Cloudera Docs

Java Requirements

CDP Private Cloud Base comprises of Cloudera Manager and Runtime services. Understand the specific JDK requirements for your deployments.

Supported JDK versions

Please see the Cloudera Support Matrix for detailed information about supported JDK versions.

Table 1. Azul Open JDK versions that are tested and recommended
Azul Open JDK Version Notes
17.0.7
11.50.19
8.56.0.21 Minimum required version
Table 2. Oracle JDK versions that are tested and recommended
Oracle JDK Version Notes
17.0.6
11.0.10+8
1.8u181 Minimum required version
Table 3. OpenJDK versions that are tested and recommended
OpenJDK Version Notes
17.0.7 17.0.2 is the minimum required OpenJDK 17 version for FIPS
11.0.4+11 11.0.3 is the minimum required OpenJDK 11 version for FIPS
1.8u231 For FIPS minimum required / latest version tested
1.8u232 Minimum required / Latest version tested

Configuring Required JDK 17 JVM Parameters (add-opens and add-exports) for Cloudera Runtime Components

When using JDK 17, Cloudera Runtime components and applications (such as YARN, MapReduce, Spark, and Hive) require explicit Java reflection and package export access (--add-opens and --add-exports flags) to run successfully.

In Cloudera Manager 7.13.1 and 7.13.2 / Cloudera Runtime 7.3.1, 7.3.2, and higher versions, these required parameters are automatically pre-configured by default. No manual configuration is required.

However, for CDP Private Cloud Base 7.1.9 (Base, SP1, and SP2), you must verify their presence. If missing, configure the relevant service in Cloudera Manager to handle them automatically by performing the following steps.

YARN (MapReduce and DistCP Applications)

Running MapReduce Application Masters (AM) and MapReduce containers with JDK 17 requires specific Java reflection access flags. These parameters are typically managed automatically in the NodeManager environment (yarn_nodemanager_admin_env).

You must verify if these parameters are present. If they are missing, you do not need to turn on container flags manually. Instead, you can configure Cloudera Manager to handle them automatically using one of the following two methods:
Method 1: Enable mapreduce_jvm_add_opens_as_default (Recommended)
This property automatically appends the required JDK 17 flags to the MapReduce Application Master (AM) and map/reduce container launch commands.

  1. Log in to the Cloudera Manager Admin Console.

  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the YARN service.

  3. Click on the Configuration tab at the top of the YARN service page.

  4. In the Search filter box on the left, type or paste the exact configuration key: mapreduce_jvm_add_opens_as_default

  5. Locate the property in the filtered results (it is typically titled Add add-opens flags to MR containers).

  6. Select the checkbox to change its value from false to true.

  7. Click Save Changes.

  8. Select Restart from the list of Actions at the top of the page to restart the affected YARN/MapReduce service components.

Method 2: Manually Update the NodeManager Admin Environment
If you prefer not to use the automated flag, you can explicitly inject the three required parameters into the NodeManager service's environment configurations.

  1. Log in to the Cloudera Manager Admin Console.

  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the YARN service.

  3. Click on the Configuration tab at the top of the YARN service page.

  4. In the Search filter box on the left, type or paste the configuration key: yarn_nodemanager_admin_env

  5. Locate the Containers Environment Variable property.

  6. Click into the value field and append the following three flags on a single line (ensure they are space-separated):

    --add-opens=java.base/java.lang=ALL-UNNAMED --add-exports=java.base/sun.net.dns=ALL-UNNAMED --add-exports=java.base/sun.net.util=ALL-UNNAMED

  7. Click Save Changes.

  8. Select Restart from the list of Actions at the top of the page to restart the affected YARN/MapReduce service components.

Hive on Tez
To manually add the parameters for JDK 17, do the following steps:
  1. Log in to the Cloudera Manager Admin Console.
  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the Tez service.
  3. Click on the Configuration tab at the top of the Tez service page.
  4. In the Search filter box on the left, type or paste the configuration key: tez.am.launch.cmd-opts and tez.task.launch.cmd-opts.

  5. Click into the value field and append the following three flags on a single line (ensure they are space-separated):

    
--add-opens=java.base/java.lang=ALL-UNNAMED 
--add-exports=java.base/sun.net.dns=ALL-UNNAMED 
--add-exports=java.base/sun.net.util=ALL-UNNAMED 
--add-opens java.base/java.net=ALL-UNNAMED
--add-opens java.base/java.util=ALL-UNNAMED
--add-opens java.base/java.util.concurrent.atomic=ALL-UNNAMED
--add-opens java.base/java.util.regex=ALL-UNNAMED
--add-opens java.base/java.lang=ALL-UNNAMED
--add-opens java.base/java.time=ALL-UNNAMED
--add-opens java.base/java.io=ALL-UNNAMED
--add-opens java.base/java.nio=ALL-UNNAME
  6. Click Save Changes.

  7. Select Restart from the list of Actions at the top of the page to restart the affected services.

Ranger Admin

To ensure full compatibility when running Apache Ranger service with JDK 17, you must append specific Java runtime flags to the Ranger Admin environment configuration snippet (safety valve) in Cloudera Manager.

  1. Log in to the Cloudera Manager Admin Console.

  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the Ranger service.

  3. Click on the Configuration tab at the top of the Ranger service page.

  4. In the Search filter box on the left, type or paste the configuration key: RANGER_ADMIN_role_env_safety_valve or Ranger Admin Environment Advanced Configuration Snippet (Safety Valve).

  5. In the configuration snippet field, add a key-value pair by entering JAVA_OPTS as the key.

    Note that the required value differs depending on your Cloudera Runtime version:
    For Cloudera Runtime 7.1.9:

    • Key: JAVA_OPTS

    • Value:
      --add-opens java.base/java.nio=ALL-UNNAMED
    For Cloudera Runtime 7.1.9 SP1, Cloudera Runtime 7.1.9 SP2, and higher versions

    • Key: JAVA_OPTS

    • Value:
      --add-opens java.base/java.nio=ALL-UNNAMED --add-exports java.base/sun.net.dns=ALL-UNNAMED --add-exports java.base/sun.net.util=ALL-UNNAMED

  6. Click Save Changes.

  7. Select Restart from the list of Actions at the top of the page to restart the Ranger service and all affected roles.

Ranger Tagsync

To ensure full compatibility when running Apache Ranger service with JDK 17, you must append specific Java runtime flags to the Ranger Tagsync environment configuration snippet (safety valve) in Cloudera Manager.

  1. Log in to the Cloudera Manager Admin Console.

  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the Ranger service.

  3. Click on the Configuration tab at the top of the Ranger service page.

  4. In the Search filter box on the left, type or paste the configuration key: RANGER_TAGSYNC_role_env_safety_valve or Ranger Tagsync Environment Advanced Configuration Snippet (Safety Valve).

  5. In the configuration snippet field, add a key-value pair by entering:

    • Key: JAVA_OPTS

    • Value:
      --add-opens java.management/java.lang.management=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED

  6. Click Save Changes.

  7. Select Restart from the list of Actions at the top of the page to restart the Ranger service and all affected roles.

Ranger Usersync

To ensure full compatibility when running Apache Ranger service with JDK 17, you must append specific Java runtime flags to the Ranger Usersync environment configuration snippet (safety valve) in Cloudera Manager.

  1. Log in to the Cloudera Manager Admin Console.

  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the Ranger service.

  3. Click on the Configuration tab at the top of the Ranger service page.

  4. In the Search filter box on the left, type or paste the configuration key: RANGER_USERSYNC_role_env_safety_valve or Ranger Usersync Environment Advanced Configuration Snippet (Safety Valve).

  5. In the configuration snippet field, add a key-value pair by entering:

    • Key: JAVA_OPTS

    • Value:
      --add-opens java.management/java.lang.management=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED

  6. Click Save Changes.

  7. Select Restart from the list of Actions at the top of the page to restart the Ranger service and all affected roles.

Ranger KMS

To ensure full compatibility when running Apache Ranger KMS service with JDK 17, you must append specific Java runtime flags to the Ranger KMS environment configuration snippet (safety valve) in Cloudera Manager.

  1. Log in to the Cloudera Manager Admin Console.

  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the Ranger KMS service.

  3. Click on the Configuration tab at the top of the Ranger KMS service page.

  4. In the Search filter box on the left, type or paste the configuration key: RANGER_KMS_service_env_safety_valve or Ranger KMS Service Environment Advanced Configuration Snippet (Safety Valve).

  5. In the configuration snippet field, add a key-value pair by entering:

    • Key: JAVA_OPTS

    • Value:
      --add-exports java.xml.crypto/com.sun.org.apache.xml.internal.security.utils=ALL-UNNAMED

  6. Click Save Changes.

  7. Select Restart from the list of Actions at the top of the page to restart the Ranger KMS service.

Important JDK Support Matrix and Configuration Notes

Review critical Java compatibility requirements, configuration guidelines, and operational constraints for Cloudera Manager and Cloudera Runtime components before deploying or updating your JDK environment.