various changes to support JDK21 by xsalefter · Pull Request #347 · killbill/killbill-cloud

xsalefter · 2026-10-14T18:05:05Z

No description provided.

For KB 0.25.1 -- Upgraded Tomcat to v11.x

…2.x.

This is actually optional changes. But since this is a candidate for future release, lets start to change this.

…est" tag

Removed deprecated --with-ssl=yes configure option for Tomcat Native 2.x.

create another workflow to handle beta release

Arises from the killbill-admin-ui-standalone JRuby 10 upgrade: jruby-rack 2.0.0 (the release that targets JRuby 10/JDK21) is compiled against jakarta.servlet, which requires a Jakarta EE servlet container (Tomcat 10+) and a JDK 21+ JVM to run it. Targets Tomcat 11.0.x rather than 10.1.x: both major lines are currently supported by the Tomcat project (which keeps 3 concurrent supported major versions), but 11.0.x implements the newest specs (Servlet 6.1 vs 10.1's 6.0) and will have a longer support runway before the next EOL rotation. Since we already require JDK 21 for jruby-rack 2.0 regardless, there's no downside to going straight to 11.0.x (it only requires JDK 17+, same as 10.1's JDK 11+ floor is irrelevant here). - ansible/roles/tomcat/tasks/install.yml: bump the maven-metadata.xml version regex and download URL from tomcat-10 (10.1.x) to tomcat-11 (11.0.x). Validated the regex against the live repo1.maven.org/maven2/org/apache/tomcat/tomcat/maven-metadata.xml (resolves to 11.0.25, matching the current official download page). - ansible/templates/tomcat/conf/web.xml.j2: update the schema from jakarta.ee/web-app_6_0.xsd to jakarta.ee/web-app_6_1.xsd, matching Tomcat 11's actual bundled default web.xml (verified against a real local Tomcat 11.0.25 install). server.xml.j2/context.xml.j2 needed no changes (pure org.apache.catalina.* internal classes, unaffected by the servlet spec version). - docker/templates/base/latest/Dockerfile: openjdk-11-jdk-headless -> openjdk-21-jdk-headless, and the java-11-openjdk -> java-21-openjdk JAVA_HOME symlink. Validated end to end: built the killbill-admin-ui-standalone WAR (rack 2.2.24 + jruby-rack 2.0.0 + json 2.21.2 + csv fix) and deployed it to a real local Tomcat 11.0.25 instance under JDK21 - it booted successfully with no errors, served an HTTP 302 redirect to /users/sign_in with correct session cookie handling and Transfer-Encoding: chunked, and correctly established a JDBC connection. jruby-rack 2.0.0 (built against Servlet 6.0) works unmodified against Tomcat 11's Servlet 6.1 API, as expected since 6.1 is backward compatible with 6.0. IMPORTANT: this base Docker image is shared with the killbill/killbill core server image. The core server team should validate their own deployment is compatible with Tomcat 11 (javax vs jakarta.servlet) and JDK 21 before this rolls out to production; core server source is out of scope for this repo. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…2.x) CI on this PR was failing: "Build killbill/base:latest" step, in the "Configure native libraries" ansible task: configure: error: yes is not a directory Root-caused by extracting and diffing the tomcat-native.tar.gz bundled in each Tomcat distribution: - Tomcat 9.0.x (the pre-PR baseline) bundles Tomcat Native 1.3.8, whose configure script special-cases the literal value "yes" for --with-ssl (falls back to auto-detecting OpenSSL from standard system paths). - Tomcat 10.1.x AND 11.0.x both bundle Tomcat Native 2.0.x (2.0.9 and 2.0.15 respectively), whose configure script dropped that special case: it now only accepts "no" or an actual directory path, otherwise erroring with "<value> is not a directory". This means the bug was latent in the jump from Tomcat 9.0.x to EITHER 10.1.x or 11.0.x - not specific to the choice of 11.0.x made in this PR. Fix: drop the --with-ssl=yes argument entirely. Confirmed by reading both configure scripts that omitting --with-ssl produces the exact same auto-detect-from-system-paths behavior as passing "yes" did on tcnative 1.x, and is also the documented tcnative 2.x default (skips the explicit value check, falls through to the same "guess it" search over /usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw). Validated by fully reproducing the native build in a fresh ubuntu:24.04 container (same toolchain packages the "Install toolchain" task installs: dpkg-dev, gcc, libapr1-dev, libssl-dev, make; same JDK: openjdk-21-jdk-headless) using Tomcat 11.0.25's actual bundled tomcat-native.tar.gz: checking for OpenSSL location... using openssl from /usr/lib and /usr/include checking OpenSSL library version >= 3.0.0... ok configure: creating ./config.status (exit 0) Then ran `make all` (produced libtcnative-2.so.0.0.15) and `make install` (landed correctly in the configured libdir) - both exit 0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Bump Tomcat to 11.0.x and base Docker image to JDK 21

Copilot

🟡 Changes recommended

The shared Tomcat upgrade breaks legacy application compatibility and download URLs for existing version pins.

2 open findings

What changed in this PR

Updates the build and deployment infrastructure for JDK 21 and adds a self-contained beta image build.

Changes:

Switches Java installation and KPM release builds to JDK 21.
Updates shared Tomcat installation and configuration to Tomcat 11.
Adds a multi-stage beta Dockerfile using caller-selected Ansible roles.

File	Description
docker/templates/killbill/beta/Dockerfile.template	Adds self-contained beta image build.
docker/templates/build/Dockerfile	Uses JDK 21 for builds.
docker/templates/base/latest/Dockerfile	Uses JDK 21 in the base image.
ansible/templates/tomcat/conf/web.xml.j2	Uses Jakarta Servlet 6.1 configuration.
ansible/roles/tomcat/tasks/native.yml	Removes explicit SSL configure option.
ansible/roles/tomcat/tasks/install.yml	Defaults to Tomcat 11 downloads.
ansible/README.md	Updates Java prerequisite examples.
ansible/java.yml	Installs JDK 21 by default.
.gitignore	Ignores the generated beta Dockerfile.
.github/workflows/kpm_release.yml	Runs release builds with Java 21.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

🔵 Needs a closer look

The major runtime migration needs application startup validation beyond build-only CI, and native-library detection remains unresolved.

1 open issue

Shared Tomcat 11 default breaks legacy javax.servlet applications

1 previously missed issue

In code that hasn't changed since last review

Update Native library check for Tomcat Native 2

ansible/roles/tomcat/tasks/install.yml:41

Tomcat 11 bundles Tomcat Native 2, but ansible/roles/tomcat/tasks/native.yml:10 still checks for libtcnative-1.so. This causes subsequent provisioning runs to rebuild an already-installed Native 2 library, or incorrectly skip its build when an old Native 1 marker exists in a shared library directory. Update the existence check to libtcnative-2.so alongside this version bump.

1 resolved since last review

Hardcoded Tomcat 11 path breaks explicit older version pins

_{Review effort: Balanced}

Copilot

🔵 Needs a closer look

The Tomcat major-version migration and new beta image need human runtime validation, and unresolved build and provisioning issues remain.

2 open issues

1 previously missed issue

In code that hasn't changed since last review

Update Tomcat Native existence check for libtcnative-2.so

ansible/roles/tomcat/tasks/install.yml:41

Tomcat 11 bundles Tomcat Native 2.x, which installs libtcnative-2.so, but ansible/roles/tomcat/tasks/native.yml:10 still checks for libtcnative-1.so. After a successful installation, subsequent native-task runs therefore recompile and reinstall the library unnecessarily. Update that existence check to libtcnative-2.so alongside this major-version change.

_{Review effort: Balanced}

vnandwana and others added 14 commits July 24, 2026 12:11

Upgraded Tomcat to v11.x

6af0c2c

Merge pull request #335 from vnandwana/java2x

7a1c5cf

For KB 0.25.1 -- Upgraded Tomcat to v11.x

Removed deprecated --with-ssl=yes configure option for Tomcat Native …

2ae494b

…2.x.

update ansible/java.yml to use Java 21

dbe23f3

Update base/latest/Dockerfile to use openjdk-21

5358590

This is actually optional changes. But since this is a candidate for future release, lets start to change this.

ignore beta Dockerfile

413b022

add beta Dockerfile.template: killbill only, and ignore touching "lat…

02a30d1

…est" tag

add workflow file that will execute beta Dockerfile

2d034f0

Merge pull request #336 from vnandwana/java2x

4985c2b

Removed deprecated --with-ssl=yes configure option for Tomcat Native 2.x.

Merge pull request #337 from killbill/kb-beta-release

497e31b

create another workflow to handle beta release

Update java version to 21

77afdaa

Merge pull request #344 from killbill/jruby10-tomcat-upgrade

6eab879

Bump Tomcat to 11.0.x and base Docker image to JDK 21

Copilot AI balanced review requested due to automatic review settings October 14, 2026 18:05

Copilot started reviewing on behalf of xsalefter October 14, 2026 18:05

View session

Copilot AI reviewed Oct 14, 2026

View reviewed changes

Comment thread ansible/roles/tomcat/tasks/install.yml

Comment thread ansible/roles/tomcat/tasks/install.yml Outdated

xsalefter requested a review from vnandwana October 17, 2026 03:49

xsalefter added 4 commits October 24, 2026 06:41

update various version

20f558c

update ansible command sample for mac

fce8b0d

update web-app schema version to 5.0

60cd2ca

add task to verify tomcat version

03b2cc4

Copilot AI balanced review requested due to automatic review settings October 23, 2026 23:43

Copilot started reviewing on behalf of xsalefter October 23, 2026 23:43

View session

Copilot AI reviewed Oct 23, 2026

View reviewed changes

update ruby version to 3.2

281e0a1

Copilot AI balanced review requested due to automatic review settings October 23, 2026 23:58

Copilot started reviewing on behalf of xsalefter October 23, 2026 23:59

View session

Copilot AI reviewed Oct 24, 2026

View reviewed changes

Comment thread .github/workflows/docker_ci.yml

xsalefter merged commit 3372bb1 into master Oct 29, 2026
11 checks passed

xsalefter deleted the java2x branch October 29, 2026 16:51

Navigation Menu

Repository navigation

various changes to support JDK21 - #347

various changes to support JDK21#347
xsalefter merged 19 commits into
masterfrom
java2x

xsalefter commented Oct 14, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

xsalefter commented Oct 14, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants