        <maven.plugin.version>3.10.2</maven.plugin.version>
         <hibernate.validator.version>8.0.1.Final</hibernate.validator.version>
         <jakarta.el.version>4.0.2</jakarta.el.version>
         <poi.version>5.2.4</poi.version>
         <javapoet.version>1.13.0</javapoet.version>
         <!-- Using Jetty 10 LTS over Jetty 11 because Jetty 11 moves to the jakarta namespace for the servlet API which causes a problem for HAPI-->
         <jetty.version>10.0.16</jetty.version>
         <org.apache.httpcomponents.httpclient.version>4.5.14</org.apache.httpcomponents.httpclient.version>
-        <maven.surefire.plugin.version>3.1.2</maven.surefire.plugin.version>
-        <maven.failsafe.plugin.version>3.1.2</maven.failsafe.plugin.version>
+        <maven.surefire.plugin.version>3.2.2</maven.surefire.plugin.version>
+        <maven.failsafe.plugin.version>3.2.2</maven.failsafe.plugin.version>
         <datasource-proxy.version>1.9</datasource-proxy.version>
         <cors.filter.version>1.0.1</cors.filter.version>
         <org.apache.spark.version>3.5.0</org.apache.spark.version>
@@ -225,7 +226,7 @@
         <!-- https://github.com/GoogleContainerTools/jib/tree/master/jib-maven-plugin#quickstart -->
         <jib.version>3.4.0</jib.version>
         <!-- The base image (FROM) used to build images with jib. -->
-        <jib.from>amazoncorretto:17.0.7-alpine</jib.from>
+        <jib.from>amazoncorretto:21.0.1-alpine</jib.from>
         <!--
           The goal to use with the jib plugin.   Override on command line to change behavior:
           dockerBuild: build on local docker only
@@ -306,6 +307,12 @@
                 <artifactId>mockito-inline</artifactId>
                 <version>${mockito-inline.version}</version>
             </dependency>
+            <!-- https://mvnrepository.com/artifact/net.bytebuddy/byte-buddy -->
+            <dependency>
+                <groupId>net.bytebuddy</groupId>
+                <artifactId>byte-buddy</artifactId>
+                <version>${byte-buddy.version}</version>
+            </dependency>
             <dependency>
                 <!-- Used to write fluent assertions in unit tests. -->
                 <groupId>org.assertj</groupId>
@@ -727,7 +734,6 @@
                     <configuration>
                         <toolchains>
                             <jdk>
-                                <!-- Use a Java 17 JDK, by default. -->
                                 <version>${javaSourceVersion}</version>
                             </jdk>
                         </toolchains>

ops/Dockerfile

@@ -39,19 +39,22 @@ LABEL org.opencontainers.image.source=https://github.com/CMSgov/beneficiary-fhir
 # * <https://github.com/solita/docker-systemd>: For Ubuntu, but works!
 # * <https://github.com/moby/moby/issues/28614>: Also some useful info.
 #
-# NOTE: Packages sepecified below should generally be kept up-to-date
+# NOTE: Packages specified below should generally be kept up-to-date
 #       with the dependencies encoded in the BFD platinum image
 #       instructions.
-RUN yum update -y --security && \
+
+RUN rpm --import https://yum.corretto.aws/corretto.key && \
+    curl -L -o /etc/yum.repos.d/corretto.repo https://yum.corretto.aws/corretto.repo && \
     yum clean metadata && \
+    yum update -y --security && \
     amazon-linux-extras install epel -y && \
     yum -y groupinstall "Development Tools" && \
     yum install -y \
+    java-21-amazon-corretto-devel \
     amazon-cloudwatch-agent \
     ansible \
     gcc \
     git \
-    java-17-amazon-corretto-devel \
     libffi-devel \
     openssl-devel \
     selinux-policy \

ops/ansible/playbooks-ccs/roles/platinum/tasks/install-dependencies.yml

@@ -3,19 +3,23 @@
 # Builds a 'Platinum' AMI (updates) and installs program specific dependencies
 # from a base Gold Image in the CCS AWS Environment
 ##
+- name: Import Corretto RPM key
+  ansible.builtin.command : rpm --import https://yum.corretto.aws/corretto.key
+- name: Download Corretto repository configuration
+  ansible.builtin.command: curl -L -o /etc/yum.repos.d/corretto.repo https://yum.corretto.aws/corretto.repo
 - name: Install dependencies
   vars:
     ansible_python_interpreter: /usr/bin/python
   yum:
-    # NOTE: Packages sepecified below should generally be kept up-to-date
+    # NOTE: Packages specified below should generally be kept up-to-date
     #       with the dependencies encoded in ops/Dockerfile instructions.
     name:
       - "@Development Tools" # equivalent to `yum groupinstall "Development Tools"`
       - amazon-cloudwatch-agent
       - ansible
       - gcc
       - git
-      - java-17-amazon-corretto-devel
+      - java-21-amazon-corretto-devel
       - libffi-devel
       - openssl-devel
       - selinux-policy

ops/ansible/roles/bfd-db-migrator/tasks/migrator.yml

@@ -4,7 +4,7 @@
     ansible_python_interpreter: /usr/bin/python
   yum:
     pkg:
-      - java-17-amazon-corretto-devel
+      - java-21-amazon-corretto-devel
       - jq
   become: true
   tags:

ops/ansible/roles/bfd-pipeline/tasks/etl.yml

@@ -4,7 +4,7 @@
     ansible_python_interpreter: /usr/bin/python
   yum:
     pkg:
-      - java-17-amazon-corretto-devel
+      - java-21-amazon-corretto-devel
   become: true
   tags:
     - pre-ami

ops/ansible/roles/bfd-server/tasks/install.yml

@@ -4,7 +4,7 @@
     ansible_python_interpreter: /usr/bin/python
   yum:
     pkg:
-      - java-17-amazon-corretto-devel
+      - java-21-amazon-corretto-devel
       - iptables
   become: true
 

ops/deploy-ccs.groovy

@@ -55,10 +55,10 @@ class AmiIds implements Serializable {
 def findAmis(String branchName) {
 	// Replace this lookup either with a lookup in SSM or in a build artifact.
 	return new AmiIds(
-		platinumAmiId: awsEc2.getAmiId("", "bfd-amzn2-jdk17-platinum-??????????????"),
-		bfdPipelineAmiId: awsEc2.getAmiId(branchName, "bfd-amzn2-jdk17-etl-??????????????"),
-		bfdServerAmiId: awsEc2.getAmiId(branchName, "bfd-amzn2-jdk17-fhir-??????????????"),
-		bfdMigratorAmiId: awsEc2.getAmiId(branchName, "bfd-amzn2-jdk17-db-migrator-??????????????"),
+		platinumAmiId: awsEc2.getAmiId("", "bfd-amzn2-jdk21-platinum-??????????????"),
+		bfdPipelineAmiId: awsEc2.getAmiId(branchName, "bfd-amzn2-jdk21-etl-??????????????"),
+		bfdServerAmiId: awsEc2.getAmiId(branchName, "bfd-amzn2-jdk21-fhir-??????????????"),
+		bfdMigratorAmiId: awsEc2.getAmiId(branchName, "bfd-amzn2-jdk21-db-migrator-??????????????"),
 		bfdDockerHostAmiId: awsEc2.getAmiId(branchName, "docker-host-??????????????")
 	)
 }

ops/jenkins/bfd-build-apps/Jenkinsfile

@@ -78,7 +78,7 @@ spec:
   serviceAccount: bfd
   containers:
   - name: bfd-cbc-build
-    image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk17-mvn3-tfenv3-kt1.9-latest'
+    image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk21-mvn3-tfenv3-kt1.9-latest'
     command:
     - cat
     tty: true

ops/jenkins/bfd-build-deploy/Jenkinsfile

@@ -20,7 +20,7 @@ spec:
   serviceAccount: bfd
   containers:
   - name: bfd-cbc-build
-    image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk17-mvn3-tfenv3-kt1.9-latest'
+    image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk21-mvn3-tfenv3-kt1.9-latest'
     command:
     - cat
     tty: true

ops/jenkins/bfd-build-deployment-process/Jenkinsfile

@@ -21,7 +21,7 @@ spec:
   serviceAccount: bfd
   containers:
   - name: bfd-cbc-build
-    image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk17-mvn3-tfenv3-kt1.9-latest'
+    image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk21-mvn3-tfenv3-kt1.9-latest'
     command:
     - cat
     tty: true

ops/jenkins/bfd-build-platinum/Jenkinsfile

@@ -84,7 +84,7 @@ spec:
   serviceAccount: bfd
   containers:
   - name: bfd-cbc-build
-    image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk17-mvn3-tfenv3-kt1.9-latest'
+    image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk21-mvn3-tfenv3-kt1.9-latest'
     command:
     - cat
     tty: true
@@ -135,7 +135,7 @@ spec:
                             returnStdout: true,
                             script: "aws ec2 describe-images \
                             --filters 'Name=tag:amiSourceId,Values=${goldAmiId}' \
-                            'Name=name,Values=bfd-amzn2-jdk17-platinum-??????????????' \
+                            'Name=name,Values=bfd-amzn2-jdk21-platinum-??????????????' \
                             'Name=state,Values=available' --region us-east-1 \
                             --query 'Images[*].[ImageId]' \
                             --output text"

ops/jenkins/bfd-cbc-build/Dockerfile

@@ -4,7 +4,6 @@ ARG PACKER_VERSION
 ARG YQ_VERSION
 
 FROM maven:${MAVEN_VERSION}-amazoncorretto-${JAVA_VERSION} AS base
-
 RUN yum update -y --security && \
     amazon-linux-extras install epel -y && \
     yum clean metadata && \

ops/jenkins/bfd-cbc-build/build-push.sh

@@ -6,12 +6,12 @@ REPO_ROOT="$(cd "$BUILD_ROOT_DIR" && git rev-parse --show-toplevel)"
 # Overridable Defaults
 GIT_SHORT_HASH="$(git rev-parse --short HEAD)"
 IMAGE_NAME="public.ecr.aws/c2o1d8s9/bfd-cbc-build"
-IMAGE_TAG="${CBC_IMAGE_TAG:-"jdk17-mvn3-tfenv3-${GIT_SHORT_HASH}"}"
-IMAGE_TAG_LATEST="${CBC_IMAGE_TAG_LATEST:-"jdk17-mvn3-tfenv3-kt1.9-latest"}"
+IMAGE_TAG="${CBC_IMAGE_TAG:-"jdk21-mvn3-tfenv3-${GIT_SHORT_HASH}"}"
+IMAGE_TAG_LATEST="${CBC_IMAGE_TAG_LATEST:-"jdk21-mvn3-tfenv3-kt1.9-latest"}"
 CIPHER_SCRIPT="$(cat "$REPO_ROOT/apps/utils/cipher/cipher.main.kts")"
 
 docker build "$BUILD_ROOT_DIR" \
-  --build-arg JAVA_VERSION="${CBC_JAVA_VERSION:-17}" \
+  --build-arg JAVA_VERSION="${CBC_JAVA_VERSION:-21}" \
   --build-arg MAVEN_VERSION="${CBC_MAVEN_VERSION:-3}" \
   --build-arg PACKER_VERSION="${CBC_PACKER_VERSION:-1.6.6}" \
   --build-arg TFENV_REPO_HASH="${CBC_TFENV_REPO_HASH:-c05c364}" \

ops/jenkins/bfd-cbc-build/toolchains.xml

@@ -3,11 +3,11 @@
     <toolchain>
         <type>jdk</type>
         <provides>
-            <version>17</version>
+            <version>21</version>
             <vendor>openjdk</vendor>
         </provides>
         <configuration>
-            <jdkHome>/usr/lib/jvm/java-17-amazon-corretto</jdkHome>
+            <jdkHome>/usr/lib/jvm/java-21-amazon-corretto</jdkHome>
         </configuration>
     </toolchain>
 </toolchains>

ops/jenkins/bfd-data-fda/Jenkinsfile

@@ -17,7 +17,7 @@ spec:
   serviceAccount: bfd
   containers:
   - name: bfd-cbc-build
-    image: public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk17-mvn3-tfenv3-kt1.9-latest # TODO: resolve the container image rather than hard-coding it
+    image: public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk21-mvn3-tfenv3-kt1.9-latest # TODO: resolve the container image rather than hard-coding it
     command:
     - sleep
     args:

ops/jenkins/bfd-data-npi/Jenkinsfile

@@ -17,7 +17,7 @@ spec:
   serviceAccount: bfd
   containers:
   - name: bfd-cbc-build
-    image: public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk17-mvn3-tfenv3-kt1.9-latest # TODO: resolve the container image rather than hard-coding it
+    image: public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk21-mvn3-tfenv3-kt1.9-latest # TODO: resolve the container image rather than hard-coding it
     command:
     - sleep
     args:

ops/jenkins/bfd-deploy-apps/Jenkinsfile

@@ -82,7 +82,7 @@ spec:
   serviceAccount: bfd
   containers:
   - name: bfd-cbc-build
-    image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk17-mvn3-tfenv3-kt1.9-latest'
+    image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk21-mvn3-tfenv3-kt1.9-latest'
     command:
     - cat
     tty: true

ops/jenkins/bfd-deploy-pipeline-terraservice/Jenkinsfile

@@ -16,7 +16,7 @@ spec:
   restartPolicy: Never
   containers:
     - name: bfd-cbc-build
-      image: "public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk17-mvn3-tfenv3-kt1.9-latest" # TODO: consider a smarter solution for resolving this image
+      image: "public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk21-mvn3-tfenv3-kt1.9-latest" # TODO: consider a smarter solution for resolving this image
       command:
         - cat
       tty: true

ops/jenkins/bfd-destroy-environment/Jenkinsfile

@@ -84,7 +84,7 @@ spec:
   serviceAccount: bfd
   containers:
   - name: bfd-cbc-build
-    image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk17-mvn3-tfenv3-kt1.9-latest'
+    image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk21-mvn3-tfenv3-kt1.9-latest'
     command:
     - cat
     tty: true

ops/jenkins/bfd-jenkins-sonarqube/Jenkinsfile

@@ -36,7 +36,7 @@ spec:
         memory: '8192Mi'
         cpu: '4000m'
   - name: bfd-cbc-build
-    image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk17-mvn3-tfenv3-kt1.9-latest'
+    image: 'public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk21-mvn3-tfenv3-kt1.9-latest'
     volumeMounts:
     - name: docker-socket
       mountPath: /var/run

ops/jenkins/bfd-run-pipeline-oob/Jenkinsfile

@@ -10,7 +10,7 @@ spec:
   restartPolicy: Never
   containers:
     - name: bfd-cbc-build
-      image: "public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk17-mvn3-tfenv3-kt1.9-latest" # TODO: consider a smarter solution for resolving this image
+      image: "public.ecr.aws/c2o1d8s9/bfd-cbc-build:jdk21-mvn3-tfenv3-kt1.9-latest" # TODO: consider a smarter solution for resolving this image
       command:
         - cat
       tty: true