Java Requirements

CDP Private Cloud Base comprises of Cloudera Manager and Runtime services. Understand the specific JDK requirements for your deployments.

Supported JDKs

Refer the Cloudera Support Matrix for detailed information about supported JDKs.

For Cloudera Runtime services, JDK-17 is provided as an additional platform support for Cloudera Runtime 7.1.9.

Supported JDK versions

Table 1. Azul Open JDK versions that are tested and recommended
Azul Open JDK Version	Notes
17.0.7
11.50.19
8.56.0.21	Minimum required version

Table 2. Oracle JDK versions that are tested and recommended
Oracle JDK Version	Notes
17.0.6
11.0.10+8
1.8u181	Minimum required version

Table 3. OpenJDK versions that are tested and recommended
OpenJDK Version	Notes
17.0.7
11.0.4+11
1.8u231	For FIPS minimum required / latest version tested
1.8u232	Minimum required / Latest version tested

warning

Spark3 in CDE uses OpenJDK 11.0.17 which causes a Kerberos issue when deprecated 3DES and RC4 permitted encryption types are used.
Workaround: Remove the deprecated 3DES and RC4 encryption types in the krb5.conf and kdc.conf files.
JDK 8u271, JDK 8u281, and JDK 8u291 may cause socket leak issues due to JDK-8245417 and JDK-8256818. Pay attention to the build version of your JDK because some later builds are fixed as described in JDK-8256818.

Workaround: Consider using a more recent version of the JDK like 8u282, or builds of the JDK where the issue is fixed.
Upgrading to Oracle JDK 1.8.351 or higher, OpenJDK 11.0.17 or higher, or OpenJDK 1.8.392 causes a Kerberos issue when deprecated 3DES and RC4 permitted encryption types are used. You can workaround this issue by removing the deprecated 3DES and RC4 encryption types in the krb5.conf and kdc.conf files.
Spark3 in CDE uses OpenJDK 11.0.17 which causes a Kerberos issue when deprecated 3DES and RC4 permitted encryption types are used.
Workaround: Remove the deprecated 3DES and RC4 encryption types in the krb5.conf and kdc.conf files.
JDK 8u40, 8u45, and 8u60 are not supported due to JDK issues impacting CDH functionality:
- JDK 8u40 and 8u45 are affected by JDK-8077155, which affects HTTP authentication for certain web UIs.
- JDK 8u60 is incompatible with the AWS SDK, and causes problem with DistCP. For more information, see the KB article.
Oozie Workflow Graph Display in Hue does not work properly with JDK versions lower than 8u40.
The default value of the YARN config Add add-opens flags to MR containers is false regardless of the JDK, Cloudera Manager or CDP version. To run distcp or any MapReduce application, this config must be turned on whenever JDK17 is used.
If you are using JDK 17 on your cluster, you must run the JVM option --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.management/com.sun.jmx.mbeanserver=ALL-UNNAMED --add-exports=java.management/com.sun.jmx.mbeanserver=ALL-UNNAMED --add-exports=java.base/sun.net.dns=ALL-UNNAMED --add-exports=java.base/sun.net.util=ALL-UNNAMED to ensure the jobs run successfully.

Support Notes

Only 64 bit JDKs are supported.

Unless specifically excluded, Cloudera supports later updates to a major JDK release from the release that support was introduced. Cloudera excludes or removes support for select Java updates when security is jeopardized.

Running Runtime nodes within the same cluster on different JDK releases is not supported. All cluster hosts must use the same JDK update level.