Cloudera Docs

Java Requirements

Cloudera Base on premises comprises Cloudera Manager and Cloudera Runtime services. To successfully upgrade the service, you need the following Java prerequisites.

Supported JDK versions

See the Cloudera Support Matrix for detailed information about supported JDK versions.

As Cloudera transitions to JDK 17 as its default OpenJDK release, the upgrade flow assumes that you must upgrade the existing OpenJDK from the current release to JDK 17 before starting the upgrade process, unless specifically stated otherwise.

  • The current version of OpenJDK 17 is 17.0.16 (as of September 2025).
  • For OpenJDK, Oracle JDK, or Azul JDK, Cloudera requires a minimum release of 17.0.11. Use the latest releases, as Cloudera supports them and prefers them, even if documentation does not list them.

Configuring Required JDK 17 JVM Parameters (add-opens and add-exports) for Cloudera Runtime Components

When using JDK 17, Cloudera Runtime components and applications (such as YARN, MapReduce, Spark, and Hive) require explicit Java reflection and package export access (--add-opens and --add-exports flags) to run successfully.

In Cloudera Manager 7.13.1 and 7.13.2 / Cloudera Runtime 7.3.1, 7.3.2, and higher versions, these required parameters are automatically pre-configured by default. No manual configuration is required.

However, for CDP Private Cloud Base 7.1.9 (Base, SP1, and SP2), you must verify their presence. If missing, configure the relevant service in Cloudera Manager to handle them automatically by performing the following steps.

YARN (MapReduce and DistCP Applications)

Running MapReduce Application Masters (AM) and MapReduce containers with JDK 17 requires specific Java reflection access flags. These parameters are typically managed automatically in the NodeManager environment (yarn_nodemanager_admin_env).

You must verify if these parameters are present. If they are missing, you do not need to turn on container flags manually. Instead, you can configure Cloudera Manager to handle them automatically using one of the following two methods:
Method 1: Enable mapreduce_jvm_add_opens_as_default (Recommended)
This property automatically appends the required JDK 17 flags to the MapReduce Application Master (AM) and map/reduce container launch commands.

  1. Log in to the Cloudera Manager Admin Console.

  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the YARN service.

  3. Click on the Configuration tab at the top of the YARN service page.

  4. In the Search filter box on the left, type or paste the exact configuration key: mapreduce_jvm_add_opens_as_default

  5. Locate the property in the filtered results (it is typically titled Add add-opens flags to MR containers).

  6. Select the checkbox to change its value from false to true.

  7. Click Save Changes.

  8. Select Restart from the list of Actions at the top of the page to restart the affected YARN/MapReduce service components.

Method 2: Manually Update the NodeManager Admin Environment
If you prefer not to use the automated flag, you can explicitly inject the three required parameters into the NodeManager service's environment configurations.

  1. Log in to the Cloudera Manager Admin Console.

  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the YARN service.

  3. Click on the Configuration tab at the top of the YARN service page.

  4. In the Search filter box on the left, type or paste the configuration key: yarn_nodemanager_admin_env

  5. Locate the Containers Environment Variable property.

  6. Click into the value field and append the following three flags on a single line (ensure they are space-separated):

    --add-opens=java.base/java.lang=ALL-UNNAMED --add-exports=java.base/sun.net.dns=ALL-UNNAMED --add-exports=java.base/sun.net.util=ALL-UNNAMED

  7. Click Save Changes.

  8. Select Restart from the list of Actions at the top of the page to restart the affected YARN/MapReduce service components.

Hive on Tez
To manually add the parameters for JDK 17, do the following steps:
  1. Log in to the Cloudera Manager Admin Console.
  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the Tez service.
  3. Click on the Configuration tab at the top of the Tez service page.
  4. In the Search filter box on the left, type or paste the configuration key: tez.am.launch.cmd-opts and tez.task.launch.cmd-opts.

  5. Click into the value field and append the following three flags on a single line (ensure they are space-separated):

    
--add-opens=java.base/java.lang=ALL-UNNAMED 
--add-exports=java.base/sun.net.dns=ALL-UNNAMED 
--add-exports=java.base/sun.net.util=ALL-UNNAMED 
--add-opens java.base/java.net=ALL-UNNAMED
--add-opens java.base/java.util=ALL-UNNAMED
--add-opens java.base/java.util.concurrent.atomic=ALL-UNNAMED
--add-opens java.base/java.util.regex=ALL-UNNAMED
--add-opens java.base/java.lang=ALL-UNNAMED
--add-opens java.base/java.time=ALL-UNNAMED
--add-opens java.base/java.io=ALL-UNNAMED
--add-opens java.base/java.nio=ALL-UNNAME
  6. Click Save Changes.

  7. Select Restart from the list of Actions at the top of the page to restart the affected services.

Ranger Admin

To ensure full compatibility when running Apache Ranger service with JDK 17, you must append specific Java runtime flags to the Ranger Admin environment configuration snippet (safety valve) in Cloudera Manager.

  1. Log in to the Cloudera Manager Admin Console.

  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the Ranger service.

  3. Click on the Configuration tab at the top of the Ranger service page.

  4. In the Search filter box on the left, type or paste the configuration key: RANGER_ADMIN_role_env_safety_valve or Ranger Admin Environment Advanced Configuration Snippet (Safety Valve).

  5. In the configuration snippet field, add a key-value pair by entering:

    • Key: JAVA_OPTS

    • Value:
      --add-opens java.base/java.nio=ALL-UNNAMED --add-exports java.base/sun.net.dns=ALL-UNNAMED --add-exports java.base/sun.net.util=ALL-UNNAMED

  6. Click Save Changes.

  7. Select Restart from the list of Actions at the top of the page to restart the Ranger service and all affected roles.

Ranger Tagsync

To ensure full compatibility when running Apache Ranger service with JDK 17, you must append specific Java runtime flags to the Ranger Tagsync environment configuration snippet (safety valve) in Cloudera Manager.

  1. Log in to the Cloudera Manager Admin Console.

  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the Ranger service.

  3. Click on the Configuration tab at the top of the Ranger service page.

  4. In the Search filter box on the left, type or paste the configuration key: RANGER_TAGSYNC_role_env_safety_valve or Ranger Tagsync Environment Advanced Configuration Snippet (Safety Valve).

  5. In the configuration snippet field, add a key-value pair by entering:

    • Key: JAVA_OPTS

    • Value:
      --add-opens java.management/java.lang.management=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-exports java.base/sun.net.dns=ALL-UNNAMED

  6. Click Save Changes.

  7. Select Restart from the list of Actions at the top of the page to restart the Ranger service and all affected roles.

Ranger Usersync

To ensure full compatibility when running Apache Ranger service with JDK 17, you must append specific Java runtime flags to the Ranger Usersync environment configuration snippet (safety valve) in Cloudera Manager.

  1. Log in to the Cloudera Manager Admin Console.

  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the Ranger service.

  3. Click on the Configuration tab at the top of the Ranger service page.

  4. In the Search filter box on the left, type or paste the configuration key: RANGER_USERSYNC_role_env_safety_valve or Ranger Usersync Environment Advanced Configuration Snippet (Safety Valve).

  5. In the configuration snippet field, add a key-value pair by entering:

    • Key: JAVA_OPTS

    • Value:
      --add-opens java.management/java.lang.management=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-exports java.base/sun.net.dns=ALL-UNNAMED

  6. Click Save Changes.

  7. Select Restart from the list of Actions at the top of the page to restart the Ranger service and all affected roles.

Ranger KMS

To ensure full compatibility when running Apache Ranger KMS service with JDK 17, you must append specific Java runtime flags to the Ranger KMS environment configuration snippet (safety valve) in Cloudera Manager.

  1. Log in to the Cloudera Manager Admin Console.

  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the Ranger KMS service.

  3. Click on the Configuration tab at the top of the Ranger KMS service page.

  4. In the Search filter box on the left, type or paste the configuration key: RANGER_KMS_service_env_safety_valve or Ranger KMS Service Environment Advanced Configuration Snippet (Safety Valve).

  5. In the configuration snippet field, add a key-value pair by entering:

    • Key: JAVA_OPTS

    • Value:
      --add-exports java.xml.crypto/com.sun.org.apache.xml.internal.security.utils=ALL-UNNAMED --add-exports java.base/sun.net.dns=ALL-UNNAMED

  6. Click Save Changes.

  7. Select Restart from the list of Actions at the top of the page to restart the Ranger KMS service.

Ranger RAZ

To ensure full compatibility when running Apache Ranger RAZ service with JDK 17, you must append specific Java runtime flags to the Ranger RAZ environment configuration snippet (safety valve) in Cloudera Manager.

  1. Log in to the Cloudera Manager Admin Console.

  2. From the main dashboard or the Clusters drop-down menu, select your cluster and click on the Ranger RAZ service.

  3. Click on the Configuration tab at the top of the Ranger RAZ service page.

  4. In the Search filter box on the left, type or paste the configuration key: RANGER_RAZ_service_env_safety_valve or Ranger Raz Service Environment Advanced Configuration Snippet (Safety Valve).

  5. In the configuration snippet field, add a key-value pair by entering:

    • Key: JAVA_OPTS

    • Value:
      --add-opens java.base/java.lang=ALL-UNNAMED --add-exports java.base/sun.net.dns=ALL-UNNAMED --add-exports java.base/sun.net.util=ALL-UNNAMED

  6. Click Save Changes.

  7. Select Restart from the list of Actions at the top of the page to restart the Ranger RAZ service.

Important JDK Support Matrix and Configuration Notes

Review critical Java compatibility requirements, configuration guidelines, and operational constraints for Cloudera Manager and Cloudera Runtime components before deploying or updating your JDK environment.