OPSEXP-2956 Bump to java 21

group_vars/all.yml

@@ -192,7 +192,7 @@ dependencies_version:
   postgresql_connector: 42.6.1
   postgres_major_version: 15
   activemq: 5.18.6
-  java: 17.0.13
+  java: 21.0.5
   java_build: 11
   tomcat: 10.1.33
   libreoffice: 7.2.5.1

molecule/pki/verify.yml

@@ -46,14 +46,13 @@
 
     - name: Check in logs a client did connect
       when: item.edition == acs.edition
+      become: true
       ansible.builtin.slurp:
         src: /var/log/alfresco/{{ item.file }}.log
       register: ats_log
-      become: true
       until:
         - item.pattern in ats_log.content | b64decode
-      retries: 10
-      delay: 3
+      no_log: true
       loop:
         - file: ats-ate-aio
           pattern: GET Transform Config version
@@ -64,6 +63,8 @@
         - file: ats-shared-fs
           pattern: TLS virtual host
           edition: Enterprise
+      retries: 10
+      delay: 3
 
     - name: Copy cert as PEM
       ansible.builtin.copy:

roles/repository/templates/alfresco-global.properties.j2

@@ -33,6 +33,8 @@ encryption.keystore.backup.type=JCEKS
 {% endif %}
 
 encryption.ssl.truststore.location={{ java_truststore | default(java_home + '/lib/security/cacerts') }}
+encryption.ssl.truststore.type={% if java_major | int >= 21 %}pkcs12{% else %}JCEKS{% endif %}
+
 {% if repo_keystore %}
 encryption.ssl.keystore.location={{ repo_keystore.path }}
 httpclient.config.transform.mTLSEnabled=true

roles/sfs/defaults/main.yml

@@ -7,3 +7,7 @@ sfs_environment:
     - $JAVA_OPTS
 utils_sfs: []
 ats_keystore: {}
+
+sfs_truststore_path: "{{ java_home + '/lib/security/cacerts' }}"
+sfs_truststore_pass: 'changeit'
+sfs_truststore_type: "{% if java_major | int >= 21 %}pkcs12{% else %}JCEKS{% endif %}"

roles/sfs/templates/mtls.properties.j2

@@ -3,7 +3,7 @@ server.ssl.key-password={{ ats_keystore.pass | default('') }}
 server.ssl.key-store={{ ats_keystore.path | quote }}
 server.ssl.key-store-password={{ ats_keystore.pass | default('') }}
 server.ssl.key-store-type={{ ats_keystore.type | default('JCEKS') }}
-server.ssl.trust-store={{ ats_truststore | default(java_home + '/lib/security/cacerts') }}
-server.ssl.trust-store-password={{ ats_truststore_pass | default('changeit') }}
-server.ssl.trust-store-type=JCEKS
+server.ssl.trust-store={{ sfs_truststore_path }}
+server.ssl.trust-store-password={{ sfs_truststore_pass }}
+server.ssl.trust-store-type={{ sfs_truststore_type }}
 server.ssl.client-auth=need

roles/transformers/defaults/main.yml

@@ -7,3 +7,7 @@ tengine_environment:
     - -Xmx1536m
 ats_keystore: {}
 include_ghostscript: false
+
+transformers_truststore_path: "{{ java_home + '/lib/security/cacerts' }}"
+transformers_truststore_pass: 'changeit'
+transformers_truststore_type: "{% if java_major | int >= 21 %}pkcs12{% else %}JCEKS{% endif %}"

roles/transformers/templates/mtls.properties.j2

@@ -3,15 +3,15 @@ server.ssl.key-password={{ ats_keystore.pass | default('') }}
 server.ssl.key-store=file:{{ ats_keystore.path | quote }}
 server.ssl.key-store-password={{ ats_keystore.pass | default('') }}
 server.ssl.key-store-type={{ ats_keystore.type | default('JCEKS') }}
-server.ssl.trust-store=file:{{ tengines_truststore | default(java_home + '/lib/security/cacerts') }}
-server.ssl.trust-store-password={{ tengines_truststore_pass | default('changeit') }}
-server.ssl.trust-store-type=JCEKS
+server.ssl.trust-store=file:{{ transformers_truststore_path }}
+server.ssl.trust-store-password={{ transformers_truststore_pass }}
+server.ssl.trust-store-type={{ transformers_truststore_type }}
 server.ssl.client-auth=need
 
 client.ssl.key-store=file:{{ ats_keystore.path | quote }}
 client.ssl.key-store-password={{ ats_keystore.pass | default('') }}
 client.ssl.key-store-type={{ ats_keystore.type | default('JCEKS') }}
-client.ssl.trust-store=file:{{ tengines_truststore | default(java_home + '/lib/security/cacerts') }}
-client.ssl.trust-store-password={{ tengines_truststore_pass | default('changeit') }}
-client.ssl.trust-store-type=JCEKS
+client.ssl.trust-store=file:{{ transformers_truststore_path }}
+client.ssl.trust-store-password={{ transformers_truststore_pass }}
+client.ssl.trust-store-type={{ transformers_truststore_type }}
 client.ssl.hostname-verification-disabled=true

roles/trouter/defaults/main.yml

@@ -6,3 +6,7 @@ trouter_environment:
     - -Xmx512m
 utils_trouter: []
 ats_keystore: {}
+
+trouter_truststore_path: "{{ java_home + '/lib/security/cacerts' }}"
+trouter_truststore_pass: 'changeit'
+trouter_truststore_type: "{% if java_major | int >= 21 %}pkcs12{% else %}JCEKS{% endif %}"

roles/trouter/templates/mtls.properties.j2

@@ -3,15 +3,15 @@ server.ssl.key-password={{ ats_keystore.pass | default('') }}
 server.ssl.key-store=file:{{ ats_keystore.path | quote }}
 server.ssl.key-store-password={{ ats_keystore.pass | default('') }}
 server.ssl.key-store-type={{ ats_keystore.type | default('JCEKS') }}
-server.ssl.trust-store=file:{{ tengines_truststore | default(java_home + '/lib/security/cacerts') }}
-server.ssl.trust-store-password={{ tengines_truststore_pass | default('changeit') }}
-server.ssl.trust-store-type=JCEKS
+server.ssl.trust-store=file:{{ trouter_truststore_path }}
+server.ssl.trust-store-password={{ trouter_truststore_pass }}
+server.ssl.trust-store-type={{ trouter_truststore_type }}
 server.ssl.client-auth=need
 
 client.ssl.key-store=file:{{ ats_keystore.path | quote }}
 client.ssl.key-store-password={{ ats_keystore.pass | default('') }}
 client.ssl.key-store-type={{ ats_keystore.type | default('JCEKS') }}
-client.ssl.trust-store=file:{{ tengines_truststore | default(java_home + '/lib/security/cacerts') }}
-client.ssl.trust-store-password={{ tengines_truststore_pass | default('changeit') }}
-client.ssl.trust-store-type=JCEKS
+client.ssl.trust-store=file:{{ trouter_truststore_path }}
+client.ssl.trust-store-password={{ trouter_truststore_pass }}
+client.ssl.trust-store-type={{ trouter_truststore_type }}
 client.ssl.hostname-verification-disabled=true